Skill UI

A specialized tool for digital forensics investigators that parses the Windows Amcache.hve registry hive. It extracts crucial evidence regarding program execution history, application installation metadata, and loaded driver binaries. By correlating SHA-1 hashes and reconstructing timelines, users can determine which executables ran on a system, aiding in incident response and threat detection.

This comprehensive tool suite provides high-fidelity parsers for key Windows artifacts, including MFT, Registry hives, Prefetch files, and ShellBags. Designed for digital forensics and incident response, it converts raw system evidence into structured CSV/JSON formats. The output is optimized for feeding into Timeline Explorer, enabling analysts to build comprehensive, correlated timelines and establish a clear chain of events.

KAPE is a powerful, Windows-native triage tool used for Digital Forensics and Incident Response (DFIR). It executes in two phases: 'Targets' collect raw forensic artifacts (like registry hives, event logs, and prefetch files) from live systems, while 'Modules' parse this collected data into normalized, analyst-ready CSV/JSON formats. It enables fast, defensible, and scalable artifact collection, especially when full disk imaging is impractical.