|
|
Proof Finder Supported File Types
Latest version: Proof Finder 4.2.
One of Proof Finder's strengths is its ability to index a large variety of file types quickly. Click here for a full list of currently supported file types.
Supported Formats
Most email and file formats in everyday use:
- Email formats: PSTs, OSTs, DBXs, NSF, EML, EMLX, MBOX, Webmail and more
- Email Databases: Exchange, Lotus Notes Domino
- Microsoft Office 95 and above
- Most document formats in common use, and many that are not in common use
Note: Proof Finder can find and identify encrypted documents and often extract metadata but is not able to decrypt encrypted files.
Forensic images
Proof Finder can directly ingest some forensic images should you be presented with this type of data. Directly ingesting forensic images allows Proof Finder to process the source data without interference from the operating system or the file system security.
- EnCase: E01, E02, E03, etc... - Both single E01 files and segmented.
- EnCase: L01, L02, L03, etc... - EnCase Logical Volumes.
- DD Images: DD- Single file dd images. dd.01, dd.02, dd.03, etc...
- Access Data: AD1 logical images
Note: Nuix strongly recommends processing logical images over physical images.
Adding segmented EnCase images:
Create a directory that contains all of the segments associated with a given image and ensure they are under approximately 8 GB to allow for compression.
Supported File Systems:
Only images of the following file systems will be processed by Proof Finder.
- Windows: FAT32, NTFS
- Linux: EXT2, EXT3, EXT4
- Mac OS: HFS+, HFSX
- For unsupported file system types using logical images will ensure Nuix can still process the data
Create a piece of Proof Finder evidence at the parent directory level. This will ensure that all of the files are associated with the single image.
|
