Unfurl takes a URL and expands ("unfurls") it into a directed graph, extracting every bit of information from the URL and exposing the obscured. It does this by breaking up a URL into components, extracting as much information as it can from each piece, and presenting it all visually. This “show your work” approach (along with embedded references and documentation) makes the analysis transparent to the user and helps them learn about (and discover) semantic and syntactical URL structures.
Unfurl has parsers for URLs, search engines, chat applications, social media sites, and more. It also has more generic parsers (timestamps, UUIDs, etc) helpful for exploring new URLs or reverse engineering. It’s also easy to build new parsers, since Unfurl is open source (Python 3) and has an extensible plugin system.
No matter if you extracted a URL from a memory image, carved it from slack space, or pulled it from a browser’s history file, Unfurl can help you get the most out of it.
pip install dfir-unfurl
After Unfurl is installed, you can run use it via the web app or command-line:
python unfurl_cli.py https://twitter.com/_RyanBenson/status/1205161015177961473
 https://twitter.com/_RyanBenson/status/1205161015177961473 ├─(u)─ Scheme: https ├─(u)─ twitter.com | ├─(u)─ Domain Name: twitter.com | └─(u)─ TLD: com └─(u)─ /_RyanBenson/status/1205161015177961473 ├─(u)─ 1: _RyanBenson ├─(u)─ 2: status └─(u)─ 3: 1205161015177961473 ├─(❄)─ Timestamp: 1576167751484 | └─(🕓)─ 2019-12-12 16:22:31.484 ├─(❄)─ Machine ID: 334 └─(❄)─ Sequence: 1
If the URL has special characters (like "&") that your shell might interpret as a command, put the URL in quotes.
python unfurl_cli.py "https://www.google.com/search?&ei=yTLGXeyKN_2y0PEP2smVuAg&q=dfir.blog&oq=dfir.blog&ved=0ahUKEwisk-WjmNzlAhV9GTQIHdpkBYcQ4dUDCAg"
unfurl_cli has a number of command line options to modify its behavior:
optional arguments: -h, --help show this help message and exit -d, --detailed show more detailed explanations. -f FILTER, --filter FILTER only output lines that match this filter. -o OUTPUT, --output OUTPUT file to save output (as CSV) to. if omitted, output is sent to stdout (typically this means displayed in the console). -v, -V, --version show program's version number and exit
git clone https://github.com/obsidianforensics/unfurl
docker-compose up -d
python -m unittest discover -s unfurl/tests
If using Docker as above, run:
docker exec unfurl python -m unittest discover -s unfurl/tests
This is not an officially supported Google product.