Digital forensics EU-developed

Dissect

Opens forensic images and file collections for cross-platform artifact analysis through a modular Python framework and command-line investigation tools.

By Fox-IT · Netherlands

Open primary source Compare saved tools Report a correction

EU-developed

The record identifies an EU developer or development origin. The origin note explains the evidence; current ownership and hosting are recorded separately where established.

At a glance

Recorded facts

Response workflow: Digital forensics
Developer or maintainer: Fox-IT
Recorded country: Netherlands
Product model: Open source
Deployment: Desktop/CLI
Software license: AGPL-3.0
Upstream status: Active
Evidence class: EU-developed

What the sources establish

Origin note

Upstream identifies Dutch Fox-IT's Dissect Team as developer.

Reported capabilities

Image and filesystem parsing
target-query and target-shell
Modular artifact parsers

Scope and limits

Fox-IT is part of UK-based NCC Group; Dutch development does not imply EU ownership or hosting. Count the suite once, not its parser modules.

Inspect the research evidence 3 source observations

identity / origin / capabilities / deployment
README credits Fox-IT's Dissect Team and documents installation, artifact analysis and target-query/target-shell CLI.
Read source Checked 2026-10-10
license
Actual license text is GNU Affero General Public License version 3.
Read source Checked 2026-10-10
country / maintenance
Verified developer organization states Netherlands, NCC Group affiliation and a repository update on 9 October 2026.
Read source Checked 2026-10-10

This profile summarizes source material. It does not include hands-on security testing, procurement review, or an assessment of fit for your environment.

Capabilities & integrations

Tags record specific documented functions. They do not establish end-to-end interoperability; check the component, edition and version in the source.

YARA Capability

The yara plugin scans files inside a forensic target using local rule files. Files above the configured maximum size are skipped; rule checking and decompression are configurable.

Dissect YARA plugin

Support evidence checked 2026-10-11

Put the tool in context.

Plan targeted evidence collection, check acquisition gaps and produce a traceable timeline. Source-linked guidance for Acquire, Dissect and DFIR ORC.

A digital forensics triage and evidence workflow