bulk_extractor

bulk_extractor -o <out> -R <path>

Automatically extract forensic artifacts (emails, URLs, hashes, coordinates, credit cards) from disk images or dumps with bulk_extractor.

Run it when you need a raw extraction sweep without relying on the filesystem: bulk_extractor scans raw data (disk image, memory dump, pcap) looking for patterns — email addresses, URLs, hashes, credit card numbers, GPS coordinates, credentials — and saves them into feature files separated by type. Its advantage over traditional carving tools: it works on unstructured data and is resistant to fragmentation (no FS needed). In IR, it's the triage step that answers 'what's in this image?' with the list of extracted artifacts, and the starting point for targeted analysis.

Don't use it as a full analysis: bulk_extractor extracts patterns, not context — an email found doesn't tell you who sent it or when; correlation with the timeline and manual analysis are still needed. On large images it takes hours and generates many feature files: narrow it down with scanner filters (enable/disable scanner options) and size. And watch out for false positives: generic patterns (URLs, emails) appear in any image — findings are validated against context before including them in the report. Performance on slow disks or remote images is another factor to plan for.