Installing bulk_extractor 2.2

For production work, use a tested release from the GitHub releases page. The commands below build either a release archive or a Git checkout from source.

Supported build environments

Current CI covers Ubuntu 22.04 and macOS. A C++17 compiler, GNU Make, Python 3, Autotools (autoconf, automake, and libtool), GNU Flex, pkg-config, and the libraries detected by configure are required. The exact dependency set is platform and configuration dependent; the error from ./configure is authoritative for a missing header, library, or tool.

The Ubuntu CI configuration uses the following packages and deliberately disables E01 support:

sudo apt-get update
sudo apt-get install --yes \
  autoconf automake build-essential flex git libabsl-dev libexpat1-dev \
  libgcrypt20-dev libgpg-error-dev libre2-dev libssl-dev libtool make \
  pkg-config procps python3 zlib1g-dev

E01 input requires a compatible libewf development installation. Leave E01 enabled (the default) after installing it; use --disable-libewf only when building without E01 support. Verify the resulting capability with the configured build's bulk_extractor -h and bulk_extractor -H output.

The etc/ directory retains older platform-preparation scripts as reference material. They are not a substitute for the supported CI configurations and may need maintenance on a newer operating system.

Build a release archive

Release archives contain the generated configure script:

./configure
make
make check
sudo make install

Use ./configure --prefix=/path to choose the installation location. Do not use elevated privileges unless that prefix requires them.

Build a Git checkout

Generate the Autotools files before configuring a checkout:

git clone https://github.com/simsong/bulk_extractor.git
cd bulk_extractor
./bootstrap.sh
./configure
make
make check
sudo make install

bootstrap.sh is for Git checkouts only. make clean removes build products; make distclean additionally removes files generated by configure.

Windows

Native Windows builds are not supported. The maintained Windows path is the MinGW cross-build and Windows execution test in mingw.yml. It produces an unsigned CI artifact with E01 support, not a release installer. See the Windows build notes for its operational limits, including raw-device input.

Troubleshooting and support

Use the bug-reporting guide for a reproducible failure and GitHub Discussions for support or early design questions. Do not upload forensic images, extracted evidence, credentials, or personal data to a public report.