Extract Embedded Files from Multiple OneNote Files with onedump.py

Summary

A new onedump.py option outputs embedded files from multiple OneNote files as JSON. Piping the output to myjson-filter.py writes the files to disk using each file's SHA-256 hash as its name.

Key points

• The onedump.py --jsonoutput option outputs JSON containing the embedded files found in OneNote documents.
• Run onedump.py --jsonoutput *.one to process multiple OneNote files in one command.
• Pipe the JSON output to myjson-filter.py -W hashvir to write embedded files to disk, named by their content's SHA-256 hash with the .vir extension.

Products

Tools

Related Articles

• Microsoft October 2026 Updates Fix 1,411 Flaws, Including Three Zero-Daysbleepingcomputer.comMicrosoft Office OneNote
• Debug-Mode Flaw in Six Microsoft Android Apps Could Expose Account Tokenssecurityweek.comMicrosoft Office OneNote
• CodeStorm AiTM Kit Targets Microsoft 365, Steals MFA and Session Tokenshexastrike.comMicrosoft Office OneNote
• Asset Inventory and IT Hygiene Help Reduce an Organization’s Attack Surfacehuntress.comMicrosoft Office OneNote
• Emotet Resumes Spam Campaign, Shifts from Word Documents to OneNoteblog.talosintelligence.comMicrosoft Office OneNote