<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Endpoint Forensic Collection

## Forensic Collection APIs

### KAPE Targets and Modules

| Target | Description |
|---|---|
| `KapeTriage` | Comprehensive triage collection |
| `RegistryHives` | SAM, SYSTEM, SOFTWARE, NTUSER.DAT |
| `EventLogs` | Windows Event Log (.evtx) files |
| `Prefetch` | Application execution artifacts |
| `$MFT` | Master File Table for timeline analysis |
| `AmCache` | Application compatibility cache |

### Velociraptor Artifacts

| Artifact | Description |
|---|---|
| `Windows.KapeFiles.Targets` | KAPE-equivalent triage collection |
| `Windows.System.Pslist` | Running process listing |
| `Windows.Network.Netstat` | Network connection snapshot |
| `Linux.Collection.BasicInfo` | Linux system information triage |
| `Generic.Collectors.File` | Targeted file collection by glob |

### Agent Script

```bash
# Collect volatile artifacts
node agent.js collect-volatile --output-dir ./evidence

# Hash evidence files
node agent.js hash-evidence --evidence-dir ./evidence

# Verify evidence integrity
node agent.js verify-integrity --hash-file evidence_hashes.txt
```
