Tools · Triage collection and timelines · 05 / 24
KAPE: what the copy log shows, and what it does not
Read a KAPE copy log as proof a path was copied and hashed. It is not a malware verdict, an execution record, or a full inventory of the disk.
A row is a copy, not a verdict
Each line of the copy log names a source path, the destination inside the package, a size, and a SHA-1 of the source bytes. That line is evidence the collector saw that path and stored a copy whose digest is written down. Keep the log with the package so a later reader can check the same path.
The digest identifies bytes. It does not say whether those bytes are expected, unwanted, or unknown. A finding that says “malicious” needs a separate basis you can cite. The copy log is not that basis.
SourceFile,DestinationFile,FileSize,SourceFileSha1,DeferredCopy C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareCenter\DailyInventory,C\Windows\...\DailyInventory,1840,lab-digest-1,False C:\Users\riley\Desktop\budget-notes.txt,C\Users\riley\Desktop\budget-notes.txt,902,lab-digest-2,False
Counts and deferred copies
The console line that reports how many files were copied is the size of this target’s result, including a deduplicated tally for paths already stored. It is not a census of the volume. Paths the target never listed are simply absent, and absence from the log is not proof they were absent on disk.
DeferredCopy true means the file was locked and the copy was postponed. An empty destination on that row means “not copied yet,” not “the path did not exist.” Write the flag next to the path before you treat the package as missing that file.
Claims the log can carry
You may write that the path was in the package, the size, the digest, and the timestamps the log stored. You may write that a second copy of the same path was skipped as a duplicate. You may not write, from this file alone, that the program ran, that a person opened it, or that the host contained nothing else.
Execution, if you need it, comes from a parser aimed at prefetch, a shim, or an event. That is a different output. Point the finding at that output, and point the collection statement at the copy log.
Worked case: a digest treated as a conclusion
On lab host ACCT-04 the package includes budget-notes.txt with a digest and DeferredCopy false. A draft finding says the digest “confirms unwanted software.” Nothing in the row talks about software reputation. The corrected line says the desktop file was copied, quotes the digest, and says execution was not claimed here.
A second row, a locked hive, has DeferredCopy true and no destination digest. The draft had said the hive was not on the host. The corrected line says the hive was seen and the copy was deferred. The finding waits for that deferred copy, or it states that this package does not yet contain the hive.
Diagram
A copy-log line versus an over-read
The row supports the left-hand facts only.
Path. The source path was copied, or marked deferred
Bytes. The recorded digest identifies that copy
Limit. The target list, not the whole disk
Verdict. No reputation or “malicious” conclusion
Activity. No statement that the file ran or was opened
Absence. A missing path was outside the target, or not copied yet
Check yourself
1. What does the SHA-1 on a copy-log row support?
2. DeferredCopy is true and the destination is empty. Which reading fits?
3. The console says 640 files were copied. What is that number?