Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Download Supported File Types
Document related concepts
no text concepts found
Transcript
Nuix Proof Finder Reference Guide Supported File Types Version 6.2 Supported File Types Proof Finder provides various levels of support for file types used by a wide variety of applications: Supported - The file type is fully supported, including the extraction of all metadata and content. Recognized - The file type is recognized by its header, but is not fully supported. This file type designation is simply text stripped. Partially Supported - The file type is recognized and partially supported, meaning that some but not all data from the file is processed. Processing Forensic Images Proof Finder can directly consume some forensic images. Directly consuming forensic images allows Proof Finder to process the source data without interference from the operating system or the file system security. Supported Formats Encase: E01, E02, E03, etc... - Proof Finder supports direct processing of Encase images. Both single E01 files and segmented. L01, L02, L03, etc... - Proof Finder supports direct processing of Encase Logical Volumes. dd Images: dd - Proof Finder supports direct processing of single file dd images. dd.01, dd.02, dd.03, etc... Proof Finder can process Split DD files using the option Add Evidence > Add Split DD Files... when adding evidence. Note: All split files for the same image must reside in the same folder for processing. Supported File Systems Only images of the following file systems are processed by Proof Finder: Windows: FAT32, NTFS Linux: EXT2, EXT3 Mac: HFS+, HFSX Adding single file disk images as evidence: Single file, complete E01 or dd images can be added as single files. September 2015 Nuix Proof Finder Reference Guide PAGE 2 of 49 Adding segmented Encase images: 1. Create a directory that contains all of the segments associated with a given image. 2. Create a piece of Proof Finder evidence at the parent directory level. This ensures that all of the files are associated with the single image. Note: Proof Finder does not recover or extract data from the images deleted, swap, slack or free space. Supported File Types Description Query String Kind Extensions Support Level Scanned for in Data Carving 3D Photo application/vnd.3d-photo- Containers *.obv Supported Supported for Browser Thumbnail browser-thumbnail-cache Carving (Undocumented) Container 7-Zip Archive File application/x-7zcompressed Containers *.7z Supported Supported for Carving (Undocumented) ABC View Thumbnail application/vnd.abc-viewmanager-thumbnail-cache Containers *.abt Supported Container (Undocumented) AccessData application/vnd.accessdat FTK Image a-ftk-imager ACDSee application/vnd.acdsee- Thumbnail Container thumbnail-cache ACE Archive application/x-ace Containers *.ad1 Supported Containers *.fpt Supported Supported for Carving (Undocumented) Containers *.ace Recognized Supported for Carving (Undocumented) audio/amr Multimedia *.amr Recognized Multi-Rate Audio File Adaptive Supported for Carving (Undocumented) File Adaptive Supported for Carving Supported for Carving (Undocumented) audio/amr-wb Multimedia *.amr Recognized Multi-Rate Wide Band Supported for Carving (Undocumented) Audio File Address Book application/x-contact Contacts *.dat Supported Contact Adobe Flash (Stored in another type) video/x-flv Multimedia *.flv Video File Adobe Format Data File Not Applicable application/vnd.fdf Other Documents September 2015 Nuix Proof Finder Reference Guide *.fdf Recognized Supported for (All known versions) Carving (Undocumented) Recognized Supported for Carving (Undocumented) PAGE 3 of 49 Description Adobe Illustrator Query String application/vnd.adobeillustrator Kind Drawings Extensions *.ai Support Scanned for in Level Data Carving Recognized Supported for Carving Artwork (Undocumented) Adobe Lightroom application/vnd.adobephotoshop-lightroom- Cache cache Adobe Photoshop application/vnd.adobephotoshop-elements- Elements Thumbnail thumb-db Containers *.lrprev Supported Databases *.cache Supported Supported for Carving (Undocumented) Supported for Carving (Undocumented) Database Adobe Photoshop application/vnd.adobephotoshop Images *.psd Recognized Adobe application/x-shockwave- Multimedia *.swf Recognized Shockwave/F lash File flash ALZip Archive application/x-alzip- File compressed ALZip Native application/x-egg- Archive File compressed Amazon S3 server/amazon-s3- Account account Amazon S3 server/amazon-s3-bucket Image (Undocumented) server/amazon-s3-folder Supported for