Dissect Forensic Framework Guide: Scaling Artefact Parsing Across Many Images

When an incident touches fifty servers instead of one laptop, full disk imaging and manual artefact review stop scaling, and responders need a way to ask the same question of every disk, VM and triage package at once. Dissect is an open source digital forensics and incident response framework from Fox-IT, part of NCC Group, built for exactly that: it reads disk images, virtual machine files and file collections as "targets" and lets an analyst query artefacts from them with one command line or Python API. This guide explains what the framework contains, where it fits in a defender's investigation, how to install and run it safely in an evidence-handling workflow, and how it compares with other open source options. It is written for incident responders, forensic analysts and threat hunters, and covers authorised investigation use only. Facts reflect the Dissect project's GitHub repositories, PyPI listing and documentation as checked in October 2026.

Key takeaways

• Targets, not tools per format. Dissect's core module, dissect.target, gives one interface to data inside disk images and file collections, so the same query runs against a VMDK, an E01 or a triage collection.
• Records are the output. target-query returns structured records (from the flow.record library) that rdump can filter and convert to formats such as CSV and JSON for a SIEM or timeline tool.
• Collection and analysis are separate projects. acquire gathers artefacts from a live system or image into a lightweight container using profiles (full, default, minimal, none); dissect.target parses them.
• Licence matters for products, not investigations. Dissect and acquire are released under AGPL-3.0; internal investigation use is straightforward, but embedding it in a service you offer others needs a licence review.
• Treat the analysis host as evidence infrastructure. Run it on an isolated workstation, mount images read-only, hash inputs and outputs, and record every query so results can be reproduced.

What the tool does

The dissect package on PyPI is a meta package that installs the Dissect modules at compatible versions. At the time of checking the latest stable release was 3.22 (25 February 2026), requiring Python 3.10 or later, licensed AGPL-3.0-or-later. The pieces a responder meets most are below.

Underneath sit parsers for many formats, each its own module: file systems (dissect.ntfs, dissect.extfs, dissect.fat, dissect.xfs, dissect.btrfs, dissect.apfs, dissect.vmfs, dissect.squashfs and others), volume handling (dissect.volume), full volume encryption (dissect.fve), hypervisor disk formats (dissect.hypervisor), forensic containers (dissect.evidence), Windows registry hives (dissect.regf), event logs (dissect.eventlog), ETW traces (dissect.etl), Common Log File System (dissect.clfs), WMI repositories (dissect.cim) and structure parsing (dissect.cstruct). Optional YARA scanning is available through target-query -f yara after installing dissect.target[yara].

Defender use cases

• Scoping a widespread intrusion: run the same persistence query across every server image collected, then sort by first-seen time. The project's own example pipes target-query -f runkeys into rdump to list Registry Run Keys, which maps to ATT&CK T1547.001 Registry Run Keys / Startup Folder. Similar plugin functions cover command history such as PowerShell history (relevant to T1059.001 PowerShell).
• Virtual infrastructure: because it reads hypervisor disk files and VMFS directly, responders can examine VM disks copied from a datastore without booting them. This matters after ESXi ransomware, where the ESXi Ransomware Playbook calls for evidence from many guests.
• Triage first, image later: acquire collects key artefacts from live hosts in minutes; the analyst queries those containers and decides which systems deserve a full image. This mirrors the approach in the KAPE and Triage Collection Guide.
• Feeding timelines and hunts: records exported as JSON go into a SIEM, a notebook or a timeline tool; see the Forensic Timeline Analysis Guide.
• Credential and NHI exposure review: after a server compromise, responders need to know which service account secrets, SSH keys, API tokens and configuration files on disk were reachable. Querying files and registry across images gives a list of machine credentials to rotate, which links forensics to the Secrets Management Guide.
• Repeatable checks in exercises: scripted queries against known-good images become regression tests for detection engineering and purple team work.

Deployment and safe use

Dissect is a Python toolkit; safe use is mostly about the environment and evidence handling around it, in line with NIST SP 800-86 and the Evidence Handling and Chain of Custody Guide.

