Day 5 數位鑑識 Bulk Extractor

前情提要: 市面上有幾款免費開源的記憶體工具，Ex: Volatility、Bulk Extractor等等 有時候在幫客戶分析記憶體時，想看證據映像檔的封包時，可以使用Bulk Extractor提取pcap檔案 是相當方便且建議大家一定要認識的鑑識工具 在安裝Bulk Extractor前，請大家先下載Java，以免於安裝過程中跳出報錯訊息喔!!! 下載網址: https://downloads.digitalcorpora.org/downloads/bulk_extractor/

bulk_extractor operates on disk images, files or a directory of files and extracts useful information without parsing the file system or file system structures. The input is

split into pages and processed by one or more scanners. The results are stored in feature files that can be easily inspected, parsed, or processed with other automated tools.

bulk_extractor also creates histograms of features that it finds. This is useful because

features such as email addresses and internet search terms that are more common tend

to be important.