We have used the program to process hard drives, SSDs, optical media, camera cards, cell phones, network packet dumps, and other kinds of digital information.īulk_extractor now creates an output directory that has the following layout:Ĭredit card “track 2″ informaiton, which has previously been found in some bank card fraud cases. Our testing has shown that there is a significant amount of compressed data in the unallocated regions of file systems that is missed by most forensic tools that are commonly in use today.Īnother advantage of ignoring file systems is that bulk_extractor can be used to process any digital media. That’s because bulk_extractor automatically detects, decompresses, and recursively re-processes compressed data that is compressed with a variety of algorithms. This means that 24-core machines process a disk roughly 24 times faster than a 1-core machine. In practice, the program splits the disk up into 16MiByte pages and processes one page on each available core. Because it ignores file system structure, bulk_extractor can process different parts of the disk in parallel. Please see page BEViewer.īulk_extractor is distinguished from other forensic tools by its speed and thoroughness. A Bulk Extractor Viewer User Interface (BEViewer) for browsing features stored in feature files and for launching bulk_extractor scans.A a small number of python programs that perform automated processing on feature files.We have provided the Bulk Extractor Viewer User Interface (BEViewer) for browsing features stored in feature files and for launching bulk_extractor scans. We have provided a small number of python programs that perform automated processing on feature files. We have made the following tools available for processing feature files generated by bulk_extractor:
bulk_extractor also creates histograms of features that it finds, as features that are more common tend to be more important. The results are stored in feature files that can be easily inspected, parsed, or processed with automated tools.
Bulk_extractor is a C++ program that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures.
0 kommentar(er)
