unblob

unblob is a Python 3 library and tool designed for forensic analysis of binary data. It excels at identifying and extracting embedded files from unknown binary blobs, supporting more than 30 different archive, compression, and filesystem formats. The tool recursively processes nested containers and carves out unaccounted data chunks, making it invaluable for digital forensics investigations.

Use cases include malware analysis, disk image examination, memory forensics, and recovering files from corrupted or obfuscated binaries. Investigators can use unblob to automatically unpack complex nested archives and filesystems without manual intervention, saving significant time in evidence extraction.

The tool requires additional extractor commands like 7z, debugfs, jefferson, and others to handle specific file types. It provides detailed output about discovered file structures and supports controlled recursion depth for precise analysis.

unblob parses binary blobs using format-specific parsers for over 30 archive, compression, and filesystem types. It recursively extracts contents up to a configurable depth, leveraging external extractor tools (7z, debugfs, ubireader, etc.) for supported formats. The tool calculates entropy for randomness detection and carves unknown data chunks not matching known signatures. Python libraries like python3-lief, python3-cryptography, and python3-dissect.cstruct handle specialized parsing tasks.