Downloading kape incident response tool for forensic triage

 Kape is a triage collection and post-processing application written by Eric Zimmerman. Remember its just the triage collection tool ok? We will analyze the collection later. 

https://github.com/EricZimmerman/KapeFiles

Kape download:

Kroll Artifact Parser And Extractor (KAPE) | Cyber Risk | Kroll

Besides full disk image/acquired disk image, this tool allows us to create smaller triage image where important forensic data is present. In case the scenario is divide and conquer, meaning if you want smaller triage image from big size disk image then you can use this and share with your DFIR team to investigate together. The main reason of using kape is now you don't need to wading or sift through into the full image where 10% actual artifacts are present. Kape will allow you to collect those 10% before taking full image. Now you can analysis those 10% of data. 

If you want to learn more, please open for508 workbook and labs section 1-2.pdf file and look for page 28.

This is windows based. It requires target files which identify specific artifacts to be collected in a triage image. Target files are crowd sourced. 

On this location in github, \Targets\Compound\ Kape ships with one target file that collects every relevant artifacts called !SANS_Triage.tkape

First sync it after download to get latest files:

kape.exe --sync

Command: Admin privilege required. Taking triage image from a live system.

kape.exe --tsource F --target !SANS_Triage --tdesk C:\temp\Output

--tsource -->where is the data. This should be formatted as C or D: or F:\

--target -->what data to collect. --tlist will tell you list of available targets. 

--tdest -->where to copy the collected data. Here you can also use vhdx and vhd.

Command to see target list with details, assuming you are in the kape folder:

kape.exe --tlist . --tdetail

Creating a vhdx image:

kape.exe --tsource C: --tdest G:\USB\Labs\Kape --target !SANS_Triage --vhdx %COMPUTERNAME%-triage

Benefit of vhdx is you can mount it as like your other drive just double clicking it. It is recommended to take the output to usb drive or external storage. It will show some errors during running, but that's normal. The output will be a .zip file. 

You need to extract it and mount it by double clicking it. It's a vhdx file. 

Now we have another use case which is creating a triage image from a full disk image having extension .E01 and size could be 26 GB+ after compress. But actual size of the HD could be 50GB+. 

We may also need to learn how to mount an ISO file as DVD. This is easy. Go to your vm settings > select a dvd and connect it > Navigate to the iso file > Now it will show inside of your vm. 

Going to the dvd drive folder will get you to the image file. Full disk image extension should be .E01

Mount it using Arsenal Image Mounter tool with read only mode. You can also mount it as write mode. But we will follow here as per the book.  

After a moment you will see a new drive letter appeared. Say for example F.

Now triage using kape again. 

Command:

kape.exe --tsource F: --tdest G:\Labs\kape --target !SANS_Triage --vhdx rd01-triage

Again this will generate a .zip file.

Now how to running kape from usb drive?

Download and update zimmersman tools and kape. Then copy it to the usb drive. That's it. 

Avi