bulk_extractor is a program that extracts features such as email addresses, credit card numbers, URLs, and other types of information from digital evidence files. It is a useful forensic investigation tool for many tasks such as malware and intrusion investigations, identity investigations and cyber investigations, as well as analyzing imagery and pass-word cracking. The program provides several unusual capabilities including:
- It finds email addresses, URLs and credit card numbers that other tools miss because it can process compressed data (like ZIP, PDF and GZIP ﬁles) and incomplete or partially corrupted data. It can carve JPEGs, office documents and other kinds of files out of fragments of compressed data. It will detect and carve encrypted RAR files.
- It builds word lists based on all of the words found within the data, even those in compressed files that are in unallocated space. Those word lists can be useful for password cracking.
- It is multi-threaded; running bulk_extractor on a computer with twice the number of cores typically makes it complete a run in half the time.
- It creates histograms showing the most common email addresses, URLs, domains, search terms and other kinds of information on the drive.
bulk_extractor operates on disk images, files or a directory of files and extracts useful information without parsing the ﬁle system or ﬁle system structures. The input is split into pages and processed by one or more scanners. The results are stored in feature files that can be easily inspected, parsed, or processed with other automated tools.
bulk_extractor also creates histograms of features that it finds. This is useful because features such as email addresses and internet search terms that are more common tend to be important.
In addition to the capabilities described above, bulk_extractor also includes:
- A graphical user interface, Bulk Extractor Viewer, for browsing features stored in feature ﬁles and for launching bulk_extractor scans
- A small number of python programs for performing additional analysis on feature files
Tool Source: https://github.com/simsong/bulk_extractor/
root@kali:~# bulk_extractor bulk_extractor version 1.3 $Rev: 10606 $ Usage: bulk_extractor [options] imagefile runs bulk extractor and outputs to stdout a summary of what was found where Required parameters: imagefile - the file to extract or -R filedir - recurse through a directory of files SUPPORT FOR E01 FILES COMPILED IN SUPPORT FOR AFF FILES COMPILED IN -o outdir - specifies output directory. Must not exist. bulk_extractor creates this directory. Options: -b banner.txt- Add banner.txt contents to the top of every output file. -r alert_list.txt - a file containing the alert list of features to alert (can be a feature file or a list of globs) (can be repeated.) -w stop_list.txt - a file containing the stop list of features (white list (can be a feature file or a list of globs)s (can be repeated.) -F <rfile> - Read a list of regular expressions from <rfile> to find -f <regex> - find occurrences of <regex>; may be repeated. results go into find.txt -q nn - Quiet Rate; only print every nn status reports. Default 0; -1 for no status at all Tuning parameters: -C NN - specifies the size of the context window (default 16) -G NN - specify the page size (default 16777216) -g NN - specify margin (default 4194304) -W n1:n2 - Specifies minimum and maximum word size (default is -w6:14) -B NN - Specify the blocksize for bulk data analysis (default 512) -j NN - Number of analysis threads to run (default 2) -M nn - sets max recursion depth (default 5) Path Processing Mode: -p <path>/f - print the value of <path> with a given format. formats: r = raw; h = hex. Specify -p - for interactive mode. Specify -p -http for HTTP mode. Parallelizing: -Y <o1> - Start processing at o1 (o1 may be 1, 1K, 1M or 1G) -Y <o1>-<o2> - Process o1-o2 -A <off> - Add <off> to all reported feature offsets Debugging: -h - print this message -H - print detailed info on the scanners -V - print version number -z nn - start on page nn -dN - debug mode (see source code -Z - zap (erase) output directory Control of Scanners: -P <dir> - Specifies a plugin directory -E scanner - turn off all scanners except scanner -m <max> - maximum number of minutes to wait for memory starvation default is 60 -s name=value - sets a bulk extractor option name to be value -e bulk - enable scanner bulk -e wordlist - enable scanner wordlist -x accts - disable scanner accts -x aes - disable scanner aes -x base16 - disable scanner base16 -x base64 - disable scanner base64 -x elf - disable scanner elf -x email - disable scanner email -x exif - disable scanner exif -x gps - disable scanner gps -x gzip - disable scanner gzip -x hiber - disable scanner hiber -x json - disable scanner json -x kml - disable scanner kml -x net - disable scanner net -x pdf - disable scanner pdf -x vcard - disable scanner vcard -x windirs - disable scanner windirs -x winpe - disable scanner winpe -x winprefetch - disable scanner winprefetch -x zip - disable scanner zip
Extract files to the output directory (-o bulk-out) after analyzing the image file (xp-laptop-2005-07-04-1430.img):
root@kali:~# bulk_extractor -o bulk-out xp-laptop-2005-07-04-1430.img bulk_extractor version: 1.3 Hostname: kali Input file: xp-laptop-2005-07-04-1430.img Output directory: bulk-out Disk Size: 536715264 Threads: 1 Phase 1. 13:02:46 Offset 0MB (0.00%) Done in n/a at 13:02:45 13:03:39 Offset 67MB (12.50%) Done in 0:06:14 at 13:09:53 13:04:43 Offset 134MB (25.01%) Done in 0:05:50 at 13:10:33 13:04:55 Offset 201MB (37.51%) Done in 0:03:36 at 13:08:31 13:06:01 Offset 268MB (50.01%) Done in 0:03:15 at 13:09:16 13:06:48 Offset 335MB (62.52%) Done in 0:02:25 at 13:09:13 13:07:04 Offset 402MB (75.02%) Done in 0:01:25 at 13:08:29 13:07:20 Offset 469MB (87.53%) Done in 0:00:39 at 13:07:59 All Data is Read; waiting for threads to finish... Time elapsed waiting for 1 thread to finish: (please wait for another 60 min .) Time elapsed waiting for 1 thread to finish: 6 sec (please wait for another 59 min 54 sec.) Thread 0: Processing 520093696 Time elapsed waiting for 1 thread to finish: 12 sec (please wait for another 59 min 48 sec.) Thread 0: Processing 520093696 Time elapsed waiting for 1 thread to finish: 18 sec (please wait for another 59 min 42 sec.) Thread 0: Processing 520093696 Time elapsed waiting for 1 thread to finish: 24 sec (please wait for another 59 min 36 sec.) Thread 0: Processing 520093696 Time elapsed waiting for 1 thread to finish: 30 sec (please wait for another 59 min 30 sec.) Thread 0: Processing 520093696 All Threads Finished! Producer time spent waiting: 335.984 sec. Average consumer time spent waiting: 0.143353 sec. ******************************************* ** bulk_extractor is probably CPU bound. ** ** Run on a computer with more cores ** ** to get better performance. ** ******************************************* Phase 2. Shutting down scanners Phase 3. Creating Histograms ccn histogram... ccn_track2 histogram... domain histogram... email histogram... ether histogram... find histogram... ip histogram... tcp histogram... telephone histogram... url histogram... url microsoft-live... url services... url facebook-address... url facebook-id... url searches... Elapsed time: 378.5 sec. Overall performance: 1.418 MBytes/sec. Total email features found: 899
Video Tutorial: Coming Soon!