22  bulk_extractor(1) - Kailash Tool Reference

22.1 bulk_extractor

bulk_extractor - Extracts features (emails, URLs, cards) from disk images without parsing the filesystem.

Layer CLASSIC
Category c-09-forensics-ir-reporting
Safety class safe
Licence MIT
Upstream github.com/simsong/bulk_extractor

22.1.1 NAME

bulk_extractor - Extracts features (emails, URLs, cards) from disk images without parsing the filesystem.

22.1.2 SYNOPSIS & usage

Derived from the upstream README at generation time; verify against --help where the tool is installed.

git clone https://github.com/simsong/bulk_extractor.git
./bootstrap.sh
./configure
make
make check
make install

22.1.3 DESCRIPTION (upstream)

bulk_extractor is a high-performance digital forensics exploitation tool. It is a “get evidence” button that rapidly scans any kind of input (disk images, files, directories of files, etc) and extracts structured information such as email addresses, credit card numbers, JPEGs and JSON snippets without parsing the file system or file system structures. The results are stored in text files that are easily inspected, searched, or used as inputs for other forensic processing. bulk_extractor also creates histograms of certain kinds of features that it finds, such as Google search terms and email addresses, as previous research has shown that such histograms are especially useful in investigati

22.1.4 CONFIGURATION (detected)

Config-surface markers detected in the upstream README (2 matches, e.g. environment variables, mingw.yml). A full config reference page for this tool is queued under the config-page policy — this line is the detection record, not the page.

22.1.5 SEE ALSO

ref: pin - verified 2026-10-14