bulk_extractor is a high-speed parallel scanner that reads a disk image and pulls
out bulk artifacts: email addresses, URLs, phone numbers, credit card numbers,
domain names, encrypted-password indicators, JPEGs, and more — including from compressed and
even partially-encrypted data. It's designed to run unattended over an entire image in minutes
and produce plaintext output you can grep, script, and pivot on.
apt install bulk-extractor
dnf install bulk_extractor
git clone https://github.com/simsong/bulk_extractor.git # build from source# simplest run - output dir must be empty/new
mkdir /evidence/be_out
bulk_extractor -o /evidence/be_out /evidence/image.dd
# parallel (default) - control workers
bulk_extractor -o /evidence/be_out -j 8 /evidence/image.dd
# restrict scanners with -x or -e
bulk_extractor -o /evidence/be_out -x net,phone /evidence/image.dd # disable net & phone
bulk_extractor -o /evidence/be_out -e http /evidence/image.dd # run ONLY http
# scan a partition or memory dump too
bulk_extractor -o /evidence/be_out /evidence/part2.dd
bulk_extractor -o /evidence/be_out /evidence/ram.limeAfter a run, the output directory is full of feature files. The most useful:
| File | Content |
|---|---|
| email.txt | Email addresses + offsets |
| url.txt | URLs (with history of who accessed them) |
| domain.txt | Domain names |
| phone.txt | Phone numbers |
| creditcard.txt | Credit card numbers (Luhn-checked) |
| pii.txt | Personal identifiers |
| exif.txt | EXIF metadata from images |
| windirs.txt | Windows-style paths |
| carved/ | Carved files (use -C to enable) |
| report.xml | Run summary & settings for documentation |
# enable carving (JPEG, PNG, EXIF) with -C
bulk_extractor -C -o /evidence/be_out /evidence/image.dd
# carve by MIME type
bulk_extractor -M -o /evidence/be_out /evidence/image.dd
# recover data around hits - gives you the surrounding bytes
bulk_extractor -r 4096 -o /evidence/be_out /evidence/image.dd
# restrict to a byte range (scan a suspicious region)
bulk_extractor -R start,end -o /evidence/be_out /evidence/image.ddfls/istat) to map a hit to a specific file — the same
offset-to-artifact trick described in the strings & grep
guide.