Specifies the output directory, which will be created by
bulk_extractor if necessary.
If the output directory contains data from a partial
bulk_extractor will attempt to resume where the previous run left off.
Read the contents of
bannerfile.txt and stamp it at the beginning of each output file. This might be useful if
you have some kind of privacy banner that needs to be stamped at the
top of all of your files.
alert list, (or red list), which is a list of terms that, if found, will be specifically flagged
in a special
alert file that begins with the letters
ALERT. The alert list may contain individual terms, which
must be found in their entirity and are case-sensitive, or wildcards with standard Unix
globbing (e.g. *@company.com). Globbed terms are case-insensitive.
stop list, (or white list),
which is a list of terms that, if found, will be placed in a special
stopped file (rather than in the main file). The whitelist may also contain
random sampling parameters.
Open a disk image and print the information found at
format specification may be
r for raw output and
h for hex output.
Specify -p - for interactive mode.
Specify -p -http for HTTP mode.
Specifies a file of regular expressions to be used as search terms.
Specifies a regular expression to be used as a search term.
Quiet mode. Only prints every
nn status reports.
Specify -1 for no status.
scan_wordlist scanner should only extract words that are between
n2 characters in length.
These commands are useful for tuning operation:
-C NN Specifies the size of the context window.
-S fr:<name>:window=NN specifies context window for recorder <name> to NN.
-S fr:<name>:window_before=NN specifies context window after to NN for recorder <name>
-S fr:<name>:window_after=NN specifies context window before to NN for recorder <name>
-G NN specify the page size
-g NN Specifies the size of the margin in bytes.
-j NN Use n threads for analysis. Normally you do not need specify this, as the default is the number of processors on the current computer.
-m NN Have bulk_extractor wait at most NN minutes for scanners to finish after all data have been read.
The following commands are useful for debugging:
-V Print the version number
-R outdir Restarts the program from where it left off for a particular directory.
-B nn Set the dedup Bloom filter to nn bits. This is used by the scan_wordlist scanner.
-M nn Specifies a maximum recursion depth of nn.
-z pagenum Start on page number pagenum.
-Y <o1>[-<o2>] Start at input offset o1 optionally ending at offset o2
-dN Enable debugging level N.
Finally, you can control scanners with these options:
-P <dir> Specifies a directory in which to find plugins.
-E scanner Turns off all scanners, then enabled scanner scanner.
-e scanner Enables a scanner.
-x scanner Disables a scanner.
bulk_extractor is based on a feature extractor and named entity recognizer developed for SBook in 1991. The feature extractor was repurposed for disk images in 2003. The stand-alone bulk_extractor program was rewritten in 2005 and publicly released in 2007. The multi-threaded bulk_extractor was released in May 2010.
Simson Garfinkel <email@example.com>
|User Manuals||BULK_EXTRACTOR (1)||OCT 2013|