Carving (Undocumented) Containers *.alz Supported Supported for Carving (Undocumented) Containers *.egg Supported Supported for Carving (Undocumented) Containers Containers *.dat *.dat Bucket Amazon S3 Folder Supported for Carving Containers *.dat Supported Not Applicable (All) (Stored on a remote server) Supported Not Applicable (All) (Stored on a remote server) Supported (All) Not Applicable (Stored on a remote server) AMV Video File video/x-amv Multimedia *.amv Recognized AOL Art Image image/vnd.aol-art Images *.art Recognized AOL Personal Filing Cabinet application/vnd.aolpersonal-filing-cabinet Containers *.pfc Recognized Supported for Carving (Undocumented) Supported for Carving (Undocumented) File Supported for Carving (Undocumented) AOS application/vnd.aos- Database database Databases September 2015 Nuix Proof Finder Reference Guide *.db, *.mdr Partially Supported for Supported Carving (Undocumented) PAGE 4 of 49 Description AOS File List Query String application/vnd.aos-filelist Kind Containers Extensions *.dat Support Scanned for in Level Data Carving Partially Supported Not Supported for Carving (Text based) AOS SMS Message application/vnd.aos-smsmessage Other Documents *.dat Supported AOS SMS Message application/vnd.aos-smsmessage-thread Other Documents *.dat Supported audio/x-caf Multimedia *.caf Recognized Not Applicable (Stored in another type) Thread Apple CAFF Audio File Not Applicable (Stored in another type) Supported for Carving (Undocumented) Apple application/vnd.apple-ds- System Directory Services store Files application/x-applediskimage Containers *.dat Recognized Supported for Carving (Undocumented) Store File Apple Disk Image *.dmg, *.smi, Recognized *.img, *.dsk, *.nib Apple application/vnd.apple- System Interface Builder interface-builder-archive Files application/vnd.apple-iosaddress-book-database Databases *.nib Supported for Carving (Undocumented) Recognized Supported for Carving (Undocumented) Archive Apple iOS Address Book *.db Recognized Database Apple iOS Application Supported for Carving (Undocumented) application/vnd.apple-iosapp Containers *.ipa Supported Apple iOS application/vnd.apple-ios- Other *.dat Supported Message message Documents Apple iOS application/vnd.apple-ios- Other Message Conversation message-conversation Documents Apple iOS application/vnd.apple-ios- Databases Message Database message-database Apple iOS application/vnd.apple-ios- Safari Bookmarks bookmarks-database File Supported for Carving (Undocumented) Not Applicable (Stored in another type) *.dat Supported Not Applicable (Stored in another type) *.db Supported Supported for Carving (Undocumented) Databases *.db Recognized Supported for Carving (Undocumented) Database September 2015 Nuix Proof Finder Reference Guide PAGE 5 of 49 Description Apple iPhone Call Database Query String application/vnd.appleiphone-call-database Kind Databases Extensions *.db Support Scanned for in Level Data Carving Supported Supported for Carving (Undocumented) Apple iPhone Voice Mail application/vnd.appleiphone-voice-mail- Database database Apple iWork Archive File application/vnd.apple.iwor k-archive Databases *.db Recognized Supported for Carving Other Documents *.iwa Partially Supported Not Supported for Carving (iWork 13, text and (Signature is not unique enough) (Undocumented) some metadata extracted, but not all) Apple application/vnd.apple.key Presentatio Keynote Presentation note ns *.key File Partially Partially Supported (iWork 09 Supported for Carving (iWork and later, text 09 and later) extracted but not embedded images or files) Apple application/vnd.apple- Mail.app Email File emlx Apple application/vnd.apple.nu Spreadshe Numbers Spreadsheet mbers ets Containers *.emlx Supported Supported for Carving (Undocumented) *.numbers File Partially Partially Supported (iWork 09 Supported for Carving (iWork and later, text 09 and later) extracted but not embedded images or files) Apple Pages Document application/vnd.apple.pag es Documents File *.pages Partially Supported Partially Supported for (iWork 09 and later, Carving (iWork 09 and later) text extracted but not embedded September 2015 Nuix Proof Finder Reference Guide PAGE 6 of 49 Description Query String Kind Extensions Support Scanned for in Level Data Carving images or files) Apple video/quicktime Multimedia QuickTime Multimedia *.mov, Recognized *.moov Supported for Carving (Undocumented) File Apple Safari Cache application/vnd.applesafari-cache-entry Other Documents *.dat Supported Database Entry Not Applicable (Stored in another type) Apple Safari