{"id":29286650,"url":"https://github.com/ostafen/digler","last_synced_at":"2025-10-09T09:13:56.632Z","repository":{"id":300995119,"uuid":"857274678","full_name":"ostafen/digler","owner":"ostafen","description":"Digler is a tool for forensic disk analysis and file recovery. It's designed to help you unearth lost or deleted data from various disk images and raw devices.","archived":false,"fork":false,"pushed_at":"2025-06-24T15:48:45.000Z","size":484,"stargazers_count":3,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-24T16:46:36.780Z","etag":null,"topics":["cli-tool","data-recovery","deleted-file-recovery","dfxml","digital-forensics","disk-analysis","disk-image","file-carving","filesystem-analysis","golang","photo-recovery","plugin-architecture"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ostafen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2024-09-14T08:05:16.000Z","updated_at":"2025-06-24T16:20:39.000Z","dependencies_parsed_at":"2025-06-24T16:46:42.242Z","dependency_job_id":"38992d80-d75b-490b-8ec0-724a4bae1b9a","html_url":"https://github.com/ostafen/digler","commit_stats":null,"previous_names":["ostafen/digler"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/ostafen/digler","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ostafen%2Fdigler","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ostafen%2Fdigler/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ostafen%2Fdigler/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ostafen%2Fdigler/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ostafen","download_url":"https://codeload.github.com/ostafen/digler/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ostafen%2Fdigler/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263828749,"owners_count":23516792,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli-tool","data-recovery","deleted-file-recovery","dfxml","digital-forensics","disk-analysis","disk-image","file-carving","filesystem-analysis","golang","photo-recovery","plugin-architecture"],"created_at":"2025-07-06T00:10:25.373Z","updated_at":"2025-10-09T09:13:56.626Z","avatar_url":"https://github.com/ostafen.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n\u003cimg alt=\"Digler Logo\" src=\"assets/logo.png\" width=\"300px\"\u003e\n\u003c/p\u003e\n\u003ch2 align=\"center\"\u003eDigler - Go Deep. Get Back Your Data\u003c/h2\u003e\n\n\u003cp align=\"center\"\u003e\n  ⚠️ \u003cstrong\u003eNote:\u003c/strong\u003e Digler is in early development (\u003ca href=\"https://github.com/ostafen/digler/releases/tag/v0.1.0\" target=\"_blank\" rel=\"noopener noreferrer\"\u003ev0.1.0\u003c/a\u003e). Some bugs may exist. Please report issues!\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://github.com/ostafen/digler/actions/workflows/build.yml\"\u003e\n    \u003cimg src=\"https://github.com/ostafen/digler/actions/workflows/build.yml/badge.svg\" alt=\"Build Status\"\u003e\n  \u003c/a\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003cimg alt=\"Digler Demo\" src=\"assets/demo.gif\" width=\"500px\"\u003e\n\u003c/p\u003e\n\n## Why Digler?\n\nWhile many data recovery tools exist, few offer the combination of simplicity, flexibility, and modern design with deep disk analysis and effective file carving.\n\nDigler was created to fill this gap by providing a streamlined, plugin-extensible tool for data recovery that’s both powerful and easy to use. It offers both a **command-line interface and a user-friendly desktop application**, making it accessible for professionals and casual users alike. Whether you prefer the speed and scriptability of the CLI or the convenience of a visual interface, Digler adapts to your workflow without the complexity of heavyweight GUIs or fragmented tools.\n\nBuilt in Go, Digler leverages the language’s strengths in performance, cross-platform support, and maintainability to deliver a fast and dependable solution for today’s data recovery challenges.\n\n\n## Features\n\n* **Broad Disk Image and Raw Device Support**: Analyze a wide array of disk image formats (`.dd`, `.img`, etc...) or directly access physical disks.\n\n* **File System Agnostic Analysis**: Recover deleted files regardless of the underlying file system (e.g., NTFS, FAT32, ext4), even when metadata is lost.\n\n* **Plugin-Based Extensibility**: Support for custom file scanners through plugins, simplifying integration with new file formats.\n\n* **Reporting Capabilities**: Generate detailed reports, compliant with the `Digital Forensics XML (DFXML)` format, of recovered data and analysis findings.\n\n* **Post-Scan Data Recovery**: Utilize the generated DFXML reports to precisely recover specific files.\n\n* **Dual Interface Options**: Use Digler through a fast, intuitive command-line interface or a modern desktop application—choose the interface that best fits your workflow.\n---\n\n## Installation\n\n**From Source:**\n\n```bash\ngit clone https://github.com/ostafen/digler.git\ncd digler\nmake build\n```\n\n**From Precompiled Binaries:**\n\nPrecompiled binaries are available for Linux, macOS, and Windows on the [Releases page](https://github.com/ostafen/digler/releases).\n\n## CLI Usage\n\nDigler follows a simple but powerful workflow: **scan first, recover later**. This approach lets you analyze disks or images thoroughly before extracting any files.