KapeTriage
KapeTriage collects most of the files needed for a DFIR Investigation. This Target pulls evidence from File System files, Registry Hives, Event Logs, Scheduled Tasks, Evidence of Execution, SRUM data, SUM data, Cloud metadata, WER, WBEM, Web Browser data (IE/Edge, Chrome, Mozilla history), LNK Files, JumpLists, Notepad unsaved sessions (Win11), 3rd party remote access software logs, 3rd party antivirus software logs, Windows 10/11 Timeline database, and $I Recycle Bin files.
- 1,199 paths from 152 artifacts
- Per-user data
- Version 4.2
- Scott Downie
Paths on disk
1199 paths from 152 targets
Includes 18 targets
Each one is collected with this target
- Antivirus
- CloudStorage_Metadata
- EventLogs3 paths
- EvidenceOfExecution
- FileSystem
- LNKFilesAndJumpLists8 paths
- Notepad
- PowerShellConsole5 paths
- RecycleBin_InfoFiles2 paths
- RegistryHives
- RemoteAdmin
- ScheduledTasks13 paths
- SRUM6 paths
- SUM1 path
- WER5 paths
- WBEM2 paths
- WebBrowsers
- WindowsTimeline1 path