Page tree
Skip to end of metadata
Go to start of metadata

The BitCurator Environment includes many individual tools to perform specific curation tasks.

BitCurator-specific tools

BitCurator Reporting Tool: A GUI-driven (and optionally command-line) tool for running forensics tools in sequence to produce human- and machine-readable reports.

BitCurator Disk Image Access Tool: A GUI interface to browse raw and forensically-packaged disk images, export files and deleted items, and view disk image metadata.

BitCurator Mounter: A Qt GUI application to list currently attached devices along with technical details. Allows users to mount fixed and removable media according to the current mount policy.

BitCurator Read-Only AppIndicator: A Ubuntu AppIndicator allowing users to switch the system mount policy between "Read Only" and "Read/Write" for any attached media prior to mounting.

Nautilus scripts: Support for various interactions with files and file systems.

Safe Mount: Software write-blocking for digital media.


Disk imaging

GuymagerMulti-threaded open-source forensic disk imaging tool.

dcfldd: A forensics-focused rewrite of dd.

dd: Create raw disk images and transfer data between devices.

ddrescue: A version of dd with additional options for data recovery.

ewfacquire: Acquire Expert Witness packaged disk images from devices on the command line.

cdrdao: CD imaging tool (primarily for audio CDs).


Forensic analysis

bulk_extractor: A stream-based tool for disk image analysis.

bulk_extractor Viewer (BEViewer): The GUI front-end for bulk-extractor

DFXML tools: A set of C and Python programs to process Digital Forensics XML.

fiwalk: File system analysis and DFXML export.

The Sleuth Kit: A suite of forensics tools, utilities, and APIs.

libewf: Open-source support for the Expert Witness format.

AFFLIB: Open-source library for the Advanced Forensic Format.

pyExifToolGUI: A GUI front-end for Exiftool. Allows editing of image metadata.

sdhash: File similarity tool using similarity digests.

ssdeep: Fast hash generation.


Other tools

ClamAV / ClamTK: Virus scanning.

FSlint: Duplicate file identification and deletion.

HFS Utilities: Utilities providing access to legacy HFS file systems, such as HFS Explorer.

readpst: A utility for reading and exporting the contents of PST files.

GTK Hash: A cryptographic hashing tool.

GHex: A hex viewer/editor


  • No labels