\n\n### 1. Scan a Disk Image or Device\n```bash\nfoo@bar$ digler scan \u003cimage_or_device\u003e\n```\n\nExample:\n\n###\n```bash\nfoo@bar$ digler scan dfrws-2006-challenge.raw\n```\n\nor, to scan an entire disk partition:\n\n###\n```bash\nfoo@bar$ digler scan /dev/nvme0n1 # or C: on Windows\n```\nBy default, the command generates a detailed DFXML report describing the findings, together with a detailed execution log. However, you can optionally specify a dump directory to to recover files immediately during scanning.\n\n```bash\nfoo@bar$ --dump \u003cpath/to/dump/dir\u003e\n```\n\n### 2. Mount Scan Results as a Filesystem (Linux only)\n```bash\nfoo@bar$ digler mount \u003cimage_or_device\u003e \u003creport_file.xml\u003e --mountpoint /path/to/mnt\n```\n\nExample:\n\n```bash\ndigler mount dfrws-2006-challenge.raw report.xml --mountpoint /mnt/recover\n```\n\nThis mounts a FUSE filesystem allowing you to browse and access recovered files directly from the scan report, without copying anything yet.\n\n### 3. Recover Files Based on Scan Report\n```bash\nfoo@bar$ digler recover \u003cimage_or_device\u003e \u003creport_file.xml\u003e --dir /path/to/dir\n```\n\nExample:\n\n```bash\nfoo@bar$ digler recover dfrws-2006-challenge.raw report.xml --dir ./recover\n```\n\n### Test Datasets\n\nTo help you get started with real-world testing and evaluation, here are some publicly available disk image datasets commonly used in digital forensics research:\n\n- **DFRWS Forensic Challenge Images**\n  [DFRWS 2006 Challenge](https://www.dropbox.com/scl/fi/il7qier2mg7azy13znmvc/dfrws-2006-challenge.zip?rlkey=iueltr1kelpcbdhctnabt2gfn\u0026e=1\u0026dl=0) — a classic forensic image used for recovery challenges and benchmarking.\n\n- **Digital Corpora**\n  [Digital Corpora Repository](https://digitalcorpora.org/) — a rich collection of forensic datasets including disk images, memory dumps, and more.\n\n- **National Institute of Standards and Technology (NIST) Datasets**\n  [NIST Computer Forensics Reference Data Sets (CFReDS)](https://www.cfreds.nist.gov/) — a wide variety of forensic datasets for research and tool evaluation.\n\nYou can download these images and use Digler’s `scan` and `recover` commands to experiment and validate your setup.\n\n\n### Supported File Types\n\nEven in its early stages, Digler is already capable of recovering a wide range of file types, including documents, images, audio, and archives.\n\nTo see the complete list of supported formats, run:\n\n```bash\nfoo@bar$ digler formats\n```\n\n## Adding Custom Scanners via Plugins\n\nDigler supports a plugin architecture that allows you to extend the tool with custom file scanners. This makes it easy to add support for new file formats or specialized carving logic without modifying the core code.\n\n### Plugin Interface\nYour plugin must implement the following interface:\n\n```golang\ntype FileScanner interface {\n    Ext() string                  // Returns the file extension this scanner handles\n    Description() string          // A brief description of the file type\n    Signatures() [][]byte         // Byte signatures used to identify the file type\n    ScanFile(r *Reader) (*ScanResult, error) // Logic to scan and recover files from a Reader\n}\n```\n\nWhen your plugin is ready, place its source file in the plugins/ directory and compile all plugins by running:\n\n```bash\nfoo@bar$ make plugins\n```\n\nThis will build your plugin(s) as `.so` files and place them in the **bin/plugins/** folder, ready to be loaded by Digler.\n\nTo verify that your plugins are correctly loaded, run:\n\n```bash\nfoo@bar$ digler formats --plugins ./bin/plugins\n```\n\nThis command will lists all supported file formats, including those provided by your custom plugins.\n\nFinally, use the same --plugins flag when scanning to enable your plugins:\n\n```bash\nfoo@bar$ digler scan \u003cimage_or_device\u003e --plugins ./bin/plugins\n```\n\n## Contributing\n\nWriting a comprehensive file carver is a complex challenge. Each supported file type often requires a format-specific decoder to properly identify, validate, and reconstruct data. This makes the development of Digler both technically demanding and highly modular — the perfect scenario for open source collaboration.\n\nWe welcome contributions of all kinds, especially in areas like:\n\n- Implementing new file format decoders\n- Improving existing carving heuristics\n- Optimizing performance\n- Enhancing the CLI interface\n- Writing tests, docs, or usage examples\n\nWhether you're familiar with Go or just interested in digital forensics, your help is appreciated.\n\n### Getting Started\n\nBefore you start, **please open an issue** (or pick an existing one) to discuss your idea or planned changes. This helps avoid duplicate work and keeps development aligned.\n\n**Please read our [Code of Conduct](CODE_OF_CONDUCT.md) before getting started.**\n\nOnce you're ready, fork the repository and submit your pull request!\n\n## License\n\nDigler is released under the **MIT License**.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fostafen%2Fdigler","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fostafen%2Fdigler","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fostafen%2Fdigler/lists"}