Skip to content
This repository

This is the development tree. For downloads please see:

Octocat-spinner-32 doc fixed errors in unquoting April 17, 2014
Octocat-spinner-32 java_gui fix typo December 10, 2013
Octocat-spinner-32 m4 updated for mingw April 22, 2014
Octocat-spinner-32 man update manpage for 1.4 August 06, 2013
Octocat-spinner-32 plugins words in sql April 17, 2014
Octocat-spinner-32 python switch heartbeat api code to 0 to match library April 09, 2014
Octocat-spinner-32 specfiles migration from internal SVN to github December 10, 2012
Octocat-spinner-32 src upped version number to 1.5.0-alpha1 April 24, 2014
Octocat-spinner-32 src_win upped version number to 1.5.0-alpha1 April 24, 2014
Octocat-spinner-32 tests updated for SQL April 18, 2014
Octocat-spinner-32 .gitignore sets options for creating SQL table April 03, 2014
Octocat-spinner-32 .gitmodules fixed submodule reference March 07, 2014
Octocat-spinner-32 AUTHORS update author information September 09, 2013
Octocat-spinner-32 COPYING migration from internal SVN to github December 10, 2012
Octocat-spinner-32 ChangeLog fixed errors in unquoting April 17, 2014
Octocat-spinner-32 INSTALL migration from internal SVN to github December 10, 2012
Octocat-spinner-32 added lib target April 07, 2014
Octocat-spinner-32 NEWS minor June 04, 2013
Octocat-spinner-32 README update dependency information September 19, 2013
Octocat-spinner-32 ROADMAP.txt fixes dfxml writer; better rejection of ccn2 June 04, 2013
Octocat-spinner-32 added sceadan March 07, 2014
Octocat-spinner-32 compile upgraded to newer autoconf July 09, 2013
Octocat-spinner-32 upped version number to 1.5.0-alpha1 April 24, 2014
Octocat-spinner-32 When doing lg v flex comparisons, separate what's missing from what's… September 26, 2013
Octocat-spinner-32 updated to libtool September 16, 2013
Octocat-spinner-32 migration from internal SVN to github December 10, 2012
Octocat-spinner-32 ttd.txt added comments December 20, 2013
Welcome to bulk_extractor!

Downloads and Websites

  * [Current Release](
  * [Download Archive](
  * [Forensics Wiki Entry](

Downloading the Development Tree

Download the sources with git:

  $ git clone --recursive

Compiling Notes

bulk_extractor builds with the GNU auto tools.  The maintainer has
previously run automake and autoconf to produce the script
"configure".  This script *should* be able to compile bulk_extractor
for your platform. 

We recommend compiling bulk_extractor with -O3 and that is the
default. You can disable all optimization flags by specifying the
configure option --with-noopt.

Compiling for MacOS or Linux

From the downloaded source directory run, configure and make:

  $ cd bulk_extractor
  $ sh
  $ sh configure
  $ make
  $ sudo make install

Compiling for Windows

There are three ways to compile for Windows:

  1. Cross-compiling from a Linux or Mac system with mingw.
  2. Compiling natively on Windows using mingw.
  3. Compiling natively on Windows using cygwin (untested)

Cross-compiling for Windows using Debian Testing (wheezy) or Ubuntu 12.04 LTS (with mingw):

You will need to install mingw-w64 and zlib-dev:

  $ sudo apt-get update
  $ sudo apt-get upgrade
  $ sudo apt-get -y install mingw-w64 

Next, download zlib from

  $ ./configure --host=i686-w64-mingw32

This allows the cross-compiling of the 64-bit and the 32-bit
bulk_extractor.exe, although we do not recommend running the 32-bit
version.  Now you are ready to compile:

  $ git clone --recursive
  $ cd bulk_extractor
  $ sh
  $ mingw64-configure

Cross-compiling for Windows using Fedora

Please see src_win/README for instructions on cross-compiling for Windows from Fedora
using automated scripts.

Set up mingw and the cross-compilation environment:

  $ sudo yum -y install mingw64-gcc-c++ mingw64-zlib-static mingw64-pthreads flex 
  $ sudo yum -y install autoconf automake  # not strictly needed, but necessary to build from SVN/GIT
  $ sudo yum -y install zlib-devel zlib-static
  * Run script CONFIGURE_F18.bash found in directory src_win/.
  * Run script found in directory src_win/ to install libewf and TRE.
  $ make win32
  $ make win64

Installing on a Linux/MacOS/Mingw system

  $ ./configure
  $ make
  $ sudo make install

The following directories will NOT be installed with the above commands:

    python/   - bulk_extractor python tools.
    	      	Copy them where you wish and run them directly. 
		These tools are experimental.

    plugins/  - This is for C/C++ developers only. You can develop your own
    	      	bulk_extractor plugins which will then be run at run-time
		if the .so or .dll files are in the same directory as
		the bulk_extractor executable.
This will install bulk_extractor in /usr/local/bin  (by default)

To get started and send an extract of image.raw to OUTPUT, use this command:

  $ /usr/local/bin/bulk_extractor -o OUTPUT image.raw

This will create a directory called OUTPUT that contains lots of files you should examine.

Additional packages used by bulk_extractor

The TRE or libgnurx regular expression library is required.  TRE is
preferred because experiments indicate that it is about 10X faster.

The libgnurx-static package is required.

The LIBEWF library is recommended for access to E01 files.

Packages may be installed by running the script in src_win/.
The additional libraries may be installed by running the script in src_win/.


Before compiling bulk_extractor for your platform, you may need to install
other packages on your system which bulk_extractor requires to compile cleanly.

* Installing Dependencies On Fedora:

On Fedora, this command should add the appropriate packages:

  $ sudo yum update
  $ sudo yum groupinstall development-tools
  $ sudo yum install flex
  $ sudo yum install zlib-devel

Note: the following specific packages may be loaded instead of
installing development-tools:

If the Bulk Extractor Viewer is required, also install a Java JDK Version 6
or newer.

* Installing Dependencies On Debian and Ubuntu:

On Debian Testing (wheezy) and Ubuntu 12.04, this was sufficient:

  $ sudo apt-get -y install gcc g++ flex libewf-dev 

* Installing Dependencies On Mac:

We recommend installing Mac dependencies using the MacPorts system. Once that is installed, try:

  $ sudo port install flex autoconf automake libewf-devel

Note that port installs to /opt/local/bin, so file /etc/paths may need to be updated
to include /opt/local/bin.

Note that libewf-devel may not be available in ports.  If it is not, please download
libewf source, ./configure && make && sudo make install

TRE is faster than libgnurx, so we recommend to download the source then:

  sudo make install

If you really need to read AFFLIB, you will also need to install openssldev.  Please
note that AFF is in the process of being deprecated.


If you are developing with github, after a checkout, you may wish to do this:

for i in dfxml be13_api  ; do echo $i ; (cd $i && git remote rm origin && git add origin$i.git && git checkout master ) ; done

Something went wrong with that request. Please try again.