Triage Collections
40 pre-built KAPE compound targets for rapid forensic acquisition
Compound targets combine multiple individual targets into a single collection. Use these for comprehensive triage acquisition with a single KAPE command.
Featured collections
4 starting points for triage
SANS_Triage
SANS Triage Collection
23 targets180 resolved1351 paths
KapeTriage
KapeTriage collects most of the files needed for a DFIR Investigation. This Target pulls evidence from File System files, Registry Hives, Event Logs, Scheduled Tasks, Evidence of Execution, SRUM data, SUM data, Cloud metadata, WER, WBEM, Web Browser data (IE/Edge, Chrome, Mozilla history), LNK Files, JumpLists, Notepad unsaved sessions (Win11), 3rd party remote access software logs, 3rd party antivirus software logs, Windows 10/11 Timeline database, and $I Recycle Bin files.
18 targets152 resolved1199 paths
BasicCollection
Basic Collection
12 targets23 resolved125 paths
EvidenceOfExecution
Evidence of execution related files
5 targets5 resolved13 paths
All collections
Pre-built compound targets
- RemoteAdminComposite target for files related to remote administration toolsby Drew Ervin, Mathias Frank, Andrew Rathbun, Phill Moore, Paul Cabon CERT Almond66 targets
- AntivirusAntivirusby Andrew Rathbun28 targets
- WebBrowsersWeb browser history, bookmarks, etc.by Eric Zimmerman25 targets
- SANS_TriageSANS Triage Collectionby Mark Hallman23 targets
- KapeTriageKapeTriage collects most of the files needed for a DFIR Investigation. This Target pulls evidence from File System files, Registry Hives, Event Logs, Scheduled Tasks, Evidence of Execution, SRUM data, SUM data, Cloud metadata, WER, WBEM, Web Browser data (IE/Edge, Chrome, Mozilla history), LNK Files, JumpLists, Notepad unsaved sessions (Win11), 3rd party remote access software logs, 3rd party antivirus software logs, Windows 10/11 Timeline database, and $I Recycle Bin files.by Scott Downie18 targets
- BasicCollectionBasic Collectionby Phill Moore12 targets
- FileExplorerReplacementsFile Explorer Replacementsby Andrew Rathbun12 targets
- ProgramExecutionProgram Execution Triage Collectionby Max Zabuty12 targets
- MessagingClientsMessaging and communication appsby Gregor Wegberg11 targets
- AICodingAgentsAI coding agent harnesses (Claude Code, OpenAI Codex, GitHub Copilot, Gemini CLI, OpenCode, Cursor, Cline, Roo Code) and the IDE that hosts their extensionsby Eric Capuano9 targets
- CloudStorage_AllCloud Storage Contents and Metadataby Chad Tilbury and Andrew Rathbun8 targets
- CloudStorage_MetadataCloud Storage Metadataby Chad Tilbury and Andrew Rathbun, Eric Capuano, Szymon Andrzejewski8 targets
- CombinedLogsCollect Event logs, Trace logs, Windows Firewall, PowerShell console logs, and .NET CLR UsageLogsby Mike Cary, Mark Hallman added the USBDevicelogs target, Thomas DIOT (Qazeer) added the .NET CLR UsageLogs and PowerShell Transcripts target7 targets
- ServerTriageA compound target for gathering artifacts common to servers.by Eric Capuano7 targets
- FileSystemFile system metadataby Eric Zimmerman6 targets
- P2PClientsP2P Clientsby Andrew Rathbun6 targets
- EvidenceOfExecutionEvidence of execution related filesby Eric Zimmerman5 targets
- SOFELKSOF-ELK related files of interestby Tony Knutson and Andrew Rathbun5 targets
- USBDetectiveCollects files that can be input into USB Detective for parsingby Kevin Pagano5 targets
- VPNClientsVPN Clientsby Evangelos Dragonas - Paul CABON CERT Almond5 targets
- WSLAll Windows Subsystem for Linux targetsby Matt Dawson5 targets
- FTPClientsFTP Clientsby Andrew Rathbun4 targets
- UsenetClientsUsenet Clientsby Andrew Rathbun4 targets
- VirtualBoxRuns all VirtualBox modules to collect Virtualbox VM config files, logs and Virtual Hard Disksby Matt Dawson4 targets
- WebServersLogs from all known web server applications and supporting servicesby Eric Capuano4 targets
- CloudStorage_OneDriveExplorerOneDrive and other files used with OneDriveExplorerby Brian Maloney3 targets
- ExchangeExchange Log Filesby Keith Twombley3 targets
- IRCClientsIRC Clientsby Andrew Rathbun3 targets
- MiniTimelineCollectionMFT, Registry and Event Logs to generate a mini timelineby Mari DeGrazia3 targets
- NetworkScannerNetwork Scanner Toolsby Reece3943 targets
- RegistryHivesSystem and user related Registry hivesby Eric Zimmerman3 targets
- TorrentClientsTorrent Clientsby Andrew Rathbun3 targets
- VMwareRuns all VMware modules to collect VMware VM config files, logs and Virtual Hard Disksby Matt Dawson3 targets
- RecycleBinRecycle Bin DataAndInfoby Mark Hallman / Joshua Hickman2 targets
- SophosSophos Databy Drew Ervin, Reece3941 target
- Symantec_AV_LogsSymantec AV Logsby Brian Maloney1 target
- LogMeInLogMeIn Databy Drew Ervin1 target
- ScreenConnectScreenConnect Data (now known as ConnectWise Control)by Drew Ervin1 target
- VNCLogsVNC Logsby Phill Moore, Evangelos Dragonas1 target
- PackageManagersCompound Target for files related to package managersby Paul CABON (CERT CWATCH - ALMOND)1 target