◆ Digital Forensics & Incident Response

Dissect

3.22 open-source

Digital forensics and incident response framework for parsing and analysing forensic artefacts from disk images, filesystems, and containers.

source ↗ website ↗ rss ↗ What is a cyber toolchain?

target-query --direct single_file.bin
acquire --children --enable-nfs <host_or_ip>
target-shell
>>> reload()
dissect target-diff /path/to/image1 /path/to/image2
dissect -f os.windows.regf.cam /path/to/target
target-yara <rules> <targets>
target-fs ls -lh <path>
dissect.target-query -f '*filesystem*' --dry-run /path/to/disk.dd
dissect.target-query -xf '*registry*' -f '*/etc/*' /path/to/disk.dd
dissect.target-shell /path/to/vm.ova registry

Summary

Dissect is an open-source digital forensics and incident response framework that extracts and parses forensic artefacts directly from disk images, VM containers and other sources, without first mounting or manually reconstructing filesystems. It is run through command-line tools like target-query and target-shell, or installed as a Python library via pip, and it works across containers such as E01, VMDK and QCoW, filesystems including NTFS and ExtFS, and operating systems from Windows to ESXi. It is aimed at incident responders and forensic investigators who need to pull artefacts like registry keys, event logs and prefetch files from many hosts at once rather than one image at a time. Developed by Fox-IT (NCC Group), the project dates to 2022 and has had 11 contributors and 13 releases in the tracked window, though its most recent release was around six months ago.

Digital forensics and incident response framework for parsing and analysing forensic artefacts from disk images, filesystems, and containers.

How Dissect helps

Which user accounts exist on a disk image without mounting it first?

queries the parsed filesystem and registry directly from the container and lists every account it finds, from built-in service accounts to local users

What actually happened on a compromised host, across its registry, logs and prefetch, without extracting each artefact by hand?

reads runkeys, event logs and prefetch straight from the source container in one pass and returns them in a common, queryable form

Can I build one timeline of events across every host in this investigation, not just one image at a time?

runs the same artefact query across many targets at once and returns results in a shared format that can be merged into a single timeline

Is this ransomware-encrypted virtual disk still readable for investigation?

parses the disk structure and filesystem directly from the VM container, so artefacts can be pulled out even when the guest OS itself would refuse to boot

Which of these thousands of hosts show the indicator I'm hunting for?

runs the same query or check against each target in bulk and reports matches back per host, turning a host-by-host search into a single pass

How do I pull a forensic copy off a live VM on a hypervisor without shutting it down or fighting file locks?

creates a lightweight container of the running machine directly from the hypervisor, sidestepping locked files and avoiding any downtime

all 32 features, with the evidence for each →

Languages

Not documented

Features

32 capabilities across 3 capability groups

Built from Dissect's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

Dissect covers 2 of the 8 investigation and response capabilities we track.
Dissect covers 1 of the 11 endpoint investigation and controls capabilities we track.

Disk and filesystem forensics 11 features Investigation and response since 2023

Disk Image and Filesystem Support shipped The cyber tool supports mounting and reading various disk image formats (Parallels, Open Virtual Appliance) and filesystems (DDF RAID, LUKS v2, JFFS, CPIO, VMtar). 25 releases · first seen Feb 2023