bulk-extractor

No entries match these filters. Clear filters

1. v2.2.0 Aug 18, 2026 · release notes

   bulk-extractor v2.2.0 adds VIN scanning, RawTherapee thumbnail carving, Windows raw-device input, RAR full-member recovery, and big-endian utmp support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.2.0 https://github.com/simsong/bulk_extractor.git
   # already have the repo? check out this version:
   $ git checkout v2.2.0

   • Adds --max_minute_wait flag support, now correctly honored during scans.
   • Adds case-sensitive find option for pattern searches.
   • Adds -Z flag support to remove nested output directories.
   • New VIN (Vehicle Identification Number) scanner for extracting VINs from disk images.
   • New RawTherapee Image8 thumbnail carver for recovering embedded thumbnails.

   +10 more show less

   • Supports Windows raw-device input, enabling direct acquisition from physical drives on Windows.
   • Recovers all members from RAR archives, improving completeness of RAR extraction.
   • Supports big-endian utmp records, broadening login-record parsing to big-endian platforms.
   • Adds diagnostic logging foundation for improved runtime observability.
   • Reports restart recovery status when resuming an interrupted scan.
   • Adds a container image for regular scans.
   • Adds Ubuntu MinGW Windows artifact build, producing Windows binaries from Linux CI.
   • Automates Debian release package builds.
   • Automates Fedora and openSUSE RPM release builds.
   • Enables basic compiler stack protection across the build.

   15 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The obsolete numeric debug mask is retired and no longer accepted.
2. advisory CVE-2026-24857 Jan 28, 2026 · issue 128
   • CVE-2026-24857: Heap-based Buffer Overflow in bulk_extractor (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects >= 1.4, < 2.2.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
3. v2.1.1 Apr 27, 2024 · release notes

   Renames jpeg_carved extractor to jpeg, updates -S flag docs for JPEG carving

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.1 https://github.com/simsong/bulk_extractor.git
   # already have the repo? check out this version:
   $ git checkout v2.1.1

   └──▷ TRY IT
   Use the new extractor name in subsequent scans.
   copy

   $ bulk_extractor -S jpeg_carve_mode=2 <image>

   └──▷ BREAKING ON UPGRADE

   • !The jpeg_carved feature extractor is renamed to jpeg, requiring configuration updates for any setups using the previous name.
4. v2.1.0 Jan 25, 2024 · release notes

   bulk_extractor v2.1 adds stable BE2 release with RE2RE2A regular-expression engine developed by Google that guarantees linear-time matching, preventing the catastrophic backtracking that plagues PCRE-style engines and making it safe to run untrusted patterns. regex engine and configurable scanner toggles.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.0 https://github.com/simsong/bulk_extractor.git
   # already have the repo? check out this version:
   $ git checkout v2.1.0

   └──▷ USE IT
   Run bulk_extractor with an open-ended regex that previously caused hangs.
   shell copy

   bulk_extractor -F '[a-z]*@company.com' disk.img

   Re-enable the scan_outlook scanner which is off by default.
   shell copy

   bulk_extractor -eoutlook disk.img

   • -F flag now supports open-ended regular expressions without hanging due to the switch to Google's RE2 regex compiler
   • -eoutlook CLI flag re-enables the scan_outlook scanner, which is disabled by default in v2.1
   • -ehiberfile CLI flag re-enables the scan_hiberfile scanner, which is disabled by default in v2.1

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !scan_outlook and scan_hiberfile scanners are now disabled by default and must be explicitly enabled via command-line flags
   • !scan_aes no longer scans for 192-bit AES keys by default, though this behavior can be re-enabled
5. 2019-11-10 Simson Garfinkel <simsong@acm.org> Nov 10, 2019 · release notes

   Adds five new scanners for Windows prefetch, NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. MFT/log/index, and EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. events

   • Adds scan_utmp.cpp scanner for utmp system login records.
   • Adds scan_ntfsmft.cpp scanner for NTFS Master File Table entries.
   • Adds scan_ntfslogfile.cpp scanner for NTFS transaction log data.
   • Adds scan_ntfsindx.cpp scanner for NTFS index allocation nodes.
   • Adds scan_evtx.cpp scanner for Windows Event Log EVTX files.

   5 details in Everything

6. 2013-08-20 Man Page <simsong@mncrnpsedu.local> Aug 20, 2013 · release notes

   Disabled recorders no longer generate tags or carves in bulk-extractor.

   • Excludes disabled recorders from carving and tag support

   1 detail in Everything

7. 2013-07-26 Simson Garfinkel <simsong@Mucha.local> Jul 26, 2013 · release notes

   Adds -S carve_tcp flag to scan_net scanner for controlling TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./IP memory structure carving.

   └──▷ TRY IT
   Enable TCP/IP memory structure carving when running the network scanner.
   copy

   $ bulk_extractor -S carve_tcp <target_image>

8. 2011-11-23 Simson Garfinkel <simsong@imac3.home> Nov 23, 2011 · release notes

   Adds -Y start-end notation and -A offset flag to enable parallelized scanning with shifted output coordinates

   └──▷ USE IT
   Define a specific time window for analysis using start and end timestamps
   shell copy

   bulk_extractor -Y 2011-11-01:00:00:00-2011-11-02:00:00:00 image.img

   Shift output coordinates by an offset to handle parallelized scans across multiple systems
   shell copy

   bulk_extractor -A 1000000 image.img

   • Adds -Y start-end notation for defining time ranges in addition to the existing -Y start notation.
   • Adds -A offset flag to shift output coordinates, enabling parallel processing across multiple systems.