application/vnd.apple- Cache Database File safari-cache Apple Typed Stream application/vnd.appletypedstream Databases *.db Supported Supported for Carving (Undocumented) System Files *.dat Recognized Supported for Carving (Undocumented) Apple UDIF Disk Image application/vnd.apple-udif Containers *.dmg Recognized Not Supported for Carving (Signature is not at the start of the file) AppleDouble Header File application/x-applefileheader System Files *.dat Partially Supported Supported for Carving (Some metadata (Undocumented) extracted) AppleSingle File application/applefile Containers *.dat Supported (Some Supported for Carving metadata extracted, (Undocumented) embedded file extracted) Audio Interchange audio/aiff Multimedia *.aiff, *.aif, *.aifc Recognized image/vnd.autocad-dwf Drawings *.dwf Recognized File AutoCAD (Undocumented) DWF Drawing AutoCAD Supported for Carving (Undocumented) image/vnd.autocad-dwfx Drawings *.dwfx Recognized DWFx Drawing AutoCAD Supported for Carving Supported for Carving (Undocumented) image/vnd.autocad-dwg Drawings DWG Drawing September 2015 Nuix Proof Finder Reference Guide *.dwg Recognized Supported for Carving (Undocumented) PAGE 7 of 49 Description AutoCAD DXF Drawing Query String image/vnd.autocad-dxf Kind Drawings Extensions *.dxf Support Scanned for in Level Data Carving Recognized Supported for Carving (Undocumented) AutoCAD Shape image/vnd.autocad-shp Drawings *.shx Recognized AutoCAD Slide image/x-sld Drawings *.sld Recognized AutoCAD Slide Library application/vnd.autocadslb Databases *.slb Recognized Supported for Carving (Undocumented) Supported for Carving (Undocumented) File Autodesk FLI Supported for Carving (Undocumented) video/x-fli Multimedia *.fli, *.flc Recognized Video File Supported for Carving (Undocumented) Autodesk video/vnd.autodesk- Scaleform USM Video scaleform-usm Multimedia *.usm Recognized Supported for Carving (Undocumented) File Autonomy Load File application/vnd.autonomy -load-file Containers *.idx Supported Not Supported for Carving (Text based) AVI Multimedia video/avi Multimedia *.avi Recognized application/vnd.rimartsbecky-file Containers *.bmf Supported (All) Becky! Email application/vnd.rimarts- Email *.dat Recognized Message becky-email Becky! application/vnd.rimarts- Standard Email becky-mailbox File Becky! Email Container Supported for Carving (Undocumented) File Not Supported for Carving (Text based) Not Applicable (Stored in another type) Containers *.bks, *.bkl Supported Not Supported (All) for Carving (Text based) Recognized Supported for Container File Bitcoin application/x-bitcoin- Other Wallet File wallet Documents BitTorrent application/x-bittorrent System File Blackberry Email *.wallet Carving (Undocumented) *.torrent Recognized Files application/vnd.rimblackberry-email Email Supported for Carving (Undocumented) *.dat Supported Not Applicable (Stored in another type) September 2015 Nuix Proof Finder Reference Guide PAGE 8 of 49 Description Blackberry IPD Database Query String application/vnd.rimblackberry-ipd Kind Containers Extensions *.ipd Support Scanned for in Level Data Carving Partially Supported Supported for Carving (Database tables text- (Undocumented) stripped) Blackberry SMS application/vnd.rimblackberry-sms Email *.dat Supported Not Applicable (Stored in another type) Blender 3D Blend File application/vnd.blender.bl end Other Documents *.blend Recognized Block Device filesystem/block-device System Files *.dat Supported Supported for Carving (Undocumented) Not Supported for Carving (Signature is not unique enough) Bloomberg Daily Text application/vnd.bloomber g-text-dump Containers *.txt Dump Supported (Handles Not Supported for Carving (Text txt messages based) starting with =====Be gin Message= ====) Bloomberg application/vnd.bloomber Daily XML Dump g-xml-dump Containers *.xml Supported Not Supported (MSGXML Email for Carving (Text based) Messages are supported) Bloomberg IM Daily XML application/vnd.bloomber g-im-xml-dump Containers *.xml application/vnd.borlanddbase Databases *.dbf Dump Borland dBase Supported (Undocume Not Supported for Carving (Text nted.) based) Recognized Not Supported for Carving Database (Signature is not unique enough) Borland application/vnd.borland- Paradox Database paradox Browser application/x-browser- Other Bookmark bookmark Documents Databases *.db, *.px Recognized Not Supported for Carving (Signature is not unique enough) September 2015 Nuix Proof Finder Reference Guide *.dat Supported Not Applicable (Stored in another type) PAGE 9 of 49 Description Browser Cookie Query String