Bulk Extractor

Bulk Extractor is a powerful open source forensics tool that can be used to extract data from digital media. It is used to identify and extract data from large digital evidence images, such as hard drives and memory cards. It scans the raw bytes without parsing the file system, so it also finds data in unallocated space and inside compressed content. This data can then be used to investigate criminal activity and other activities of interest. Bulk Extractor is widely used by computer forensics investigators, and can be used to quickly analyze large amounts of evidence.

Features:

• Support for multiple data sources: Bulk Extractor can process raw and split raw disk images, E01 (EnCase) images, individual files and whole directories, and on Windows it can also read physical drives directly.

The main benefit of Bulk Extractor is that it can quickly scan large volumes of data for email addresses, URLs and other information without parsing the file system.

• Extracts a wide range of data: Bulk Extractor can extract email addresses, URLs, credit card numbers, phone numbers, GPS coordinates, EXIF data from JPEG images, JSON snippets and other types of data.

• Histograms: Bulk Extractor automatically builds histograms of frequently found features, such as email addresses and search terms, which helps to identify patterns of interest.

• Read-only processing: Bulk Extractor only reads the evidence and writes its results to a separate output directory, so the source data is not modified.

• Graphical viewer: the Java-based Bulk Extractor Viewer (BEViewer) opens reports, browses feature files, bookmarks features and shows the matching image data as text or hex.

• Powerful search capabilities: Bulk Extractor can be used to search for data by keyword or regular expression.

• Structured output: results are saved as plain text feature files with byte offsets, together with an XML (DFXML) report of the run.

• Recursive decoding: the scanners decompress and decode ZIP, GZIP, Base64 and other encoded data and then scan the result again.

• Open source: Bulk Extractor is open source software and is freely available for download.

• Cross-platform support: Bulk Extractor can be used on Windows, Mac, and Linux operating systems.

• Scalable: Bulk Extractor is multi-threaded and runs its scanners in parallel, so it can process large amounts of digital evidence quickly.

• Documentation: Bulk Extractor comes with a user manual, and the project wiki on GitHub describes its scanners and options.