system environment/libraries
- libagdb - Library to access the Windows SuperFetch database (AGDB) file format
- libbde - Library to access the BitLocker Drive Encryption (BDE) format
- libbde-python2 - Python 2 bindings for libbde
- libbde-python3 - Python 3 bindings for libbde
- libbfio - Library to support (abstracted) basic file IO
- libcreg - Library to access the Windows 9x/Me Registry File (CREG) format
- libcreg-python3 - Python 3 bindings for libcreg
- libesedb - Library to access the Extensible Storage Engine (ESE) Database File (EDB) format
- libesedb-python2 - Python bindings for libesedb
- libesedb-python3 - Python 3 bindings for libesedb
- libevt - Library to access the Windows Event Log (EVT) format
- libevt-python2 - Python bindings for libevt
- libevt-python3 - Python 3 bindings for libevt
- libevtx - Library to access the Windows XML Event Log (EVTX) format
- libevtx-python2 - Python bindings for libevtx
- libevtx-python3 - Python 3 bindings for libevtx
- libewf - Library to support the Expert Witness Compression Format (EWF)
- libewf-python2 - Python bindings for libewf
- libewf-python3 - Python 3 bindings for libewf
- libexe - Library to access the executable (EXE) format
- libexe-python2 - Python 2 bindings for libexe
- libexe-python3 - Python 3 bindings for libexe
- libfplist - Library to support the plist formats
- libfsapfs - Library to access the Apple File System (APFS) format
- libfsapfs-python2 - Python 2 bindings for libfsapfs
- libfsapfs-python3 - Python 3 bindings for libfsapfs
- libfsext - Library to access the Extended File System (ext) format
- libfsext-python3 - Python 3 bindings for libfsext
- libfshfs - Library to access the Hierarchical File System (HFS) format
- libfshfs-python2 - Python bindings for libfshfs
- libfshfs-python3 - Python 3 bindings for libfsext
- libfsntfs - Library to access the Windows NT File System (NTFS) format
- libfsntfs-python3 - Python 3 bindings for libfsntfs
- libfsxfs - Library to support the X File System (XFS) format
- libfsxfs-python3 - Python 3 bindings for libfsxfs
- libfvde - Library to support the FileVault Drive Encryption (FVDE) format
- libfvde-python2 - Python 2 bindings for libfvde
- libfvde-python3 - Python 3 bindings for libfvde
- libfwevt - Library to support Windows XML Event Log (EVTX) data types.
- libfwnt - Library to support common Windows NT specific formats
- libfwnt-python2 - Python 2 bindings for libfwnt
- libfwnt-python3 - Python 3 bindings for libfwnt
- libfwps - Library for Windows Property Store data types
- libfwps-python2 - Python 2 bindings for libfwps
- libfwps-python3 - Python 3 bindings for libfwps
- libfwsi - Library to access the Windows Shell Item format
- libfwsi-python2 - Python bindings for libfwsi
- libfwsi-python3 - Python 3 bindings for libfwsi
- libhibr - Library to access the Windows Hibernation File (hiberfil.sys) format
- liblnk - Library to access the Windows Shortcut File (LNK) format
- liblnk-python2 - Python bindings for liblnk
- liblnk-python3 - Python 3 bindings for liblnk
- libluksde - Library to access the Linux Unified Key Setup (LUKS) Disk Encryption format
- libluksde-python3 - Python 3 bindings for libluksde
- libmdmp - Library to access the Windows Minidump (MDMP) file format
- libmodi - Library to access the Mac OS disk image formats
- libmodi-python2 - Python 2 bindings for libmodi
- libmodi-python3 - Python 3 bindings for libmodi
- libmsiecf - Library to access the MSIE Cache File (index.dat) format.
- libmsiecf-python2 - Python bindings for libmsiecf
- libmsiecf-python3 - Python 3 bindings for libmsiecf
- libnk2 - Library to access the Nickfile (NK2) format
- libnk2-python2 - Python 2 bindings for libnk2
- libnk2-python3 - Python 3 bindings for libnk2
- libodraw - Library to access optical disc (split) RAW formats
- libolecf - Library to access the Object Linking and Embedding (OLE) Compound File (CF) format
- libolecf-python2 - Python bindings for libolecf
- libolecf-python3 - Python 3 bindings for libolecf
- libpff - Library to to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format. PFF is used in PAB (Personal Address Book), PST (Personal Storage Table) and OST (Offline Storage Table) files.
- libpff-python2 - Python binding for libpff
- libpff-python3 - Python 3 bindings for libpff
- libphdi - Library to access the Parallels Hard Disk image format
- libphdi-python2 - Python 2 bindings for libphdi
- libphdi-python3 - Python 3 bindings for libphdi
- libqcow - Library to access the QEMU Copy-On-Write (QCOW) image file format
- libqcow-python2 - Python bindings for libqcow
- libqcow-python3 - Python 3 bindings for libqcow
- libregf - Library to access the Windows NT Registry File (REGF) format
- libregf-python2 - Python bindings for libregf
- libregf-python3 - Python 3 bindings for libregf
- libscca - Library to access the Windows Prefetch File (PF) format
- libscca-python2 - Python 2 bindings for libscca
- libscca-python3 - Python 3 bindings for libscca
- libsigscan - Library for binary signature scanning
- libsigscan-python3 - Python 3 bindings for libsigscan
- libsmdev - Library to access and read storage media (SM) devices
- libsmdev-python3 - Python 3 bindings for libsmdev
- libsmraw - Library to access the storage media (SM) (split) RAW format
- libsmraw-python2 - Python bindings for libsmraw
- libsmraw-python3 - Python 3 bindings for libsmraw
- libvhdi - Library to access the Virtual Hard Disk (VHD) image format
- libvhdi-python2 - Python bindings for libvhdi
- libvhdi-python3 - Python 3 bindings for libvhdi
- libvmdk - Library to access the VMware Virtual Disk (VMDK) format
- libvmdk-python2 - Python bindings for libvmdk
- libvmdk-python3 - Python 3 bindings for libvmdk
- libvshadow - Library to access the Windows NT Volume Shadow Snapshot (VSS) format
- libvshadow-python2 - Python bindings for libvshadow
- libvshadow-python3 - Python 3 bindings for libvshadow
- libvslvm - Library to access the Linux Logical Volume Manager (LVM) volume system
- libvslvm-python2 - Python 2 bindings for libvslvm
- libvslvm-python3 - Python 3 bindings for libvslvm
- libvsmbr - Library to access the Master Boot Record (MBR) volume system
- libvsmbr-python2 - Python 2 bindings for libvsmbr
- libvsmbr-python3 - Python 3 bindings for libvsmbr
- libwrc - Library to access the Windows Resource Compiler (WRC) format
- libwrc-python2 - Python 2 bindings for libwrc
- libwrc-python3 - Python 3 bindings for libwrc
- libwtcdb - Library to access the Windows Explorer thumbnail cache database (WTCDB) format
- packetexaminer - PacketExaminer - Analyze PCAP files
- python3-dfwinreg - Digital Forensics Windows Registry (dfWinReg).
- silk-ipset-lib - The SiLK IPset library
- sleuthkit-libs - Library for sleuthkit