bulk_extractor
Simson Garfinkel · bulk_extractor 2 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open-source scanner that reads a disk image, memory image, or directory from end to end and extracts features — email addresses, URLs, credit card numbers, telephone numbers, EXIF data, JSON, and more — without reference to the file system. Version 2 is the current line and the repository is actively released.
Who it is for, and when
bulk_extractor is the tool for finding data the file system has lost track of: content in unallocated space, in swap, in slack, in fragments of a deleted database. Because it ignores file system structure entirely, it recovers indicators from damaged or partially overwritten media where a file-based tool returns nothing. Practitioners commonly run it early and in parallel with a full examination, then use its histograms of email addresses or domains to decide where to look properly.
What it does not cover
It produces features, not context — a recovered email address has no file, no timestamp, and no attribution, so on its own it establishes very little and must be tied back to an allocated artefact to mean anything. False positives are routine, particularly on the credit card and telephone scanners, and it does not identify files, parse applications, or reconstruct anything. It is also not a keyword search tool for a defined term list.
Go to the source
Open at github.com (opens in a new tab)https://github.com/simsong/bulk_extractor/wiki
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Simson Garfinkel
- Version verified
- bulk_extractor 2
- Year
- 2026
- Topics
- file-systems, triage, anti-forensics, open-source, email-forensics
- Checked at source
Related entries
Autopsy
FreeAn open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.
Two maintained live Linux distributions assembled for digital forensics. CAINE 14 'Lightstream' is built on Ubuntu 24.04 and is notable for a write-blocking system that locks all block devices read-only by default, with a GUI to unblock deliberately. Tsurugi Linux ships a LAB analysis edition, a lighter Acquire edition for imaging, and the BENTO portable live-response toolkit; its current LAB release is version 26.03.
CyberChef
FreeA browser-based tool published by GCHQ that chains together hundreds of data operations — encodings, ciphers, compression, hashing, timestamp conversion, parsing, and extraction — into a visible recipe. It runs entirely client-side and is actively released.
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.