What it does
KAPE, the Kroll Artifact Parser and Extractor, uses target and module configurations to collect and process forensic artifacts.
KAPE separates what to collect from what processes the collection. Its official explanation describes targets and modules, which lets an investigator focus a triage on evidence relevant to the case. Preserve the chosen configurations and source context with the results. The vendor notes an enterprise license for commercial engagements, so a free download should not be treated as unrestricted permission for every professional use. Its triage role can precede a fuller image-based examination without replacing evidence-preservation requirements.
Strengths
- Configurable artifact targets and processing modules
Watch out for
- Commercial engagements require review of the enterprise-license terms
Best for
- Authorized forensic responders performing targeted triage
Sources
- Kroll Artifact Parser and Extractor - KAPE (Oct 26, 2026)