Dissect
A digital forensics and incident response framework for unified analysis of forensic artifacts across disk formats, filesystems, and operating systems.
What is Dissect?
Dissect is a digital forensics and incident response framework that allows analysts to quickly access and analyze forensic artifacts from various disk and file formats. It solves the problem of manual, fragmented forensic workflows by providing a unified interface that handles container formats, filesystems, and operating systems transparently. With tools like `target-query` and `acquire`, it streamlines evidence collection and analysis.
Digital forensics analysts, incident responders, security researchers, and DFIR tool developers who need to analyze disk images, memory dumps, or live systems across diverse environments.
Developers choose Dissect for its singular approach to forensic analysis, eliminating the need to chain multiple tools for extraction, mounting, and parsing. Its modular design allows customization, while the unified CLI tools reduce complexity and speed up investigations.
Overview
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
Use Cases
Best For
- Analyzing disk images (E01, VMDK, QCoW) without manual extraction
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
