Autopsy vs bulk_extractor
GitHub Stats
About Autopsy
Autopsy is a digital forensics platform with a user-friendly GUI, designed to facilitate disk image analysis, timeline analysis, keyword searching, and hash filtering. Developed in Java, it integrates with the Sleuth Kit and supports a wide range of forensic investigations, from file recovery to artifact analysis. Autopsy's comprehensive feature set and ease of use make it a valuable tool for forensic examiners and law enforcement agencies conducting digital investigations.
About bulk_extractor
bulk_extractor is a high-performance digital forensics tool that scans disk images, files, or directories and extracts useful information without parsing the file system or file system structures. It finds email addresses, URLs, credit card numbers, JPEG images, JSON fragments, GPS coordinates, Windows registry fragments, AES keys, and other artifacts by scanning raw data. This approach means it can recover data from unallocated space, slack space, compressed archives, and even encrypted volumes where the key is present in memory. bulk_extractor operates on the raw bytes of the input, dividing it into pages that are processed in parallel across all available CPU cores, making it extremely fast - often 10x faster than other carving tools. Its output consists of feature files that can be analyzed with tools like the included bulk_diff utility or imported into other analysis platforms.
Platform Support
Tags
Shared
Autopsy only
bulk_extractor only