KAPE Integration
IRFlow Timeline automatically detects and pre-configures display settings for output from KAPE and Eric Zimmerman's (EZ) tools, giving you an optimized view from the moment you open a file.
Open Triage Collection
For a full KAPE (or similar) triage folder or VHDX image — not a single CSV — use:
File → Open Triage Collection…
- Choose the collection root (a KAPE output directory or mounted evidence tree) or the
.vhdxKAPE produced with--vhdx. For a VHDX, IRFlow reads the NTFS volume inside the image and copies the recognizable artifacts into a scratch folder first; nothing is mounted and the image is never modified. See Supported Formats → KAPE VHDX Images. - IRFlow inventories recognizable artifacts (EVTX channels,
$MFT/$J, KAPE CSVs, Prefetch, Amcache, registry hives, LNK/Jump Lists, and more). - Review two independent lanes:
- Lateral Movement — pre-selects LM-relevant EVTX (Security, Sysmon, TerminalServices, RDP, …), imports them as timeline tabs, then can hand off to the Lateral Movement Tracker.
- EVTX → Sigma — optional Hayabusa/Sigma path over the Windows event-log directory (same dual-engine flow as Sigma Detection).
- Artifacts that this build cannot parse are listed with a tool hint (for example Prefetch → PECmd) rather than dropped silently.
Host attribution (when the collection encodes a hostname) is applied so imported tabs stay tied to the right endpoint. You can still open individual KAPE CSVs with File → Open for profile auto-detection below.
How Auto-Detection Works
When you open a CSV or XLSX file, IRFlow Timeline analyzes the column headers to identify the source tool. If a known profile matches, it automatically applies:
- Column ordering — most relevant columns first
- Hidden columns — noise columns are hidden by default
- Auto-color column — a column is selected for automatic palette coloring
Supported Profiles
EZ Tools
| Profile | Tool | Key Columns |
|---|---|---|
| MFTECmd | MFT parser | FileName, ParentPath, Extension, FileSize, Created, Modified |
| EvtxECmd | Event log parser | TimeCreated, EventId, Channel, Computer, PayloadData1-6 |
| PECmd | Prefetch parser | ExecutableName, RunCount, LastRun, Volume |
| LECmd | LNK file parser | SourceFile, TargetPath, Arguments, WorkingDirectory |
| AmcacheParser (Files) | Amcache files | FullPath, SHA1, FileSize, CompileTime |
| AmcacheParser (Programs) | Amcache programs | Name, Version, Publisher, InstallDate |
| RECmd | Registry parser | HivePath, Key, ValueName, ValueData, LastWriteTimestamp |
| SBECmd | ShellBags parser | AbsolutePath, ShellType, LastWriteTime, MFTEntry |
| SrumECmd | SRUM parser | ExeInfo, AppId, NetworkUsage, ForegroundTime |
| AppCompatcache | Shimcache | Path, LastModifiedTime, Executed |
| JLECmd | Jump Lists | FileName, Arguments, TargetPath, CreatedOn |
Timeline Formats
| Profile | Description | Key Columns |
|---|---|---|
| ForensicTimeline | Generic forensic timeline | datetime, timestamp_desc, source, sourcetype, message |
| Plaso SuperTimeline | Plaso psort output | datetime, source, sourcetype, type, display_name, message |
| MacTime | Bodyfile mactime | Date, Size, Type, Mode, UID, GID, File Name |
| KapeMiniTimeline | KAPE mini timeline | Date, Time, Source, Type, Short, Desc |
| PsortTimeline | Plaso psort CSV | date, time, timezone, source, sourcetype, type, user, host |
Security Tools
| Profile | Tool | Key Columns |
|---|---|---|
| Hayabusa (Standard) | Windows detection | Timestamp, RuleTitle, Level, Computer, Channel |
| Hayabusa (Verbose) | Detailed detection | Timestamp, RuleTitle, Level, Details, ExtraFieldInfo |
| Chainsaw | Detection rules | timestamp, name, level, computer, status |
| BrowsingHistoryView | Browser history | URL, Title, Visit Time, Browser |
Miscellaneous
| Profile | Description |
|---|---|
| KAPE Copy Log | KAPE collection log |
Customizing After Detection
Auto-detection sets a starting point, but you can always customize:
- Show hidden columns via the Column Manager
- Unpin columns via
Cmd+Click - Change column order via drag-and-drop
- Override color rules in the Color Rules editor
Your customizations are preserved when saving a session.
Manual Profile Application
If auto-detection doesn't trigger (e.g., modified column names), you can't currently force a profile. The detection relies on exact column header matching.
Best Practice
When exporting from EZ Tools, use the default column configurations to ensure IRFlow Timeline recognizes the output format. Custom column selections may prevent auto-detection.
AI App Artifacts in KAPE Collections
KAPE profile auto-detection covers EZ Tools CSV/XLSX output. AI assistant history is separate: collect local app paths from user profiles (.claude, .claude.json, .codex, .cursor, .gemini, .continue, ChatGPT app-data folders including the merged Application Support/Codex Chromium profile, VS Code-family workspaceStorage/*/chatSessions/, etc.) into your KAPE or triage package, then run Tools → Analysis → AI Artifacts → Collect AI Artifacts on the collection root.
IRFlow walks Windows, Linux, and macOS profile layouts and merges discovered AI stores into one AI Query History tab. See KAPE Triage Workflow and AI Query History for collection paths and investigation tips.
See Also
- Color Rules — KAPE profiles auto-apply color rule presets per tool
- Merging Timelines — merge multiple KAPE tool outputs into a unified timeline
- Diff Tabs — compare two collections or two runs of the same KAPE module
- Virtual Grid — auto-configured column layouts for each KAPE profile
- KAPE Profiles Reference — full list of supported profiles and column mappings
- AI Artifacts — collect and review local AI assistant history from KAPE folders