diff --git a/pkgs/development/python-modules/dissect-evidence/default.nix b/pkgs/development/python-modules/dissect-evidence/default.nix
new file mode 100644
index 000000000000..4548ecd6d902
--- /dev/null
+++ b/pkgs/development/python-modules/dissect-evidence/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, dissect-cstruct
+, dissect-util
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "dissect-evidence";
+  version = "3.1";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "fox-it";
+    repo = "dissect.evidence";
+    rev = version;
+    hash = "sha256-X0WMv96Wo3vDZ6HYGdWfn7OKhFuT5Qjzkyj4HzMqCiM=";
+  };
+
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  nativeBuildInputs = [
+    setuptools
+    setuptools-scm
+  ];
+
+  propagatedBuildInputs = [
+    dissect-cstruct
+    dissect-util
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "dissect.evidence"
+  ];
+
+  meta = with lib; {
+    description = "Dissect module implementing a parsers for various forensic evidence file containers";
+    homepage = "https://github.com/fox-it/dissect.evidence";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0c61c01b253c..2c98dbd3dcd9 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2485,6 +2485,8 @@ in {
 
   dissect-etl = callPackage ../development/python-modules/dissect-etl { };
 
+  dissect-evidence = callPackage ../development/python-modules/dissect-evidence { };
+
   dissect-util = callPackage ../development/python-modules/dissect-util { };
 
   dissect-volume = callPackage ../development/python-modules/dissect-volume { };