application/x-browsercookie Kind Other Documents Extensions *.dat Support Scanned for in Level Data Carving Supported Not Applicable (Stored in another type) Browser History Entry application/x-browserhistory-entry Other Documents *.dat Supported Browser Search application/x-browsersearch Other Documents *.dat Supported bzipCompressed application/x-bzip Containers *.bz2, *.tbz, Supported Not Applicable (Stored in another type) Not Applicable (Stored in another type) File Call Record *.tbz2 application/x-call-record Other *.dat (Undocumented) Supported Documents CAXA CAD image/vnd.caxa-cad Drawings Supported for Carving Not Applicable (Stored in another type) *.exb Recognized Drawing Supported for Carving (Undocumented) Cellebrite application/vnd.cellebrite- XML Report xml-report Character filesystem/character- System Device device Files Chat Conversation application/x-chatconversation Other Documents *.dat Supported Chat Message application/x-chat- Other *.dat Supported message Documents Civilization 5 application/vnd.firaxis- Other Save Game File games-civ5-save Documents Classic application/vnd.tcpdump. Logs Packet Capture File pcap COFF Object application/coff Containers *.xml Supported Not Supported for Carving (Text based) *.dat Supported Not Supported for Carving (Signature is not unique enough) Not Applicable (Stored in another type) File Comma Separated text/csv (Stored in another type) *.civ5save Recognized *.pcap, System *.obj, *.o, Files *.exp, *.dll Spreadshe ets *.csv September 2015 Nuix Proof Finder Reference Guide Supported for Carving (Undocumented) Supported *.cap, *.dmp Values Not Applicable Supported for Carving (Undocumented) Recognized Supported for Carving (Undocumented) Supported (All) Not Supported for Carving (Text based) PAGE 10 of 49 Description Common Log Format File Query String text/x-common-log Kind Logs Extensions *.dat Support Scanned for in Level Data Carving Supported Not Supported for Carving (Text based) Common Log Format File text/x-common-log-entry Logs *.dat Supported application/x-cso-image Containers *.cso Recognized image/gif Images *.gif Supported Entry Compressed ISO9660 Disk based) Image Compuserve Graphic Supported for Carving (Undocumented) image/cgm Drawings *.cgm Supported Metafile Not Supported for Carving (Signature is not unique enough) Concordance application/vnd.concordan Load File ce-load-file Concordance application/vnd.concordan Load File Item ce-load-file-item Concordance application/vnd.concordan Opticon Load File ce-opticon-load-file Corel Draw image/vnd.corel-draw-6 Containers *.dat Supported Not Supported for Carving (Text based) Documents *.dat Supported Not Applicable (Stored in another type) Containers *.opt Supported Not Supported for Carving (Text based) Drawings *.cdr6 Recognized 6.0 Graphic Corel Draw Drawing Supported for Carving (Undocumented) Interchange Format Computer Graphics Not Supported for Carving (Text Supported for Carving (Undocumented) image/vnd.corel-draw Drawings *.cdr, *.cdt, *.drw Recognized (>= Corel Supported for Carving Draw 4 for RIFF (Undocumented) formats and .cdt/.drw) Corel PhotoPaint Image Corel Presentation image/vnd.corel-photopaint application/vnd.corelpresentations Images Presentatio ns *.cpt *.mst, *.cpr Recognized (>= Supported for Carving Version 7) (Undocumented) Recognized Supported for Carving (Undocumented) Corel WordPerfect image/vnd.corelwordperfect-graphics Images Graphics September 2015 Nuix Proof Finder Reference Guide *.wpg Recognized (>= 5.1) Supported for Carving (Undocumented) PAGE 11 of 49 Description Dalvik Class Query String application/dalvik-class Kind System Files Extensions *.dex, *.odex Support Scanned for in Level Data Carving Recognized Supported for Carving (Undocumented) Database application/x-database Databases *.dat Supported Database Table application/x-databasetable Databases *.dat Supported Database Table Row application/x-databasetable-row Databases *.dat Supported Not Applicable (Stored in a database) Not Applicable (Stored in another type) Not Applicable (Stored in another type) Database application/x-database- View view Direct Draw image/vnd.ms-dds Databases *.dat Supported (Stored in another type) Images *.dds Recognized Surface Image Directory Not Applicable Supported for Carving (Undocumented) filesystem/directory Containers *.dat Supported Not Supported for Carving (Signature is not unique enough) Disk Image application/x-disk-image Containers *.dat Supported (exFAT - Supported for Carving unallocated space (Undocumented) carving) Supported (ext2, ext3, ext4 