extract-strings
Extract readable strings from forensic evidence files to uncover embedded text, URLs, and potential threat indicators like IPs and suspicious keywords.
Instructions
Extract readable strings from a forensic evidence file using the real GNU strings -n 6 command. Scans the actual command output for suspicious patterns including IPv4 addresses, URLs, domains, and suspicious keywords (cmd.exe, powershell, base64, Invoke-Expression, certutil, rundll32, etc.). A keyword hit is an indicator, not proof of malware. Results are bounded to prevent oversized responses. Use this tool to find embedded text, URLs, and potential indicators in binary files.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| filePath | Yes | Absolute or relative path to the evidence file within the evidence root (e.g. /evidence/suspect_photo.jpg) |