1. Build a dedicated analysis host. Use a forensic workstation or VM with no route to production and controlled internet access. Images may contain live malware; Dissect parses files rather than executing them, but other tools you mount the image for may not be so careful.
2. Install in an isolated Python environment. Create a virtual environment and install the meta package with pip install dissect (or pip install dissect.target, acquire and flow.record separately). Pin the version in a requirements file per case so results can be reproduced, and record it in the case notes.
3. Verify the supply chain. Install from PyPI or the fox-it GitHub organisation only; check package names carefully for look-alikes, and mirror approved versions in an internal package repository. See the Open Source Security Guide.
4. Work on copies, read-only. Hash every image before and after analysis. Query the working copy; keep the original sealed.
5. Log what you ran. Keep the exact command lines, plugin functions, Dissect version and output hashes. Save record output rather than terminal text.
6. Protect acquire output. Triage containers hold credentials, browser data and personal data. Encrypt them in transit and at rest, restrict access to the case team, and set retention. acquire needs administrative rights to read raw disk, so deploy it through your EDR or management tool with a change record, not ad hoc.
7. Review licence obligations. AGPL-3.0 has network-use terms; if you build a hosted service on Dissect for customers, involve legal before release.

Detection and hardening value

Dissect is a response tool, but its output improves prevention and detection when the findings are fed back.

• Persistence baselines: query autostart locations, services (T1543.003 Windows Service) and scheduled tasks (T1053.005 Scheduled Task) across golden images, then alert on differences in production.
• Detection gap analysis: for each artefact found on disk during an incident, ask whether your EDR or SIEM saw the matching event. Missing ones become detection engineering backlog items, for example rules written with the Sigma Rules Guide.
• Log integrity checks: parsing event logs offline from images shows whether logs were cleared or gaps exist, which supports NIST SP 800-53 AU-9 Protection of Audit Information reviews.
• Exposure of machine credentials: scan images for stored secrets and keys and track how many are found per incident.

Metrics to track. Hosts triaged per analyst hour; median time from collection to first finding; percentage of cases with pinned tool versions and saved command logs; number of detection gaps raised per incident; number of plaintext machine credentials found on disk per case, trending down.

Alternatives

Small versus large teams. A small team without Python skills will get more from a GUI suite plus a triage collector; Dissect pays off once analysts script, or once incidents regularly involve tens of hosts. Large teams often pair a live tool for collection with Dissect for offline, repeatable parsing. Network evidence still needs packet tools: see the Wireshark for Security Analysis Guide.

Common failure patterns

• Installing the latest version mid-case on an analyst laptop and getting different output from a colleague on an older version.
• Saving terminal text instead of record files, so results cannot be filtered or re-checked.
• Mounting an image on a connected workstation and letting an indexing or antivirus process touch the malware.
• Running acquire across the estate without change control, then storing containers full of credentials on a shared drive.
• Finding exposed service account secrets on disk and not rotating them because forensics and identity teams never talk.

Practitioner checklist

• Build an isolated analysis host and a pinned Dissect virtual environment, tested on a sample image.
• Mirror approved Dissect, acquire and flow.record versions internally.
• Define acquire profiles and the deployment route (EDR or management tool) before an incident.
• Hash every image and container on receipt and record it in the chain of custody.
• Save all output as records, with command lines and version in the case notes.
• Feed findings into detection engineering and credential rotation.
• Encrypt and set retention for triage containers.
• Have legal review AGPL obligations if Dissect is built into a customer-facing service.

Standards and references

• Fox-IT: Dissect meta package repository
• Fox-IT: dissect.target repository
• Fox-IT: acquire repository
• Fox-IT: flow.record repository
• Dissect: Documentation
• PyPI: dissect package
• NIST: SP 800-86, Guide to Integrating Forensic Techniques into Incident Response
• NIST: SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management

Related NHI Mgmt Group resources: Digital Forensics (DFIR) Guide · Wireshark for Security Analysis Guide · Plaso Guide · KAPE and Triage Collection Guide · REMnux and FLARE-VM Malware Analysis Toolkits Guide