A digital forensics and incident response framework for unified analysis of forensic artifacts across disk formats, filesystems, and operating systems.
Dissect is a digital forensics and incident response framework that allows analysts to quickly access and analyze forensic artifacts from various disk and file formats. It solves the problem of manual, fragmented forensic workflows by providing a unified interface that handles container formats, filesystems, and operating systems transparently. With tools like `target-query` and `acquire`, it streamlines evidence collection and analysis.
Digital forensics analysts, incident responders, security researchers, and DFIR tool developers who need to analyze disk images, memory dumps, or live systems across diverse environments.
Developers choose Dissect for its singular approach to forensic analysis, eliminating the need to chain multiple tools for extraction, mounting, and parsing. Its modular design allows customization, while the unified CLI tools reduce complexity and speed up investigations.
Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Provides a singular approach to analyze artifacts across containers, filesystems, and OSes, as shown by commands like `target-query -f mft` that eliminate manual extraction and parsing steps.
The `acquire` tool creates lightweight containers from endpoints or hypervisors without dealing with file-locks, streamlining live system acquisition.
Each parser and implementation can be used independently or combined, allowing for custom DFIR tool development, as highlighted in the modular architecture.
Easy installation via `pip install dissect` and access to CLI tools like `target-shell`, with an interactive playground at try.dissect.tools for immediate use.
Requires Python installation and management, which can be a hurdle in environments where other languages are standard or where Python is restricted.
Critical information is in separate documentation (docs.dissect.tools), not self-contained in the README, potentially slowing initial setup and learning.
The AGPL3 license may impose sharing obligations that are unsuitable for proprietary or closed-source commercial projects, limiting adoption in some sectors.