Bulk Extractor with Record Carving¶
What the tool does¶
Feature extraction and record carving
Bulk Extractor with Record Carving (bulk_extractor-rec) scans evidence bytes
without relying on file-system allocation or directory structures. The supplied
Windows 1.6.0-dev-rec03 build adds scanners that carve EVTX, NTFS INDX,
$LogFile, $MFT, $UsnJrnl and Unix utmp records, and includes the Java
Bulk Extractor Viewer for launching scans and reviewing feature reports.
- Extract features
Find email addresses, domains, URLs and other scanner-defined patterns with forensic paths and context. - Carve records
Recover validated Windows record structures from allocated, unallocated or recursively decoded data. - Review reports
Navigate feature files, histograms, carved output and source context in BEViewer.
The viewer helps launch the scanner and examine its output; it does not make
every match probative. A feature can be a false positive, a carved record can
be corrupt, and a forensic path is not automatically an original filename.
Preserve the scan configuration, report.xml, feature row and source context.
Choose your journey¶
Install the version-bound record-carving build, satisfy its Java dependency and verify BEViewer.
Complete when versions and paths are recorded.Beginner · Windows · 20–35 min 02Scan and reviewRun a focused scanner against a verified image and trace one result through the report.
Complete when the feature remains attributable to its forensic path.Practical · Training image · 25–45 min 03Hands-on LabsPractise BEViewer in-browser or complete an evidence-driven record-carving Full Lab.
Complete when another analyst can reproduce the finding.Guided beginner · 25–100 minHow the workflow fits together¶
Scanner output
Feature files normally contain a forensic path, extracted feature and surrounding
context. Record-carving scanners also create carved directories and
*_carved.txt files containing offsets and sizes.
Corrupt output is evidence too
Files labelled corrupted matched a record pattern but failed one or more
integrity checks. Retain that disposition; do not silently treat them as valid.
Before you begin¶
Record the rec03 executable and Java versions; do not substitute upstream 2.x instructions.
Use a verified working image and a new output directory on separate controlled storage.
Enable only scanners needed for the investigation and plan independent parsing or corroboration.
Legacy component and untrusted output
The supplied BEViewer workflow belongs to the older rec03 build. Treat its installer, Java dependency, evidence input and carved output as untrusted. Use an isolated lab, verify downloads and never execute carved content.