https://github.com/franckferman/datadetective
Unlock the story hidden in data - Your digital investigation partner. The Sleuth Kit Python Wrapper.
https://github.com/franckferman/datadetective
automation automation-forensics forensic forensic-analysis forensic-examinations forensic-tools forensics forensics-data forensics-investigations forensics-tools python python-3 python3 sleuthkit tsk
Last synced: 5 months ago
JSON representation
Unlock the story hidden in data - Your digital investigation partner. The Sleuth Kit Python Wrapper.
- Host: GitHub
- URL: https://github.com/franckferman/datadetective
- Owner: franckferman
- License: agpl-3.0
- Created: 2024-03-11T15:10:05.000Z (about 2 years ago)
- Default Branch: stable
- Last Pushed: 2024-08-26T13:15:53.000Z (almost 2 years ago)
- Last Synced: 2025-01-27T10:26:48.476Z (over 1 year ago)
- Topics: automation, automation-forensics, forensic, forensic-analysis, forensic-examinations, forensic-tools, forensics, forensics-data, forensics-investigations, forensics-tools, python, python-3, python3, sleuthkit, tsk
- Language: Python
- Homepage: https://github.com/franckferman/DataDetective
- Size: 675 KB
- Stars: 2
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
[![Contributors][contributors-shield]](https://github.com/franckferman/DataDetective/graphs/contributors)
[![Stargazers][stars-shield]](https://github.com/franckferman/DataDetective/stargazers)
[![License][license-shield]](https://github.com/franckferman/DataDetective/blob/stable/LICENSE)
🕵️♂️ DataDetective
Unlock the story hidden in data.
Your digital investigation partner.
## 📜 Table of Contents
Click to collapse/expand
## 📖 About
**⚠️ DataDetective is a work in progress**
Although already useful in **specific forensic investigation scenarios**, the project is still **far from complete**. The current version serves as a foundation for what will eventually become a much more **powerful**, **versatile**, and **feature-rich** forensic analysis tool.
### **What is DataDetective**
DataDetective is a Python-based tool designed to **extract, analyze, and interpret forensic evidence** from **EWF disk images** and raw storage dumps. It aims to provide investigators with a **reliable** and **efficient** method to uncover critical data for forensic analysis.
## 🚀 Installation
### Prerequisites
- **Linux** (Tested on **Debian GNU/Linux 12 Bookworm**, but should work on other distributions).
- **Python 3** (latest stable version recommended).
- **The Sleuth Kit (TSK)** - Essential for forensic disk analysis.
- **RegRipper** - Critical for extracting Windows registry artifacts.
### Getting DataDetective
#### Option 1: One-liner with `Invoke-WebRequest` (Recommended)
```shell
curl -O https://github.com/franckferman/DataDetective/blob/stable/src/DataDetective/DataDetective.py
```
#### Option 2: Clone via Git
```shell
git clone https://github.com/franckferman/DataDetective.git
```
#### Option 3: **Direct Download** from GitHub
1. Go to GitHub repo.
2. Click `<> Code` → `Download ZIP`.
3. Extract the archive to your desired location.
## 🎮 Usage
### Getting started
Once installed, you can start using DataDetective with the following commands:
❔ Get Help:
```shell
python3 DataDetective.py -h
```
⚖️ Check Image Integrity:
```shell
python3 DataDetective.py -i image.ewf --check-image
```
📋 List Image Partitions:
```shell
python3 DataDetective.py -i image.ewf --show-partitions
```
📁 List Partition Files:
```shell
python3 DataDetective.py -i image.ewf --show-files
python3 DataDetective.py -i image.ewf --show-files -r # Recursive listing
```
🗂️ Show a Specific Directory:
```shell
python3 DataDetective.py -i image.ewf --show-dir /path/to/directory
```
🔎 Extract Data:
```shell
python3 DataDetective.py -i image.ewf -e ALL -o /path/for/output
```
## 📚 License
This project is licensed under the GNU Affero General Public License, Version 3.0. For more details, please refer to the LICENSE file in the repository: [Read the license on GitHub](https://github.com/franckferman/DataDetective/blob/stable/LICENSE)
## 📞 Contact
[![ProtonMail][protonmail-shield]](mailto:contact@franckferman.fr)
[![LinkedIn][linkedin-shield]](https://www.linkedin.com/in/franckferman)
[![Twitter][twitter-shield]](https://www.twitter.com/franckferman)
[contributors-shield]: https://img.shields.io/github/contributors/franckferman/DataDetective.svg?style=for-the-badge
[contributors-url]: https://github.com/franckferman/DataDetective/graphs/contributors
[stars-shield]: https://img.shields.io/github/stars/franckferman/DataDetective.svg?style=for-the-badge
[stars-url]: https://github.com/franckferman/DataDetective/stargazers
[license-shield]: https://img.shields.io/github/license/franckferman/DataDetective.svg?style=for-the-badge
[license-url]: https://github.com/franckferman/DataDetective/blob/stable/LICENSE
[protonmail-shield]: https://img.shields.io/badge/ProtonMail-8B89CC?style=for-the-badge&logo=protonmail&logoColor=blueviolet
[linkedin-shield]: https://img.shields.io/badge/-LinkedIn-black.svg?style=for-the-badge&logo=linkedin&colorB=blue
[twitter-shield]: https://img.shields.io/badge/-Twitter-black.svg?style=for-the-badge&logo=twitter&colorB=blue