unallocated space carving) Supported (FAT32, FAT16, FAT12 unallocated space carving and deleted file recovery) Supported (HFS+, September 2015 Nuix Proof Finder Reference Guide PAGE 12 of 49 Description Query String Kind Extensions Support Scanned for in Level Data Carving HFSX unallocated space carving) Supported (NTFS unallocated space carving and deleted file recovery) Supported (X-Ways Evidence File Container) Supported (APM partitions) Supported (GPT partitions) Supported (IBM partitions) Recognized (BFS) Recognized (btrfs) Recognized (cramfs) Recognized (GFS2) Recognized (HFS) Recognized (JFS) Recognized (ReFS) Recognized (ReiserFS) Recognized (SquashFS ) Recognized September 2015 Nuix Proof Finder Reference Guide PAGE 13 of 49 Description Query String Kind Extensions Support Scanned for in Level Data Carving (UDF) Recognized (XFS) Recognized (ZFS) DocBook Document application/docbook+xml Documents *.dbk, *.xml Recognized Not Supported for Carving (Text based) DOS Executable application/com System Files *.com Recognized Not Supported for Carving (Signature is not unique enough) Drive filesystem/drive Containers *.dat Supported Supported for Carving (Undocumented) Dropbox Account server/dropbox-account Containers *.dat Supported (All) Dropbox Folder server/dropbox-folder Containers *.dat Supported (All) Dropbox Team server/dropbox-teamaccount Containers *.dat Supported (All) Not Applicable (Stored on a remote server) Not Applicable (Stored on a remote server) Account EDRM XML Load File Not Applicable (Stored on a remote server) application/vnd.edrmxml-load-file Containers *.xml Supported Not Supported for Carving (Text based) EDRM XML Load File application/vnd.edrmxml-load-file-item Other Documents *.dat Supported image/vnd.j2global-efax Images *.efx, *.jsd Recognized Item Efax Image Not Applicable (Stored in another type) Not Supported for Carving (Signature is not unique enough) Empty File application/x-empty No Data *.dat Supported (Any Not Applicable (No data) Empty Files) EnCase EVF2 application/vnd.guidance- Disk Image encase-evf2 EnCase EWC application/vnd.guidance- Disk Image encase Containers Containers September 2015 Nuix Proof Finder Reference Guide *.ex01 *.e01 Partially Supported for Supported (<= 7) Carving (Undocumented) Partially Supported for Supported (<= 7) Carving (Undocumented) PAGE 14 of 49 Description EnCase LEF2 Logical Query String application/vnd.guidanceencase-lef2 Kind Containers Extensions *.lx01 Volume File EnCase Logical Scanned for in Level Data Carving Partially Supported Supported for Carving (<= 7) (Undocumented) Partially Supported Supported for Carving application/vnd.guidanceencase-lvf Containers *.l01 (<= 7) (Undocumented) application/xevnotestream Containers *.dat Supported Not Applicable (Undocumented) application/vnd.epicunreal-package Containers *.dat Recognized Supported for Carving Volume File Enterprise Vault Note Support Stream Epic MegaGames / Digital Extremes (Undocumented) Unreal Package File EPUB Document application/epub+zip Documents *.epub Recognized Evernote Database File application/vnd.evernotedatabase Containers *.exb Supported (Version 4) Evernote Note application/vnd.evernotenote Documents *.dat Supported (Version 4) Supported for Carving (Undocumented) Supported for Carving (Undocumented) Not Applicable (Stored in another type) Evernote Notebook application/vnd.evernotenotebook Containers *.dat Supported (Version 4) Not Applicable (Stored in another type) Evernote Thumbnail application/vnd.evernotethumbnail-container Containers *.thumbnail Supported Container File Exchange Web Services (Undocumented) server/exchange-ews Containers *.dat Account Exchange Web Services server/exchange-ewsappointment Calendar *.dat Appointment Exchange Web Services server/exchange-ewscontact Contacts *.dat server/exchange-ewsfolder Containers *.dat Contact Exchange Web Services Supported for Carving Folder September 2015 Nuix Proof Finder Reference Guide Supported (2007 - Not Applicable (Stored on a 2013) remote server) Supported (2007 - Not Applicable (Stored on a 2013) remote server) Supported (2007 - Not Applicable (Stored on a 2013) remote server) Supported (2007 - Not Applicable (Stored on a 2013) remote server) PAGE 15 of 49 Description Exchange Web Services Query String server/exchange-ewsitem Kind Other Documents Extensions *.dat Item Exchange Web Services Support Scanned for in Level Data Carving Supported (2007 - Not Applicable (Stored on a 2013) remote server) Supported (2007 - Not Applicable (Stored on a server/exchange-ewstask Other Documents *.dat 2013) remote server) Executable Script File application/x-executablescript System Files *.dat Supported Not Supported for Carving (Text ExifPro Thumbnail application/vnd.exifprothumbnail-cache Containers *.bin Supported Task based) Cache Extensible (Undocumented) application/xhtml+xml Documents *.html, Hypertext Markup *.htm, *.xhtml, Language Document *.xht Extensible Supported for Carving application/xml Markup Language Unrecogniz *.xml Recognized Not Supported for Carving (Text based) Recognized ed Not Supported for Carving (Text based) File Extensible Music Format audio/xmf Multimedia *.xmf, *.mxmf Recognized Audio File FictionBook eBook Supported for Carving (Undocumented) application/xfictionbook+xml Other Documents *.fb2 Recognized Not Supported for Carving (Text based) FIFO filesystem/fifo System Files *.dat Supported Not Supported for Carving (Signature is not unique enough) FileCenter Thumbnail application/vnd.filecenterthumbnail-cache Containers *.album Supported Cache FLAC Audio File Supported for Carving (Undocumented) audio/x-flac Multimedia *.flac Recognized Supported for Carving (Undocumented) FMOD Sample Bank audio/vnd.fmod-sample Multimedia *.fsb Recognized image/x-gem-draw Drawings *.gem Recognized Format GEM Draw Image Supported for Carving (Undocumented) Not Supported for Carving (Signature is not unique enough) September 2015 Nuix Proof Finder Reference Guide PAGE 16 of 49 Description GIMP XCF Image Query String image/xcf Kind Images Extensions *.xcf Support Scanned for in Level Data Carving Recognized Supported for Carving (Undocumented) Google Android ADB application/vnd.googleandroid-adb-backup Containers *.ab Partially Supported Google Android application/vnd.googleandroid-contact-call- Databases *.db Partially Supported Contact / Call Database database Google application/vnd.google- Android Package File android-package Google Android application/vnd.googleandroid-resource System Files *.dat Supported application/vnd.googleandroid-sms-database Databases *.db Supported Backup (Undocumented) Containers *.apk Supported application/vnd.googleandroid-sms-message Other Documents *.dat Supported application/vnd.googleandroid-sms-thread Other Documents *.dat Supported application/vnd.googlechrome-history Databases *.dat Supported Not Applicable (Stored in another type) Supported for Carving (Undocumented) application/vnd.googlechrome-history-entry Other Documents *.dat Supported History Entry Google Chrome Not Applicable (Stored in another type) History Database Google Chrome Supported for Carving (Undocumented) Thread Google Chrome Supported for Carving (Undocumented) Message Google Android SMS Supported for Carving (Undocumented) Database Google Android SMS Supported for Carving (Undocumented) Resource File Google Android SMS Supported for Carving Not Applicable (Stored in another type) application/vnd.googlechrome-history-index Databases *.dat Supported History Index Database Supported for Carving (Undocumented) Google application/vnd.google- Other Chrome History Index chrome-history-indexentry Documents application/vnd.googledrive-document Documents *.dat Supported Not Applicable (Stored in another type) Entry Google Drive Document *.dat Recognized Not Supported for Carving (Text based) September 2015 Nuix Proof Finder Reference Guide PAGE 17 of 49 Description Google Drive Drawing Query String application/vnd.googledrive-drawing Kind Drawings Extensions *.dat Support Scanned for in Level Data Carving Recognized Not Supported for Carving (Text based) Google Drive Presentation application/vnd.googledrive-presentation Presentatio ns *.dat Recognized Google Drive Snapshot application/vnd.googledrive-snapshot-database Databases *.dat Recognized Google Drive Snapshot application/vnd.googledrive-snapshot-database- Other Documents *.dat Recognized Database Entry entry Google Drive Spreadsheet application/vnd.googledrive-spreadsheet Spreadshe ets *.dat Recognized Google Earth KML Feature application/vnd.googleearth.kml-feature Other Documents *.dat Recognized Not Supported for Carving (Text based) Database Supported for Carving (Undocumented) Supported for Carving (Undocumented) Not Supported for Carving (Text based) Not Applicable (Stored in another type) Google Earth KML File application/vnd.googleearth.kml+xml Other Documents *.dat Recognized Not Supported for Carving (Text based) Google Earth KML application/vnd.googleearth.kml-placemark Other Documents *.dat Recognized GPX Document application/gpx+xml Other Documents *.dat Recognized GPX Point application/gpx+xml.point Other *.dat