public / bulk_extractor

Bulk Extractor Viewer (BEViewer) is a User Interface for browsing features that have been extracted via the bulk_extractor feature extraction tool. BEViewer supports browsing multiple images and bookmarking and exporting features. BEViewer also provides a User Interface for launching bulk_extractor scans.

Latest available downloads:

  • BEViewer-1.3-devel_006.jar for Linux and Mac (added June 19, 2012)
  • be_installer_64-1.2.0b4.msi for Windows (added May 25)
Table of Contents

Running BEViewer

  • Windows
  • Linux, Macintosh
  • CERT Linux Forensics Repository
    • Run the command BEViewer from the command line. Note that bulk_extractor_viewer and gbulk_extractor are aliases to BEViewer
      • .

Version Information

BEViewer v1.2.1-devel_004 and newer supports bulk_extractor v1.2.0 and newer. Please see Capabilities being introduced in BEViewer, below, for changes. Note that some "Run bulk_extractor" options are not compatible with bulk_extractor 1.2.0 which is packaged with it, please see Limitations, below. If you do not require the Context Stoplist option, you may prefer this update. Otherwise, you may choose to continue with 1.2.0.msi and 1.2.1-devel_002.jar.

Capabilities being introduced in BEViewer

1.3-devel_006

This update is expected to be fully forward-compatible with bulk_extractor v1.3 expected in July.
  • The "Case" file commands are replaced with "Work Settings" in order to accurately reflect what is going on.
  • Errors involving invalid filenames are managed better.

1.2.1-devel_004

  • The Copy function has been fixed, allowing Feature and Image range selections to be copied to the System Clipboard.
  • The list of scanners is now always visible when starting "Run bulk_extractor" (the list was not being displayed in newer versions of bulk_extractor).

1.2.1-devel_003

  • Feature formatters have readable output for most feature types.
  • User Interface usability has been improved. Also, the ESC key now deselects selections.
  • BEViewer now accepts command-line input parameters during invocation. In particular, input -r starts a bulk_extractor scan when BEViewer starts.
  • Printing is now supported for Feature content.
  • Unused libewfcs code is no longer packaged in the .msi file, most notably file libewfcstester.exe.
  • Limitations: BEViewer's Run bulk_extractor UI is designed to run bulk_extractor V1.2.3, not bulk_extractor V1.2.0. Because of this, the Context Stoplist option does not work and new options (page size, block size, option name, max wait, processing range, offset, and erase) are not supported.

V0.2.17_Beta

  • Features have been corrected to no longer show escape codes.
  • Feature formatters provide readable output for specific feature types: GPS, EXIF. To be done: IP, TCP, JSON.
  • BEViewer is now compatible with bulk_extractor v1.2 and is expected to be forward-compatible with bulk_extractor v1.3.
  • User Interface usability has been improved.
  • Misc. capability has been added: the ability to scan from a Raw Device on Linux, the ability to print Feature content.

Still to be done

  • Feature formatter outputs for some format types may be adjusted.
  • The printing of Feature content may be adjusted.

Contacts

BEViewer has Moved

bulk_extractor and BEViewer are now hosted here on github at https://github.com/simsong/bulk_extractor/wiki. Their old home pages are being discontinued:

Markdown Cheat Sheet

Format Text

Headers

# This is an <h1> tag
## This is an <h2> tag
###### This is an <h6> tag

Text styles

*This text will be italic*
_This will also be italic_
**This text will be bold**
__This will also be bold__

*You **can** combine them*

Lists

Unordered

* Item 1
* Item 2
  * Item 2a
  * Item 2b

Ordered

1. Item 1
2. Item 2
3. Item 3
   * Item 3a
   * Item 3b

Miscellaneous

Images

![GitHub Logo](/images/logo.png)
Format: ![Alt Text](url)

Links

http://github.com - automatic!
[GitHub](http://github.com)

Blockquotes

As Kanye West said:

> We're living the future so
> the present is our past.

Code Examples in Markdown

Syntax highlighting with GFM

```javascript
function fancyAlert(arg) {
  if(arg) {
    $.facebox({div:'#foo'})
  }
}
```

Or, indent your code 4 spaces

Here is a Python code example
without syntax highlighting:

    def foo:
      if not bar:
        return true

Inline code for comments

I think you should use an
`<addr>` element here instead.
Something went wrong with that request. Please try again. Dismiss

Looking for the GitHub logo?