acquire

What it is and what it does

Acquire is a forensic triage tool that rapidly collects artifacts from disk images or running systems into a portable container format. It leverages the dissect framework to parse raw disk structures when possible, making it useful for digital forensic investigations and incident response workflows. The tool operates through configurable profiles (full, default, minimal, none) and module-based artifact gathering, with OS-specific logic to collect relevant evidence. It requires administrative access to read raw disk data but offers fallback modes to use the operating system for file access when direct disk reading is unavailable.

The package is maintained as part of the broader Dissect project by Fox-IT/NCC Group, with active development and a production-stable classification. It depends on dissect.cstruct and dissect.target for its core functionality, and is distributed as a pure Python wheel with low installation friction.

Use it for:

• Quickly triage a compromised system by collecting forensic artifacts into a portable container for offline analysis.
• Automate forensic evidence gathering from disk images during incident response workflows.
• Extract OS-specific artifacts from live systems using profile-based collection (full, default, minimal).
• Gather raw disk data when direct access is available, with automatic fallback to OS-level file access.
• Build forensic investigation pipelines that integrate artifact collection via the dissect framework.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Acquire gathers forensic artifacts from disk images or live systems into a lightweight container, using the dissect framework to extract data from raw disk when possible.

Yes, if you need forensic artifact collection from disk images or live systems. The tool is actively maintained, has low install friction, and fills a specific role in digital forensics and incident response. The AGPL-3.0-or-later license requires copyleft compliance, which is appropriate for open-source forensic work but should be reviewed if you plan proprietary modifications. Requires Python >=3.10 and administrative access.

Install

acquire on PyPI

pip install acquire

uv add acquire

poetry add acquire

Installing acquire

Before you install

Low install friction with a pure Python wheel. Active maintenance as of 2026-08-12 with a recent release on 2026-02-25. Requires Python >=3.10 and administrative access to read raw disk data, though fallback options exist.

License in practice

Licensed under AGPL-3.0-or-later, which requires that any modifications or derivative works be distributed under the same license and made available to users. This is a strong copyleft obligation suitable for open-source projects but may constrain commercial or proprietary use.

Quickstart

pip install acquire

from acquire import ...

sudo acquire

Requires Python >=3.10 and administrative (root/sudo) access to read raw disk data; fallback modes available via --fallback or --force-fallback flags.

Verify before relying

• Exact API surface and programmatic usage patterns beyond the CLI tool
• Performance characteristics on large disk images or systems
• Supported operating systems and artifact types beyond OS detection

Package facts

Evidence: acquire-3.22-py3-none-any.whl

Tags

More Utilities packages