Bulk Extractor - bulk_extractor Feature extractor and BEViewer User Interface 1.4

Bulk Extractor — bulk_extractor Feature Extractor and BEViewer User Interface, developed by the Naval Postgraduate School (NPS), is a high-performance digital forensics toolset for rapidly discovering and extracting useful artifacts from disk images, directories, and individual files—without relying on the file system. It generates machine-readable feature files and histograms that streamline triage, investigation, and privacy assessments at scale.

Key capabilities:

• Multithreaded scanning of raw data, including unallocated space and file slack, for speed and completeness.
• Extraction of artifacts such as email addresses, URLs/domains, IP addresses, phone numbers, possible credit card numbers, GPS coordinates, EXIF metadata, and more.
• Recursive analysis of compressed and encoded content (for example, ZIP/GZIP and embedded streams in formats like PDFs) to find buried data.
• Support for common forensic image types and standard files, with robust handling of large datasets.
• Extensible, pluggable scanners and configurable workflows to fit specific investigative needs.
• Output as plain-text feature files and histograms for easy automation, correlation, and reporting.
• Read-only processing to preserve evidentiary integrity.

BEViewer (the companion GUI):

• Interactive review of bulk_extractor results with fast search, filtering, and sorting.
• Context and byte-offset previews to validate hits and understand placement.
• Summaries, histograms, and export options to support reporting and case documentation.
• Cross-platform usability for streamlined analyst workflows.

Typical use cases include digital forensics, incident response, e-discovery triage, data breach and PII audits, and broader cybersecurity investigations.

Bulk Extractor - bulk_extractor Feature extractor and BEViewer User Interface is developed by "NPS". The most popular versions of this product among our users are: 1.3 and 1.4.