Dissect
A digital forensics and incident response framework for unified analysis of forensic artifacts across disk formats, filesystems, and operating systems.
What is Dissect?
Dissect is a digital forensics and incident response framework that allows analysts to quickly access and analyze forensic artifacts from various disk and file formats. It solves the problem of manual, fragmented forensic workflows by providing a unified interface that handles container formats, filesystems, and operating systems transparently. With tools like `target-query` and `acquire`, it streamlines evidence collection and analysis.
Digital forensics analysts, incident responders, security researchers, and DFIR tool developers who need to analyze disk images, memory dumps, or live systems across diverse environments.
Developers choose Dissect for its singular approach to forensic analysis, eliminating the need to chain multiple tools for extraction, mounting, and parsing. Its modular design allows customization, while the unified CLI tools reduce complexity and speed up investigations.
Overview
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
Use Cases
Best For
- Analyzing disk images (E01, VMDK, QCoW) without manual extraction
- Incident response investigations across Windows, Linux, and ESXi systems
- Creating lightweight forensic containers from endpoints or hypervisors
- Parsing forensic artifacts like MFT, event logs, and registry files
- Building custom DFIR tools using modular parsers
- Educational or training environments for digital forensics
Not Ideal For
- Incident responders who prefer graphical user interfaces over command-line tools
- Organizations that mandate vendor-supported, commercial forensic suites for compliance
- Analysts performing simple, one-off file parsing without needing a full Python framework
Pros & Cons
Pros
Provides a singular approach to analyze artifacts across containers, filesystems, and OSes, as shown by commands like `target-query -f mft` that eliminate manual extraction and parsing steps.
The `acquire` tool creates lightweight containers from endpoints or hypervisors without dealing with file-locks, streamlining live system acquisition.
Each parser and implementation can be used independently or combined, allowing for custom DFIR tool development, as highlighted in the modular architecture.
Easy installation via `pip install dissect` and access to CLI tools like `target-shell`, with an interactive playground at try.dissect.tools for immediate use.
Cons
Requires Python installation and management, which can be a hurdle in environments where other languages are standard or where Python is restricted.
Critical information is in separate documentation (docs.dissect.tools), not self-contained in the README, potentially slowing initial setup and learning.
The AGPL3 license may impose sharing obligations that are unsuitable for proprietary or closed-source commercial projects, limiting adoption in some sectors.
Frequently Asked Questions
Related Projects
FLARE VMA collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Fleet device managementOpen device management
grrGRR Rapid Response: remote live forensics for incident response
VelociraptorDigging Deeper....
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.