fox-it/dissect

Health v2 · maintenance only

Adoption not part of the score

1148 stars · 85 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Dissect is a modular digital forensics and incident response (DFIR) framework and toolset by Fox-IT that parses forensic artefacts from many disk image, container, filesystem, and OS formats. It provides tools like target-query and target-shell for uniform access to artefacts, plus Acquire for lightweight endpoint acquisition.

Use cases

• parse Windows Event Logs from an E01 disk image
• extract MFT entries from a VMDK or QCoW without mounting
• collect forensic artefacts from endpoints with Acquire
• analyse Runkeys and Prefetch files from a Linux or Windows image
• build custom DFIR tooling from modular parser libraries
• triage running VMs on a hypervisor

When to choose

• you need a single unified tool to parse artefacts across disk formats, filesystems, and operating systems
• you want scriptable, modular Python libraries for forensic parsing
• you need to acquire lightweight forensic images from live endpoints or hypervisors

When to avoid

• you need a GUI-based forensic suite with visual timeline analysis
• you require a license more permissive than AGPL-3.0 for commercial embedding
• you only need one-off parsing of a single well-supported file format with a simpler tool

Facets

framework · maturity active

parser file-system cli security security developer-tools python cli windows cross-platform dfir incident-response digital-forensics disk-images artifact-parsing target-query target-shell acquire forensics command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="fox-it/dissect")