CCYNARKS LearnLogin
← All tools

KAPE

DFIR · Advanced

Collect triage artifacts from Windows quickly.

Knowledge reference only. Prefer in-browser Labs first. Use this tool only on systems you own or have written authorization to test.

What to learn

  • Targets
  • Modules

Legitimate use

Authorized imaging/triage only.

Official docs →

Example commands (lab VMs only)

  • kape.exe --tsource C: --tdest E:\triage --target BasicCollection
    Lab VM only