dfir

PyPI version Python versions CI License: MIT

dfir is a small, dependency-free command-line toolkit for quick digital forensics and incident response triage.

It is intentionally focused on fast, local inspection of files and directories before you move into heavier forensic tooling.

Created and maintained by DyNooob.

Features

  • No runtime dependencies — pure standard library, runs anywhere Python 3.9+ runs.
  • Read-only by default — inspects evidence, never modifies it.
  • Human-readable and JSON output — easy ad-hoc use and automation.
  • Cross-platform — Windows, Linux, and macOS.

Install

From PyPI:

pip install dfir

From source:

python -m pip install .

Commands

Hash a file or directory

dfir hash suspicious.bin

dfir hash evidence/ --recursive

dfir hash evidence/ --recursive --json

Calculates MD5, SHA-1, SHA-256, and SHA-512 in one pass.

Inspect metadata

dfir info suspicious.bin

Shows size, timestamps, permissions, file type hints, and basic path information.

Calculate Shannon entropy

dfir entropy suspicious.bin

Useful as a quick signal for compressed, encrypted, packed, or otherwise high-entropy data.

Extract printable strings

dfir strings suspicious.bin

dfir strings suspicious.bin --min-length 8

Extracts ASCII and UTF-16LE printable strings.

Extract common IOCs

dfir ioc logfile.txt

dfir ioc suspicious.bin --json

Recognizes common indicators including URLs, email addresses, IPv4 addresses, domains, and MD5/SHA-1/SHA-256 hashes.

Quick triage

dfir triage suspicious.bin

dfir triage suspicious.bin --json

Runs metadata, hashing, entropy, and IOC extraction together and produces a compact report.

Design goals

  • No runtime dependencies.
  • Safe by default: reads evidence but does not modify it.
  • Cross-platform Python 3.9+ support.
  • Human-readable output plus JSON for automation.
  • Small enough to use during initial triage without a large toolchain.

Build and publish

This repository ships two GitHub Actions workflows:

  • ci.yml — runs the test suite on Python 3.9–3.13 for every push and pull request.
  • publish.yml — builds the package and publishes it to PyPI. It runs on tagged releases and reads the token from the repository secret PYPI_API_TOKEN.

To publish locally:

python -m pip install --upgrade build twine
python -m build
python -m twine check dist/*
python -m twine upload dist/*

After publishing:

pip install dfir
dfir --version

Development

Run the tests:

PYTHONPATH=src python -m unittest discover -s tests -v

Try the CLI directly from the repository:

PYTHONPATH=src python -m dfir --help

On PowerShell:

$env:PYTHONPATH = "src"
python -m dfir --help

License

Released under the MIT License by DyNooob.

Project links

Data verified by PyPI on Aug 11, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.0.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for DyNooob from gravatar.com DyNooob

Credits

Author/Maintainer: DyNooob

GitHub Statistics

Data verified by PyPI on Aug 11, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python >=3.9

Tags

dfir digital-forensics incident-response forensics triage ioc

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

dfir-0.1.0.tar.gz (9.9 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

dfir-0.1.0-py3-none-any.whl (8.3 kB view details)

Uploaded Python 3

File details

Details for the file dfir-0.1.0.tar.gz.

File metadata

  • Download URL: dfir-0.1.0.tar.gz
  • Upload date:
  • Size: 9.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for dfir-0.1.0.tar.gz
Algorithm Hash digest
SHA256 219df5ec9636dc2137b311916c7465d503e22c285312c8484f8c45636b05bc3f
MD5 9445e0ab5b647525e3f4640dfc69dc33
BLAKE2b-256 1f492cc38a52037962bb4b8d3779e07da7f25da19399d018629922bcf059d8ae

See more details on using hashes here.

Provenance

The following attestation bundles were made for dfir-0.1.0.tar.gz:

Publisher: publish.yml on DyNooob/DFIR

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file dfir-0.1.0-py3-none-any.whl.

File metadata

  • Download URL: dfir-0.1.0-py3-none-any.whl
  • Upload date:
  • Size: 8.3 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for dfir-0.1.0-py3-none-any.whl
Algorithm Hash digest
SHA256 fbf263ad096a37af160b6c7f780689930692cab2371ecf0a185b9eddf4ee369e
MD5 a495c0d27aa13c49c5dd4cbad1519a93
BLAKE2b-256 d3e144a4a05d6b5eeeec5af0a262645cfe55de945cb2f448f6299901575bb493

See more details on using hashes here.

Provenance

The following attestation bundles were made for dfir-0.1.0-py3-none-any.whl:

Publisher: publish.yml on DyNooob/DFIR

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

1.0.0

2 files

0.3.0

2 files

0.2.1

2 files

0.2.0

2 files

This release

0.1.0 This release

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page