Install and open KAPE¶
Use the tool only on an owned or explicitly authorised source and record the intended collection question.
Retain the downloaded archive, source URL, date, version and SHA-256 value.
Keep the KAPE program directory, evidence source and collection destination distinct.
Obtain KAPE¶
Navigate to the KAPE website and enter the requested details to receive a download link.
Record the download source, filename, date and KAPE version in your case or lab notes. Follow the applicable KAPE licence and redistribution conditions.
Extract the archive¶
Click the Download button to download kape.zip. Unzip the archive in
C:\Tools. This extracts the contents into a folder named KAPE.
Before using the tool in an investigation, preserve the downloaded archive or record its checksum so another analyst can identify the build that was used.
In PowerShell, record the archive hash before extraction:
Store the returned value in the lab or case notes; it identifies the file you used but does not independently establish that the file is trustworthy.
Open gkape¶
Double click gkape to open the graphical version of KAPE.
Confirm that the title bar shows the expected version and that the Targets and Modules lists load. If the lists are empty, confirm the KAPE folder was fully extracted and update the Targets and Modules from an approved source.
Keep the original folder intact
Use the extracted KAPE directory as the tool source and write collected evidence elsewhere. Do not use the KAPE program folder as the destination.
Definition update boundary¶
KAPE's Targets and Modules can be updated separately from the executable. The
official KapeFiles project
documents Sync with GitHub and kape.exe --sync for obtaining current
community definitions. Do not sync halfway through a case without recording
the change: retain the definitions used for each run and review newly
introduced external binary dependencies before execution.