Windows artifacts
95 KAPE targets for Windows forensic collection in the Windows category.
Targets
95 in the Windows category
- $Bitmap$Bitmap1 path
- $Boot$Boot1 path
- $J$J4 paths
- $LogFile$LogFile1 path
- $MFT$MFT1 path
- $MFTMirr$MFTMirr1 path
- $SDS$SDS2 paths
- $T$T2 paths
- ActiveDirectoryNTDSActive Directory NTDS1 path
- ActiveDirectorySysvolActive Directory Sysvol1 path
- AmcacheAmcache.hve and databases6 paths
- AppCompatPCAAppCompat PCA Folder1 path
- AppXPackagesAppXPackages5 paths
- ApplicationEventsWindows Application Event Log4 paths
- BCDBoot Configuration Files2 paths
- BITSMicrosoft BITS (Background Intelligent Transer Service) persistent files1 path
- CapabilityAccessManagerCapability Access Manager database1 path
- CertUtilCertutil4 paths
- DriversWindows Drivers1 path
- EncapsulationLoggingEncapsulationLogging4 paths
- EventLogs-RDPCollect Win7+ RDP related Event logs12 paths
- EventLogsEvent logs3 paths
- EventTraceLogsEvent Trace Logs10 paths
- EventTranscriptDBEventTranscript.db (and other files related to Telemetry and Diagnostic Data)3 paths
- ExchangeClientAccessExchange Client Access Log Files1 path
- ExchangeCve-2021-26855Exchange Server Vulnerability *.Compiled Files4 paths
- ExchangeSetupLogExchange Setup Log1 path
- ExchangeTransportExchange Transport Log Files1 path
- GroupPolicyCurrent Group Policy Enforcement8 paths
- HostsFileHosts file1 path
- IISConfigurationIIS4 paths
- IconCacheDBIconCache.db files1 path
- ImpacketSMBExecImpacket SMBExec Artifacts1 path
- JumpListsJump lists2 paths
- LNKFilesAndJumpListsLNK Files and jump lists8 paths
- LinuxOnWindowsProfileFilesLinux on Windows Profile Files4 paths
- LogFilesLogFiles (includes SUM)3 paths
- MOFMOF files (WMI)1 path
- MemoryFilesMemory Files5 paths
- MicrosoftOfficeBackstageMicrosoft Office Backstage1 path
- NETCLRUsageLogs.NET CLR UsageLogs2 paths
- NotepadA Target to collect files that are currently open in Notepad (Windows 11+)4 paths
- OfficeAutosaveOffice Autosave4 paths
- OfficeDiagnosticsOffice Diagnostics2 paths
- OfficeDocumentCacheOffice Document Cache1 path
- PerfLogsPerflogs Folder Copy1 path
- PowerShell7ConfigPowerShell 7 Runtime Config1 path
- PowerShellTranscriptsPowerShell Transcripts6 paths
- PrefetchPrefetch files2 paths
- ProgramDataProgramData Folder Copy1 path
- PushNotificationWindows Push Notification Service2 paths
- QuickAssistMicrosoft Quick Assist/Remote Help2 paths
- RDPCacheRDP Cache Files3 paths
- RDPJumplistRDP Jumplist Files1 path
- RDPLogsRDP Logs8 paths
- RecentFileCacheRecentFileCache2 paths
- RecentFoldersRecent Folders LNK files2 paths
- RecycleBin_DataFilesRecycle Bin Data Files3 paths
- RecycleBin_InfoFilesRecycle Bin Info Files2 paths
- RegistryHivesMSIXAppsMSIX/APPX App Hives6 paths
- RegistryHivesOtherOther Registry Hives28 paths
- RegistryHivesSystemSystem level/related Registry hives41 paths
- RegistryHivesUserUser Related Registry hives9 paths
- RoamingProfileUser Related Registry Hives, LNK files, etc73 paths
- SCCMClientLogsSCCM Client Log Files1 path
- SDBShim SDB FIles4 paths
- SRUMSystem Resource Usage Monitor (SRUM) Data6 paths
- SUMSUM Database1 path
- ScheduledTasksScheduled tasks (*.job and XML)13 paths
- SignatureCatalogObtain detached signature catalog files2 paths
- SnipAndSketchSnip & Sketch Cached Images3 paths
- SnippingToolSnippingTools screenshots2 paths
- StartupFoldersStartup Folders2 paths
- StartupInfoStartupInfo XML Files2 paths
- Syscachesyscache.hve2 paths
- ThumbCacheThumbcache DB1 path
- USBDevicesLogsUSB devices log files3 paths
- UsersFoldersUsers folders Dump1 path
- VirtualDisksVirtual Disks4 paths
- WBEMWeb-Based Enterprise Management (WBEM)2 paths
- WERWindows Error Reporting5 paths
- WindowsAppWindowsApp Logs1 path
- WindowsCopilotRecallWindows Copilot+ Recall1 path
- WindowsFirewallWindows Firewall Logs2 paths
- WindowsHelloWindows Hello23 paths
- WindowsIndexSearchWindows Index Search4 paths
- WindowsNetworkWindows Networks settings1 path
- WindowsNotificationsDBWindows 10 Notification DB2 paths
- WindowsOSUpgradeArtifactsWindows OS Upgrade Artifacts5 paths
- WindowsPowerDiagnosticsWindows Power Diagnostics1 path
- WindowsServerDNSAndDHCPWindows Server DNS and DHCP log files3 paths
- WindowsTelemetryDiagnosticsLegacyLegacy Windows Telemetry and Diagnostics files (*.rbs)2 paths
- WindowsTimelineActivitiesCache.db collector1 path
- WindowsUpdateWindows Update Logs4 paths
- XPRestorePointsXP Restore Points - System Volume Information directory1 path