BULK_EXTRACTOR(1)

🌸 NAME 🌸 (this is BULK_EXTRACTOR(1), from the General Commands Manual)

okay so bestie, this is bulk_extractor — it scans a disk image for regular expressions and other content. Iconic little forensic goblin behavior, honestly 💅✨

✨ SYNOPSIS ✨

bulk_extractor -o output_dir [options] [ image | -R dir ]

💖 DESCRIPTION 💖

bulk_extractor scans a disk image (or literally any other file) for a whole bunch of pre-defined regular expressions and other kinds of content. Those found items are called features. When it finds a feature, bulk_extractor writes the output to an output file. Each line of the output file contains a byte offset at which the feature was found, a tab, and the actual feature. So features cannot contain the end-of-line character — no line breaks allowed, periodt 😌

bulk_extractor has native support for EnCase (.E01) and AFFLIB (.aff) files, if it compiled and linked on a system containing those libraries. Alternatively, the -R option can be used to recursively scan and process a directory of individual files — and heads up: disk images in such a directory will be treated as files, not as disk images. Not me warning you about the vibe shift 😭

bulk_extractor is multi-threaded. By specifying the -j option, multiple copies of the program can be run. Each thread writes its results into its own feature file. The files are then combined by the primary thread when all of the secondary threads complete. teamwork makes the dream work, fr fr 🫶

bulk_extractor is a two-phase program. In phase 1 the features are extracted. In phase 2 a histogram is created of relevant features. two phases, one slay ✨

bulk_extractor will also create a wordlist of all the words that are found in the disk image. This can be used as a dictionary for cracking encryption. lowkey iconic and a little scary 💀

okay, the options are as follows, bestie:

• -o outdir — specifies the output directory, which will be created by bulk_extractor if necessary. If the output directory contains data from a partial bulk_extractor run, bulk_extractor will attempt to resume where the previous run left off. resuming? we love a comeback era 💖
• -b bannerfile.txt — reads the contents of bannerfile.txt and stamps it at the beginning of each output file. This might be useful if you have some kind of privacy banner that needs to be stamped at the top of all your files. cute little header moment 🎀
• -r alert_list.txt — specifies an alert list (or red list), which is a list of terms that, if found, will be specifically flagged in a special alert file that begins with the letters ALERT. The alert list may contain individual terms, which must be found in their entirety and are case-sensitive, or wildcards with standard Unix globbing (e.g. *@company.com). Globbed terms are case-insensitive. red list energy 🔥
• -w stop_list.txt — specifies a stop list (or white list), which is a list of terms that, if found, will be placed in a special stopped file (rather than in the main file). The whitelist may also contain globbed terms. into the stopped file you go 🫡
• -s frac[:passes] — specify random sampling parameters. sampling arc, unlocked 🌈
• -p path/format — open a disk image and print the information found at path. The format specification may be r for raw output and h for hex output. Specify -p - for interactive mode. Specify -p -http for HTTP mode. choose your fighter: raw, hex, interactive, HTTP 💅
• -F <rfile> — specifies a file of regular expressions to be used as search terms. regex buffet, no cap 🍓
• -f <regex> — specifies a regular expression to be used as a search term. one regex, one mission ⭐
• -q nn — quiet mode. Only prints every nn status reports. Specify -1 for no status. shhh era 🙈
• -Wn1:n2 — the scan_wordlist scanner should only extract words that are between n1 and n2 characters in length. word length filter, periodt 🎀

🔧 TUNING 🔧

these commands are useful for tuning operation:

• -C NN — specifies the size of the context window. context window glow-up ✨
• -S fr:<name>:window=NN — specifies context window for recorder <name> to NN.
• -S fr:<name>:window_before=NN — specifies context window after to NN for recorder <name>. (that is what the page says, bestie 😭)
• -S fr:<name>:window_after=NN — specifies context window before to NN for recorder <name>. (again, exactly as written 🙈)
• -G NN — specify the page size. pages are having a moment 📄
• -g NN — specifies the size of the margin in bytes. margin rights 💅
• -j NN — use n threads for analysis. Normally you do not need to specify this, as the default is the number of processors on the current computer. multitasking queen 👑
• -m NN — have bulk_extractor wait at most NN minutes for scanners to finish after all data have been read. patience, but make it timed ⏳

🐛 DEBUGGING 🐛

the following commands are useful for debugging:

• -V — print the version number. version check, slay 🔥
• -R outdir — restarts the program from where it left off for a particular directory. restart era 🔁
• -B nn — set the dedup Bloom filter to nn bits. This is used by the scan_wordlist scanner. bloom filter business 🌸
• -M nn — specifies a maximum recursion depth of nn. don't go too deep, bestie 🌀
• -z pagenum — start on page number pagenum. page jump 📖
• -Y <o1>[-<o2>] — start at input offset o1 optionally ending at offset o2. offset range, cute 🌈
• -dN — enable debugging level N. debug goblin mode 🧚

🎛️ SCANNER CONTROL 🎛️

finally, you can control scanners with these options:

• -P <dir> — specifies a directory in which to find plugins. plugin hunting 🕵️‍♀️
• -E scanner — turns off all scanners, then enables the scanner scanner. hard reset, but make it scanner-specific 💥
• -e scanner — enables a scanner. turn it on ✨
• -x scanner — disables a scanner. turn it off 🙅‍♀️

📜 HISTORY 📜

bulk_extractor is based on a feature extractor and named entity recognizer developed for SBook in 1991. The feature extractor was repurposed for disk images in 2003. The stand-alone bulk_extractor program was rewritten in 2005 and publicly released in 2007. The multi-threaded bulk_extractor was released in May 2010. lore drop, honestly 📚✨

👑 AUTHOR 👑

Simson Garfinkel <simsong@acm.org>

---

cute little sign-off, bestie: the footer says source/version line User Manuals, date OCT 2013, and manual BULK_EXTRACTOR(1) — bye bestie, go extract some features 🫶💖✨