Lion Cipher Lab
Triage a live Windows machine with KAPE and the Zimmerman tools
- Digital Forensics & IR (DFIR)
- Intermediate
- ~75 min
- Free · no account required
Why it matters
When something bad happens on a Windows machine, the textbook answer is "take a forensic image and analyse it." In the real world that can mean hours of copying and a day of processing, and the person who called you wants to know in the next twenty minutes whether this is a real incident or a false alarm. Triage is the answer to that: collect only the few hundred megabytes of files that actually record what happened, parse them, and read the story. KAPE and Eric Zimmerman's tools are what a huge number of working incident responders reach for first, they are free for exactly this kind of…
What you'll learn
- live host triage
- targeted artifact collection
- KAPE Targets and Modules
- prefetch, shellbag, jump list and MFT analysis
- Eric Zimmerman forensic tools
- building a readable timeline
- evidence handling discipline
Steps in this lab
- What "triage" means, and why it is not the same as forensics
- The two rules before you touch anything
- Open PowerShell as Administrator (the exact clicks)
- Get the Zimmerman tools (free, no account, one script)
- Get KAPE — and read the licence, properly
- Targets vs Modules — the one thing that trips everyone up
- Sync the configs, and give the Modules their tools
- Collect: the whole triage set, in minutes
- Look at what actually landed (before anything parses it)
- Parse: one command turns the pile into readable CSVs
- "Was this program executed?" — prefetch
- "Was this folder opened?" — shellbags and jump lists
- "What exists, and when did it change?" — the $MFT
- "Who logged in, and what did Windows notice?" — event logs
- Read the story: build a one-hour window across all of it
- Clean up — this part is not optional
- What you actually learned, and the habit to keep