HackBlue

Tools · Triage collection and timelines · 01 / 04

KAPE: collect a triage package and parse it with modules

Run KAPE with the KapeTriage target to copy key Windows artifacts into a VHDX with a copy log, then run EZ Tools modules over the copy so analysis never touches the original host.

12 min read · practice only with authorization

Targets copy, modules parse

KAPE separates collection from processing. Targets (.tkape files) list artifacts to copy: registry hives, event logs, prefetch, the $MFT, browser history, and more. Modules (.mkape files) run tools such as Eric Zimmerman’s parsers over the copied files. KapeTriage is a compound target that bundles the common triage set.

Collect only from hosts named in the investigation, and record who approved the collection. KAPE needs administrator rights on the host to read locked files.

A collection into a VHDX

--tsource is the volume to collect from, --tdest the output folder. --vhdx packs the copy into a virtual disk named after the host, which keeps original paths and timestamps and is easy to mount later. Run it from removable media or a network share, not from the host’s own disk.

Snippet
E:\kape\kape.exe --tsource C: --tdest E:\cases\HB-114\WS-07\tout ^
  --target KapeTriage --vhdx WS-07 --zv false --tflush

2026-11-02 10:03:11 Found 1,842 files in 12.4 seconds. Copying...
2026-11-02 10:04:40 Copied 1,842 (deduplicated: 37) files in 89.2 seconds
2026-11-02 10:04:52 Created VHDX: E:\cases\HB-114\WS-07\tout\2026-11-02T100311_WS-07.vhdx

The copy log is part of the evidence

KAPE writes a CSV next to the output listing each source path, destination, and SHA-1 hash, plus a console log of the run. Keep both with the VHDX; they show what was collected, when, and that the copy matches.

Snippet
SourceFile,DestinationFile,FileSize,SourceFileSha1,DeferredCopy,CreatedOnUtc,ModifiedOnUtc,LastAccessedOnUtc,CopyDuration
C:\Windows\prefetch\POWERSHELL.EXE-920BBA2A.pf,C\Windows\prefetch\POWERSHELL.EXE-920BBA2A.pf,28441,2f7a...,False,2026-09-14 08:00:01,2026-10-28 09:12:44,2026-10-28 09:12:44,00:00:00.002

Worked processing step

On the analysis workstation, mount the VHDX read-only and run the !EZParser compound module against it. It produces CSVs for prefetch, the registry, event logs, and the MFT. The analyst opens the prefetch CSV first: POWERSHELL.EXE ran 3 times, last at 09:12:44 on 28 October, which matches the alert time.

Snippet
E:\kape\kape.exe --msource F:\C --mdest E:\cases\HB-114\WS-07\mout --module !EZParser --mflush

E:\cases\HB-114\WS-07\mout\ProgramExecution\20261102_PECmd_Output.csv
E:\cases\HB-114\WS-07\mout\EventLogs\20261102_EvtxECmd_Output.csv

Diagram

Triage with KAPE without touching the original twice

  1. Approve

    Name the host and record who authorised collection.

    Note
    Case HB-114, host WS-07, approved by IR lead
  2. Collect

    Copy the triage target into a VHDX.

    Command
    kape.exe --tsource C: --tdest E:\cases\HB-114\WS-07\tout --target KapeTriage --vhdx WS-07
  3. Preserve

    Keep the copy log with SHA-1 hashes.

    File
    *_CopyLog.csv
  4. Parse

    Run modules on the mounted copy.

    Command
    kape.exe --msource F:\C --mdest ...\mout --module !EZParser

Check yourself

1. What is the difference between a KAPE target and a module?

2. Why collect into a VHDX?

3. Which file shows exactly what KAPE copied and the hash of each source file?