Compound artifacts
36 KAPE targets for Windows forensic collection in the Compound category.
Targets
36 in the Compound category
- BasicCollectionBasic Collection12 targets
- SANS_TriageSANS Triage Collection23 targets
- AICodingAgentsAI coding agent harnesses (Claude Code, OpenAI Codex, GitHub Copilot, Gemini CLI, OpenCode, Cursor, Cline, Roo Code) and the IDE that hosts their extensions9 targets
- AntivirusAntivirus28 targets
- CloudStorage_AllCloud Storage Contents and Metadata8 targets
- CloudStorage_MetadataCloud Storage Metadata8 targets
- CloudStorage_OneDriveExplorerOneDrive and other files used with OneDriveExplorer3 targets
- CombinedLogsCollect Event logs, Trace logs, Windows Firewall, PowerShell console logs, and .NET CLR UsageLogs7 targets
- EvidenceOfExecutionEvidence of execution related files5 targets
- ExchangeExchange Log Files3 targets
- FTPClientsFTP Clients4 targets
- FileExplorerReplacementsFile Explorer Replacements12 targets
- FileSystemFile system metadata6 targets
- IRCClientsIRC Clients3 targets
- KapeTriageKapeTriage collects most of the files needed for a DFIR Investigation. This Target pulls evidence from File System files, Registry Hives, Event Logs, Scheduled Tasks, Evidence of Execution, SRUM data, SUM data, Cloud metadata, WER, WBEM, Web Browser data (IE/Edge, Chrome, Mozilla history), LNK Files, JumpLists, Notepad unsaved sessions (Win11), 3rd party remote access software logs, 3rd party antivirus software logs, Windows 10/11 Timeline database, and $I Recycle Bin files.18 targets
- MessagingClientsMessaging and communication apps11 targets
- MiniTimelineCollectionMFT, Registry and Event Logs to generate a mini timeline3 targets
- NetworkScannerNetwork Scanner Tools3 targets
- P2PClientsP2P Clients6 targets
- PackageManagersCompound Target for files related to package managers1 targets
- ProgramExecutionProgram Execution Triage Collection12 targets
- RecycleBinRecycle Bin DataAndInfo2 targets
- RegistryHivesSystem and user related Registry hives3 targets
- RemoteAdminComposite target for files related to remote administration tools66 targets
- SOFELKSOF-ELK related files of interest5 targets
- SQLiteDatabasesSQLDatabases Target for use with SQLECmd Module106 paths
- ServerTriageA compound target for gathering artifacts common to servers.7 targets
- TorrentClientsTorrent Clients3 targets
- USBDetectiveCollects files that can be input into USB Detective for parsing5 targets
- UsenetClientsUsenet Clients4 targets
- VMwareRuns all VMware modules to collect VMware VM config files, logs and Virtual Hard Disks3 targets
- VPNClientsVPN Clients5 targets
- VirtualBoxRuns all VirtualBox modules to collect Virtualbox VM config files, logs and Virtual Hard Disks4 targets
- WSLAll Windows Subsystem for Linux targets5 targets
- WebBrowsersWeb browser history, bookmarks, etc.25 targets
- WebServersLogs from all known web server applications and supporting services4 targets