Read the evidence source
Process folders, disk images, EWF/E01 sets and supported embedded containers without first converting the full evidence image to temporary RAW.
Forensic media acquisition
Extract the media.
Preserve the evidence trail.
MediaExtractor turns complex evidence sources into a clean, structured collection of images and videos—ready for review, reporting, triage or import into Media Insight.
Windows · Linux · macOS
GUI and CLI
SHA256 CSV manifest
From acquisition to analysis
Turn complex evidence into analysis-ready media.
MediaExtractor separates acquisition from visual review. It reads supported sources, recovers media, preserves traceability and prepares an orderly output tree for the next stage of the investigation.
Preserve useful structure
Keep relative paths where possible, reconstruct Project VIC paths and sanitize output names to avoid traversal and overwrite problems.
Create a traceable manifest
Record source and output paths, type, internal path, timestamps, file size and SHA256 for every extracted item.
Supported evidence sources
One extraction layer for many source types.
Use the same workflow across ordinary folders, forensic images, archives and application containers instead of handling each source with a separate manual process.
Folders & file systems
Recursive scans on Windows, Linux and macOS with extension and signature-based recognition of common image and video formats.
RecursiveMagic bytesGeneric names
Disk & virtual images
Process .img, .dd, .raw, .vhd, .vhdx, .vmdk, .vdi and .iso.
NTFSFAT / exFATExt / XFS / HFS+
EWF / EnCase evidence
Read .e01 and .ex01 through native libewf, including segmented evidence sets such as E01, E02 and E03.
Native libewfSegmented EWFNo full RAW conversion
Project VIC exports
Use Project VIC 2 JSON metadata to reconstruct original filesystem paths and preserve available timestamps in the output.
Project VIC 2Original pathsTimestamps
Archives & documents
Extract supported media from ZIP-like containers, RAR, 7z, TAR, CAB, Office, OpenDocument, APK, JAR and related formats.
ArchivesOfficeEmbedded media
PDF, email & SQLite
Recover images from PDFs, media payloads from EML, MSG and OFT files, and image or video BLOBs from SQLite databases opened read-only.
PDFEmailRead-only SQLite
Controlled forensic workflow
Clean output without losing context.
MediaExtractor is designed for the preparation stage: it converts mixed and nested evidence sources into an organized media tree while retaining the information needed to trace each result back to its origin.
1
Select the source
Choose a folder, forensic image, EWF set, Project VIC export or supported container.
2
Choose a clean destination
Extract direct and embedded media into a structured output root with sanitized paths and unique names.
3
Review the results
Use the generated manifest for validation, reporting, archive preparation or downstream analysis.
Acquisition principles
Built for triage and case preparation
No disk mountingSupported evidence is read directly.
Continue on warningsNon-fatal container errors do not stop the full run.
Path sanitizationOutput paths are normalized and protected.
Unique output namesExisting files are not silently overwritten.
Signature recoveryMedia can be recognized beyond its extension.
One shared engineGUI and CLI use the same extraction core.
Traceable by design
Know where every extracted file came from.
The output structure remains readable for investigators, while media_manifest.csv provides a machine-readable record for validation and downstream processing.
Output examplePreserved relative structure
Source:
D:\Evidence\Users\Mario\Pictures\photo.jpg
Output:
D:\ExtractedMedia\Users\Mario\Pictures\photo.jpg
Disk image output:
D:\ExtractedMedia\Volume_C.E01.disk\
volume_00\NTFS\Users\Mario\Pictures\photo.jpgCSV manifestCore traceability fields
original_source
output_path
type
internal_path
source_created_utc
source_modified_utc
output_size_bytes
sha256GUI and command line
Use it interactively or automate the workflow.
The desktop launcher is suitable for direct case work. The CLI supports repeatable commands, scripted runs and integration into an existing laboratory pipeline.
Same extraction engine in GUI and CLI
Configurable parallel processing for folder sources
Optional direct-media-only mode
Compact warning and error output when required
MediaExtractor <source> <output> [options]
MediaExtractor.exe "D:\Evidence" "D:\ExtractedMedia"
MediaExtractor.exe "D:\Evidence\Volume_C.E01" \
"D:\ExtractedMedia"
MediaExtractor.exe "D:\Evidence" "D:\ExtractedMedia" \
--max-parallel 12
MediaExtractor.exe "D:\Evidence" "D:\ExtractedMedia" \
--no-embedded
--max-parallel N
--no-embedded
--quiet-errors
--help
Cross-platform packages
Choose the build for your workstation.
Version 1.0.3 · Updated 16 May 2026
GUI + CLI included
Windows x64
Portable ZIP package for Windows forensic workstations.
Download ZIPLinux x64
TAR.GZ package for Linux laboratory and command-line workflows.
Download TAR.GZApple Silicon
ZIP package for Apple Silicon Macs.
Download ZIPIntel
ZIP package for Intel-based Macs.
Download ZIPmacOS first-launch note
If macOS reports that MediaExtractor is damaged, the application may still have the Gatekeeper quarantine attribute. Open Terminal and run the command for your Mac, replacing /path/to/ with the folder containing the extracted app.
xattr -dr com.apple.quarantine "/path/to/MediaExtractor-osx-arm64.app"xattr -dr com.apple.quarantine "/path/to/MediaExtractor-osx-x64.app"
A complete media workflow
Extract with MediaExtractor. Analyze with Media Insight.
Prepare a clean, traceable media collection first. Then use Media Insight for indexing, EXIF and GPS review, semantic search, face analysis, restricted-content flags, similarity search and structured organization.