Supported File Types
What are the file types supported by Proof Finder?
One of Proof Finder's strengths is its ability to index a large variety of file types quickly. See Supported File Types for a full list of currently supported file types.
What formats does Proof Finder support?
Proof Finder supports most email and file formats in everyday use:
- Email formats: PST, OST, DBX, MSG, NSF, EML, EMLX, MBOX, Webmail and more
- Email Databases: Exchange, Lotus Notes Domino, Microsoft Outlook
- Microsoft Office 95 and newer
- Most document formats in common use, and many others
Note: Proof Finder can find and identify encrypted documents and often extract metadata, but is not able to decrypt encrypted files.
Can Proof Finder directly ingest forensic images?
Proof Finder can directly ingest some forensic images should you be presented with this type of data.
Directly ingesting forensic images allows Proof Finder to process the source data without interference from the operating system or the file system security.
- EnCase: E01, E02, E03, etc... - Both single E01 files and segmented.
- EnCase: L01, L02, L03, etc... - EnCase Logical Volumes.
- DD Images: DD- Single file dd images. dd.01, dd.02, dd.03, etc...
- Access Data: AD1 logical images
Note: Nuix strongly recommends processing logical images over physical images.
How do I add segmented EnCase images?
Create a directory that contains all of the segments associated with a given image and ensure they are under approximately 8 GB to allow for compression.
What file systems are supported by Proof Finder?
Only images of the following file systems will be processed by Proof Finder.
- Windows: FAT32, NTFS
- Linux: EXT2, EXT3, EXT4
- Mac OS X: HFS+, HFSX
- For unsupported file system types using logical images will ensure Nuix can still process the data
Create a piece of Proof Finder evidence at the parent directory level. This ensures that all of the files are associated with the single image.