Introduction to KAPE

As a continuation of the "Introduction to Windows Forensics" series, this episode covers an exciting new tool from Kroll and Eric Zimmerman called KAPE. From the developer, KAPE is an efficient and highly configurable triage program that will target essentially any device or storage location, find forensically useful artifacts, and parse them within a few minutes.
** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. **
Introducing KAPE (Kroll Website):
www.kroll.com/...
Introducing KAPE (Eric Zimmerman's Blog):
binaryforay.bl...
Background Music Courtesy of Anders Enger Jensen:
/ hariboosx
#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics #KAPE

[@s.8494]

Your videos are really valuable, thank you for the content you provide.

[@richmcelroy2382]

Thanks. I just downloaded to test and your video made starting much easier. Keep up the good work

[@mateusfernandotorranocouto624]

😢

[@lautarob]

Excellent video, as usual. Thanks!

[@christianjohansen9068]

Great intro video, thanks for taking the time!

[@TheMeltzz]

Is so easy to understand with your video

[@IBITZEE]

Great video.. Thanks...
I was testing the EZ tools individually but this aggregation too seems more useful...
Please make a video about he available modules and what they do...
Thanks again...

[@ivanbogdasaebersold4690]

Excelent video and explanation, thank you!

[@emran5897]

Thanks for the video.........Sulthan

[@gerardocaudillo1902]

Awesome videos! Thank you so much

[@SajidKiani1]

Thanks for this great video. When you'll share the next of this for detail of all features?

[@adkleiner]

When you run this on a live system, isn't there a concern of mistakenly modifying evidence? I know that this is a method of logical acquistion but I assume it can also run against targets which are mounted read only (from a physical acquisition previously done)?

[@13Cubed]

Sure, when you run *anything* on a live system, including a memory capture, you are technically changing evidence. This cannot be helped, but the most important thing you can do is to document, document, document, especially if you suspect the investigation could be criminal or referred to law enforcement. Of course, as you stated, you could grab memory, verify encryption isn't in play, power off the system, and then create a triage image with KAPE against the drive connected via a write blocker.

[@commandblocker2266]

Thanks. great tool for fast evidence collection and finding leads. can you pl post something on creating and applying new modules?

[@13Cubed]

Interesting suggestion - I will consider a future episode that covers those topics.

[@AnmutMossie]

Target !ALL doesn't work in the newer versions. Any explanation?

[@SecureTheWorld]

Excellent Video, could you please list software used to edit your videos!

[@13Cubed]

An iMac Pro and ScreenFlow primarily, and FCPX in the future for more advanced things.

[@Calm_Energy]

Surprised you're not using powershell!

[@Calm_Energy]

oh I see you switched to ps at the very end, just wondering if there was any particular reason not to use it from the beginning? I read cmd prompt will be getting phased out? Thanks for such great quality videos!

[@13Cubed]

​@@Calm_Energy No reason, I'm just old school. :)

[@harshpanchal2202]

Can this be used with docker?

[@13Cubed]

Harsh Panchal Are you asking if it can be used to forensicate a Docker image, or if you can run it within Docker?

[@harshpanchal2202]

@@13CubedYes sorry, I meant if it can run with Docker?

[@13Cubed]

​@@harshpanchal2202 To be honest, I've never tried. Some testing will be required :)

[@harshpanchal2202]

@@13Cubed cool no worries mate. I'm planning to try that out so thought let me ask you. But please if you do let me know how it goes. Thanks

[@kape5469]

My name