bulk_extractor

{
  "aliases": [],
  "alternatives": [],
  "build_dependencies": [
    "pkgconf",
    "re2"
  ],
  "categories": [],
  "caveats": null,
  "conflicts_with": [],
  "dependencies": [],
  "deprecated": 0,
  "deprecation_reason": null,
  "desc": "Stream-based forensics tool",
  "disable_reason": null,
  "disabled": 0,
  "enrichment_fetched_at": "2026-06-20T23:36:01+00:00",
  "first_seen": "2026-06-20T23:34:18+00:00",
  "full_name": "bulk_extractor",
  "github_default_branch": "main",
  "github_last_commit_at": "2026-01-29T13:27:05Z",
  "github_readme_excerpt": "[![codecov](https://codecov.io/gh/simsong/bulk_extractor/branch/main/graph/badge.svg?token=3w691sdgLu)](https://codecov.io/gh/simsong/bulk_extractor)\n\u003ca href=\"https://scan.coverity.com/projects/simsong-bulk_extractor\"\u003e\n  \u003cimg alt=\"Coverity Scan Build Status\" src=\"https://scan.coverity.com/projects/29726/badge.svg\"/\u003e\u003c/a\u003e\n\n`bulk_extractor` is a high-performance digital forensics exploitation\ntool.  It is a \"get evidence\" button that rapidly scans any kind of\ninput (disk images, files, directories of files, etc) and extracts\nstructured information such as email addresses, credit card numbers,\nJPEGs and JSON snippets without parsing the file system or file system\nstructures. The results are stored in text files that are easily\ninspected, searched, or used as inputs for other forensic\nprocessing. bulk_extractor also creates histograms of certain kinds of\nfeatures that it finds, such as Google search terms and email\naddresses, as previous research has shown that such histograms are\nespecially useful in investigative and law enforcement applications.\n\nUnlike other digital forensics tools, `bulk_extractor` probes every byte of data to see if it is the start of a\nsequence that can be decompressed or otherwise decoded. If so, the\ndecoded data are recursively re-examined. As a result, `bulk_extractor` can find things like BASE64-encoded JPEGs and\ncompressed JSON objects that traditional carving tools miss.\n\nThis is the `bulk_extractor` 2.1 development branch! It is reliable, but if you want to have a well-tested production quality release, download a release from https://github.com/simsong/bulk_extractor/releases.\n\nBuilding `bulk_extractor`\n=========================\nWe recommend building from sources. We provide a number of `bash` scripts in the `etc/` directory that will configure a clean virtual machine:\n\n```\ngit clone --recurse-submodules https://github.com/simsong/bulk_extractor.git\n./bootstrap.sh\n./configure\nmake\nmake install\n```\n\nFor detailed instructions on installing p",
  "github_repo": "simsong/bulk_extractor",
  "github_stars": 1382,
  "github_topics": [],
  "homepage": "https://github.com/simsong/bulk_extractor/wiki",
  "homepage_og_description": null,
  "homepage_og_image": null,
  "homepage_title": null,
  "installs_30d": 33,
  "installs_365d": 737,
  "installs_90d": 112,
  "keg_only": 0,
  "keg_only_reason": null,
  "last_seen": "2026-06-20T23:34:18+00:00",
  "license": "MIT",
  "llm_generated_at": null,
  "llm_model": null,
  "name": "bulk_extractor",
  "oldnames": [],
  "one_liner": null,
  "optional_dependencies": [],
  "rank_30d": 5625,
  "rank_365d": 4325,
  "rank_90d": 5342,
  "raw_hash": "5897854ce8701313",
  "recommended_dependencies": [],
  "revision": 3,
  "ruby_source_path": "Formula/b/bulk_extractor.rb",
  "tap": "homebrew/core",
  "test_dependencies": [],
  "uses_from_macos": [
    {
      "flex": "build"
    },
    "expat",
    "ncurses"
  ],
  "version_head": "HEAD",
  "version_stable": "2.1.1",
  "versioned_formulae": [],
  "why_use_this": null
}