Bulk Artifact Extractor
Extract common artifacts from a log slice, email dump, disk-image strings output, or any UTF-8 text. Reports exact value, kind, byte offset, and context — locally in your browser.
About this tool
Bulk Artifact Extractor scans pasted UTF-8 text for common forensic and incident-response artifacts and reports every hit with:
kind—email,url,ipv4,domain,phone,bitcoin, orcredit_cardvalue— the exact matched textoffset— the byte offset where the match starts in your inputcontext— a short surrounding snippet with whitespace flattened
It is useful for triaging log excerpts, email dumps, copied strings output, scraped pages, or text recovered from a disk image. The scan runs locally in your browser; nothing is uploaded.
Worked example
Input:
Contact [email protected], see https://data.example.org/path, server 203.0.113.7, call +1 415-555-0132, card 4111 1111 1111 1111.
Table output includes rows like:
Bulk artifact extractor · 5 artifacts · url 1 · email 1 · credit_card 1 · ipv4 1 · phone 1
| kind | value | offset | context |
| --- | --- | --- | --- |
| email | [email protected] | 8 | Contact [email protected], see https://data.example… |
Choose JSON when you want to pipe the findings into another script, or keep the default Markdown table for review and reports.
Options
- Kinds —
allor a comma-list such asemail,ipv4,url. Domain hits inside emails/URLs and IP hits inside URLs are suppressed before filtering so the output is not double-counted. - Output format —
tablefor Markdown orjsonfor an array of{kind,value,offset,context}objects. - Context characters — how many characters to include on each side of a hit, capped at 200.
- Maximum findings — cap results after filtering, in byte-offset order.
Limits
- The input is treated as UTF-8 text. For binary files, first run a strings-style extraction and paste the text here.
- Phone and domain extraction are heuristic; country-specific numbering plans and private/internal hostnames can need manual review.
- Credit-card numbers must pass the Luhn checksum, but that does not prove a card number is real or active.
- Bitcoin detection recognizes common legacy base58 and bech32-looking addresses; it does not query a blockchain.
FAQ
Does it scan binary files directly?
No. This tool accepts text in the browser form and chat/CLI schema. For a disk image or binary blob, first extract readable strings with your forensic tool of choice, then paste the UTF-8 text here. The reported offsets are byte offsets in the pasted text, not the original disk image.
Why are domains inside URLs or email addresses not listed separately?
The extractor resolves overlaps by specificity. https://example.com/path is reported as a URL, not as both a URL and example.com; [email protected] is reported as an email, not an email plus a domain. That keeps counts useful during triage.
Are credit-card matches validated?
They must pass the Luhn checksum and contain 13–19 digits, which filters out many random number strings. Luhn validation is only a formatting check: it does not prove the number is issued, active, or sensitive in a legal sense.
Can I limit the scan to only one or two artifact types?
Yes. Set Kinds to a comma-list such as email,ipv4 or url,domain. Use all or leave the field blank to report every supported kind.
Is the data uploaded?
No. The scan is pure WebAssembly running locally in the page. Your pasted text stays in your browser unless you copy or download the output yourself.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool bulk-artifact-extractor "Contact [email protected], see https://data.example.org/path, server 203.0.113.7, call +1 415-555-0132, card 4111 1111 1111 1111."New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/bulk-artifact-extractor/?text=Contact%20alice%40example.com%2C%20see%20https%3A%2F%2Fdata.example.org%2Fpath%2C%20server%20203.0.113.7%2C%20call%20%2B1%20415-555-0132%2C%20card%204111%201111%201111%201111.&kinds=all&output=table&context=24&limit=1000Machine-readable descriptor: tool.json — title + parameters JSON Schema for agents.