   2 details in Everything

9. 2011-11-05 Simson Garfinkel <simsong@ncr.nps.edu> Nov 5, 2011 · release notes

   bulk-extractor updates to zip and prefetch parsers with net module dropping libpcap dependency

   • Zips components with no name now receive the <NONAME> label instead of being skipped or misnamed.
   • WinPrefetch parser modified to only output prefetch entries where the exec name is non-zero.
   • Net module updated to perform packet carving without requiring libpcap, removing an external dependency.

   3 details in Everything

10. 1.0.5 Sep 29, 2011 · release notes

    bulk-extractor 1.0.5 adds -Z flag to auto-delete output and renames -3 to -2

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.5 https://github.com/simsong/bulk_extractor.git
    # already have the repo? check out this version:
    $ git checkout 1.0.5

    └──▷ TRY IT
    Process an image and automatically remove the output folder when finished.
    copy

    $ bulk_extractor -Z -s <session> <image>

    • -Z option added to zap (delete) the output directory after processing is complete.
    • -3 option renamed to -2 as phase 3 was removed.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -3 flag is no longer valid; use -2 instead.
11. 2011-09-29 System Administrator <root@arlington-8-30-77-137.ncr.vt.edu> Sep 29, 2011 · release notes

    Adds -Y (-Y <start_offset>) flag to bulk-extractor for setting the start offset in phase 1.

    └──▷ USE IT
    Start scanning an image or disk image from a specific byte offset.
    shell copy

    bulk_extractor -Y <start_offset> <target>

    • Adds -Y flag (mapped to opt_offst_start) to control where phase 1 processing begins

    1 detail in Everything

12. 2011-06-08 Simson L. Garfinkel <simsong@ps14412.dreamhostps.com> Jun 8, 2011 · release notes

    Adds ALERT_ONLY flag support for disabled recorders in bulk-extractor

13. 2011-05-14 Simson Garfinkel <simsong@Alphonse-Mucha.local> May 14, 2011 · release notes

    bulk_extractor now automatically computes and reports the disk image MD5 in report.xml

    └──▷ USE IT
    Verify disk image integrity immediately after extraction without running a separate hashing tool.
    shell copy

    bulk_extractor -f result/ diskimage.img && grep MD5 result/report.xml

    • Adds automatic MD5 computation for disk images and includes the hash in report.xml

    1 detail in Everything

14. 2011-02-15 Simson Garfinkel <simsong@imac3.home> Feb 15, 2011 · release notes

    Adds -C flag to set context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it. size in bulk-extractor

    └──▷ USE IT
    Set a custom context window size (e.g., 4096 bytes) for memory-efficient processing.
    shell copy

    bulk_extractor -C 4096 -o output /path/to/image

    └──▷ BREAKING ON UPGRADE

    • !The process_with_callback parameter of the process_raw class has been removed.
15. 2010-12-21 Simson Garfinkel <simsong@Silver-Surfer.local> Dec 21, 2010 · release notes

    Bulk Extractor adds IP, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., and Ether histogram support.

16. 2010-12-16 Simson Garfinkel <simsong@247.sub-69-99-140.myvzw.com> Dec 16, 2010 · release notes

    Adds print_raw field and /r flag to bulk-extractor CLI for raw output control.

    └──▷ TRY IT
    Enable raw output mode for disk image analysis using the new CLI flag.
    copy

    $ bulk_extractor -r <image_file>

    • Adds print_raw field to scanner_params struct in src/bulk_extractor.h
    • Adds /r CLI flag in process_path to enable printing of raw data when print_raw is set

    2 details in Everything

17. 2010-12-05 Robert Beverly <rbeverly@nps.edu> Dec 5, 2010 · release notes

    bulk-extractor adds Ethernet and sockaddr_in carving capabilities

    └──▷ BREAKING ON UPGRADE

    • !The source file src/scan_tcp.cpp has been renamed to src/scan_net.cpp.
18. 0.6.0 Nov 28, 2010 · release notes

    bulk-extractor 0.6.0 adds opt_margin CLI flag and scan_find function

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.0 https://github.com/simsong/bulk_extractor.git
    # already have the repo? check out this version:
    $ git checkout 0.6.0

    • Adds opt_margin user-specified option to control margin behavior
    • Introduces scan_find function in src/scan_find.cpp for scanning operations
    • Removes Bloom filter dependency from feature_recorder, limiting it to wordlist deduplication

    3 details in Everything

19. 2010-11-20 Simson Garfinkel <simsong@imac3.local> Nov 20, 2010 · release notes

    Adds scan_pdf scanner to bulk-extractor for extracting text from PDF files.

    • Added scan_pdf scanner to extract text content from PDF files
    • Removed histogram_all field from the feature recorder module in favor of configuration-driven histograms

    2 details in Everything

20. 2010-08-26 Simson Garfinkel <simsong@Silver-Surfer.local> Aug 26, 2010 · release notes

    Adds scanner enable/disable control to bulk_extractor for performance optimization

    • Adds ability to disable specific scanners via bulk_extractor configuration to skip processing entirely rather than just suppressing results.

    1 detail in Everything

21. 2010-07-02 Simson L. Garfinkel <simsong@imac2.home> Jul 2, 2010 · release notes

    Adds split-raw file handling in src/image_process.cpp to process multi-part images.

    • Updates image_process.cpp to handle split-raw files when specifying a base filename with extension (e.g., filename.000) as the first file, automatically searching for and using subsequent parts.

    1 detail in Everything

22. 2010-04-08 Simson Garfinkel <simsong@46.sub-75-211-31.myvzw.com> Apr 8, 2010 · release notes

    Adds E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. image support and wordlist extraction to bulk-extractor.

    • Adds E01 format support for disk images.
    • Adds wordlist extraction capability via updated src/scan_wordlist.cpp.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The verbose flag has been removed from the binary.