bulk_extractor is a computer forensics tool that scans a disk image,
file, or directory of files and extracts
information such as credit card
numbers, domains, e-mail addresses, URLs, and ZIP files. The extracted
information is output to a series of text files (which can be reviewed
manually or analysed using other forensics tools or scripts).
Tip: Within the output text files you will find entries for
data that resemble a credit card number, e-mail address, domain name,
etc. You will also see a decimal value in the first column of the text
file that, when converted to hex, can be used as the pointer on disk
where the entry was found (i.e. if you were analysing the disk manually
using a hex editor for example, you would jump to this hexadecimal value
to view the data).
Bulk_extractor comes as a command-line tool or a GUI tool. In the
example above I set the bulk extractor tool to extract information from a
forensics image I took earlier and output the results to a folder
called “BE_Output”. The results can then be viewed in the Bulk Extractor
Viewer and the output text files mentioned above.