Recognized Placemark Not Applicable (Stored in another type) Not Supported for Carving (Text based) Documents Graphic image/x-graphic- Database System II database-system-ii Drawings (Stored in another type) *.gdsii Recognized Not Supported (All) for Carving (Signature is not Layout File gzipCompressed unique enough) application/x-gzip Containers File Haansoft Not Applicable *.gz, *.tgz, *.cpgz, Supported *.wmz, *.emz application/x-hwp Documents Hangul Word Processing Supported for Carving (Undocumented) *.hwp, Partially Supported for *.hwt Supported (>= 3.0) Carving (Undocumented) File September 2015 Nuix Proof Finder Reference Guide PAGE 18 of 49 Description HP TRIM Email Query String application/vnd.hp-trimemail Kind Email Extensions *.vmbx, *.mbx Support Scanned for in Level Data Carving Recognized Not Supported for Carving (Text based) HumanConce pts OrgPlus application/vnd.humanco ncepts-orgplus Drawings *.opx, *.opw Recognized text/html Documents *.html, *.htm Partially Supported Not Supported for Carving (Text (Linked content, based) Document Hypertext Markup Supported for Carving (Undocumented) Language Document embedded data not extracted) iCalendar Entry text/calendar-entry Calendar *.dat Supported iCalendar File text/calendar Containers *.ics Supported Not Supported for Carving (Text based) Not Supported for Carving (Text based) Ichitaro application/x-js-taro Documents *.jtd, *.jtt, Recognized Supported for Word Processing *.jtdc, *.jfw, (>= 4 AND <= 2008) Carving (Undocumented) File *.jvw, *.jbw, Supported Not Applicable (Stored on a *.juw, *.jaw, *.jtw, *.jsw IMAP Mail Account server/imap Containers *.dat remote server) IMAP Mail Folder server/imap-folder Containers *.dat Supported Inaccessible Content filesystem/inaccessible No Data *.dat Supported Not Applicable (No data) INF Configuration text/x-inf System Files *.inf Recognized Not Applicable (No support) audio/vnd.infinity-enginemusic Multimedia *.acm Recognized Supported for Carving Not Applicable (Stored on a remote server) File Infinity Engine Music File Informed Form Data (Undocumented) application/vnd.shana.info rmed.formdata Other Documents Document September 2015 Nuix Proof Finder Reference Guide *.ifm Recognized Supported for Carving (Undocumented) PAGE 19 of 49 Description Informed Form Query String application/vnd.shana.info rmed.formtemplate Kind Other Documents Extensions *.itp Support Scanned for in Level Data Carving Recognized Supported for Carving Template Document Ini Style (Undocumented) text/x-ini Configuration File Other *.ini, Documents *.config, *.conf, Recognized Not Applicable (No support) *.properties , *.url Installed application/x-application Application ISO9660 CD- Other *.dat Supported Documents application/x-iso-image Containers Not Applicable (Stored in another type) *.iso Supported ROM Disk Image Not Supported for Carving (Signature is not at the start of the file) Java Archive application/java-archive Containers *.jar, *.war, *.ear, *.sar Supported (All) Supported for Carving (Undocumented) Java Class application/java-class System Files *.class Java Keystore File application/x-javakeystore Other Documents *.jks, *.keystore Java Serialised application/x-javaserialized-object System Files *.dat Recognized Supported (String Supported for Carving extraction) (Undocumented) Recognized (1, 2) Supported for Carving (Undocumented) Object Data JPEG 2000 Image Supported for Carving (Undocumented) image/jp2 Images *.jp2, *.jpg2 Supported Supported for Carving (Undocumented) JPEG/JFIF image/jpeg Images Image JSON Data *.jpeg, Supported *.jpg, *.jpe application/json File Other *.json Carving (Undocumented) Recognized Documents Kingsoft application/vnd.haansoft- Presentatio Presentation Document presentation ns Koomail Mail application/vnd.koomail- Containers File sml September 2015 Nuix Proof Finder Reference Guide Supported for Not Supported for Carving (Text based) *.hpt, *.rbk Recognized Supported for Carving (Undocumented) *.sml Supported Not Supported for Carving (Text based) PAGE 20 of 49 Description LLVM Byte Code Query String application/x-llvm-bytecode Kind System Files Extensions *.bc Support Scanned for in Level Data Carving Recognized Supported for Carving (Undocumented) Location Record application/x-location Other Documents *.dat Supported Log File Entry text/x-log-entry Logs *.dat Supported Logstash Log File application/vnd.logstashlog Logs *.dat Supported (>= 1.4) Not Applicable (Stored in another type) Not Supported for Carving (Text based) Not Supported for Carving (Text based) Logstash Log