dissect-evidence

library3.13pypypi✓ verified 89d ago

A Dissect module implementing parsers for various forensic evidence file containers, currently: AD1, ASDF and EWF. Version 3.13, actively maintained. Part of the Dissect project (by Fox-IT).

security

pip install dissect-evidence

INSTALL

IMPORT

SIG · DISSECT-EVIDENCE

dissect-evidence

securitypythonv3.13

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

AD1

✓ from dissect.evidence.ad1 import AD1

✗ from dissect.evidence import AD1

Module not exposed at package level; wrong import leads to ImportError

Asdf

✓ from dissect.evidence.asdf import Asdf

✗ from dissect.evidence import Asdf

Module not exposed at package level

EWF

✓ from dissect.evidence.ewf import EWF

✗ from dissect.evidence import EWF

Module not exposed at package level

Open and read an EWF evidence file.

from dissect.evidence.ewf import EWF # Open an EWF file (Ex01, E01, etc.) with open('image.E01', 'rb') as f: ewf = EWF(f) print('Number of segments:', len(ewf.segments)) # Iterate over read/write iterator for chunk in ewf.read_iter(512): pass

Debug

Known issues

breakingAll classes (AD1, Asdf, EWF) are in separate submodules; do not import from top-level package.

fix

Import from the specific submodule, e.g., from dissect.evidence.ewf import EWF.

affects: >=3.0

gotchaEWF constructor expects a file-like object opened in binary mode ('rb'), not a file path. Passing a string path will raise a TypeError.

fix

Open the file with open(path, 'rb') first and pass the file object.

affects: all

deprecatedThe AD1 parser may have limited support due to changes in forensic tooling. Check documentation for known limitations.

fix

Verify AD1 files are supported; consider using FTK Imager or alternative tools for AD1.

affects: >=3.10

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'dissect.evidence'

Package not installed or installed under different name (e.g., dissect-evidence).

fix

Install with: pip install dissect-evidence

AttributeError: module 'dissect.evidence' has no attribute 'EWF'

Importing from the top-level package instead of the submodule.

fix

Use: from dissect.evidence.ewf import EWF

TypeError: argument 1 must be readable binary file, not str

Passing a file path string instead of a binary file object.

fix

Open with: with open('path.E01', 'rb') as f: ewf = EWF(f)

Upgrade

Version history

3.13latest on PyPI · released Feb 24, 2026

Audit

Dependencies

dissect.cstructrequiredUsed for parsing binary structures

dissect.utilrequiredUtility functions and types

dissect.volumeoptionalVolume/file system handling (indirect via other dissect modules)

Agent activity

28 hits · last 30 days

node

OpenAI (training)

Resources

No resource links recorded.