You will also see a decimal value in the first column of the text file that, when converted to hex, can be used as the pointer on disk where the entry was found (i.e. Tip: Within the output text files you will find entries for data that resemble a credit card number, e-mail address, domain name, etc. The results can then be viewed in the Bulk Extractor Viewer and the output text files mentioned above. In the example above I set the bulk extractor tool to extract information from a forensics image I took earlier and output the results to a folder called “BE_Output”. The extracted information is output to a series of text files (which can be reviewed manually or analysed using other forensics tools or scripts).īulk_extractor comes as a command-line tool or a GUI tool. It is basically used by intelligence and law enforcement agencies in solving cyber crimes.īulk Extractor is a computer forensics tool that scans a disk image, file, or directory of files and extracts information such as credit card numbers, domains, e-mail addresses, URLs, and ZIP files. In this process, it ignores the file system structure, so it is faster than other available similar kinds of tools. It scans the disk images, file or directory of files to extract useful information. You can then process the evidence file or device against one of the in-built modules to begin analysing data.īulk Extractor is also an important and popular digital forensics tool. a forensic image you acquired previously) or open a device ready for analysis. When you launch DFF, you first need to load an evidence file (i.e. Amongst others, DFF’s features include the ability to read RAW, EWF and AFF forensic file formats, access local and remote devices, analyse registry, mailbox and file system data and recover hidden and deleted files. The Digital Forensics Framework (DFF) is a digital forensic investigation tool and a development platform that allows you to collect, preserve and reveal digital evidence. It can be used for digital chain of custody, to access the remote or local devices, forensics of Windows or Linux OS, recovery hidden of deleted files, quick search for files’ meta data, and various other things.

It can be used either by professionals or non-experts without any trouble. The tool is open source and comes under GPL License.

Digital Forensics Framework is another popular platform dedicated to digital forensics.

Prodiscover basic download 64