application/vnd.logstash- File Entry log-entry Lotus 1-2-3 application/vnd.lotus-123 Spreadsheet File Lotus Domino XML application/vnd.lotusdomino-xml-appointment- Appointment document Lotus Domino XML Mail application/vnd.lotusdomino-xml-mail- Logs *.dat Supported Not Supported (>= 1.4) for Carving (Text based) Spreadshe *.wk1, Partially Supported for ets *.wk4, *.wks, Supported (Text Carving (Undocumented) *.123 stripped) *.xml Supported (>= 1 AND Not Supported for Carving (Text <=9) based) Supported (>= 1 AND Not Supported for Carving (Text <=9) based) Supported (>= 1 AND Not Supported for Carving (Text <=9) based) Supported Not Supported (>= 1 AND <=9) for Carving (Text based) Supported Not Supported (>= 1 AND <=9) for Carving (Text based) Recognized Supported for Calendar Email *.xml Other Documents *.xml Contacts *.xml document Lotus Domino XML Other application/vnd.lotusdomino-xml-other- Document document Lotus Domino application/vnd.lotus- XML Person Document domino-xml-persondocument Lotus Domino application/vnd.lotus- Other XML Task Document domino-xml-taskdocument Documents Lotus image/vnd.lotus-freelance Images *.xml *.drw Freelance Graphics Carving (Undocumented) Lotus application/vnd.lotus- Presentatio Freelance Presentation freelance ns Lotus Notes Bitmap image/vnd.lotus-notesbitmap Images Image *.prz, *.pre Recognized Supported for Carving (Undocumented) *.dat Partially Supported Not Applicable (Stored in (8-bit is supported, another type) 1-bit and September 2015 Nuix Proof Finder Reference Guide PAGE 21 of 49 Description Query String Kind Extensions Support Scanned for in Level Data Carving 16-bit are unsupporte d) Lotus Notes Database application/vnd.lotusnotes Containers *.nsf Lotus Notes Document application/vnd.lotusnotes-document Email *.dxl Lotus Notes View application/vnd.lotusnotes-view Containers *.dat Lotus application/vnd.lotus- WordPro Document wordpro Lua Byte application/x-lua-byte- System Code code Files LZH Archive application/x-lzh-archive Containers Documents Supported for Carving <=9) (Undocumented) Supported (>= 1 AND Not Applicable (Stored in <=9) another type) Supported (>= 1 AND Not Applicable (Stored in <=9) another type) Recognized Supported for Carving (Undocumented) File LZMA *.lwp Supported (>= 1 AND *.luc Recognized Carving (Undocumented) *.lzh, *.lha, Supported *.arc application/x-lzma Containers *.lzma, *.tlz Supported for Carving (Undocumented) Supported Compressed File LZX Archive Supported for Supported for Carving (Undocumented) application/x-lzx Containers *.lzx Recognized File Supported for Carving (Undocumented) Mac Mach-O Executable application/x-mach-o System Files *.dat Recognized Mac Mach-O Multi- application/x-mach-omulti System Files *.dat Recognized Supported for Carving (Undocumented) Architecture Executable Mac OS X Supported for Carving (Undocumented) image/vnd.apple.icns Images *.icns Recognized Icon File Not Supported for Carving (Signature is not unique enough) MacBinary Archive application/macbinary Containers *.macbin Supported (All) Supported for Carving (Undocumented) Macintosh image/x-pict Images QuickDraw Picture *.pict, *.pct, *.pic Recognized Partially Supported for Carving (Version 2 is carved) September 2015 Nuix Proof Finder Reference Guide PAGE 22 of 49 Description Mailbox File Query String application/mbox Kind Containers Extensions *.mbox Support Scanned for in Level Data Carving Supported (All) Supported for Carving (Undocumented) Matroska Audio File audio/x-matroska Multimedia *.mka Recognized Matroska Video File video/x-matroska Multimedia *.mkv Recognized Media Impression application/vnd.mediaimp ression-rocketthumb-db Databases *.db Supported Supported for Carving (Undocumented) Supported for Carving (Undocumented) RocketThumb Database Micro Systemation (Undocumented) application/vnd.msab-xry Containers *.xry application/vnd.microfore nsics-filesafe Containers *.mfs01 XRY Image Microforensic s FileSafe Supported (> Version Supported for Carving 6) (Undocumented) Supported (All) Supported for Carving Archive Micrografx Designer (Undocumented) image/vnd.micrografxdesigner Drawings *.drw Recognized Drawing Microsoft .NET Supported for Carving (Undocumented) application/x-dotnet System Files *.exe, *.dll Recognized application/vnd.msaccess-acedb Databases *.accdb Partially Supported Supported for Carving (Text stripped) (Undocumented) Supported (2007) Supported for Carving Assembly Microsoft 2007 Access Supported for Carving Supported for Carving (Undocumented) Database Microsoft 2007 Excel application/vnd.openxmlf ormats- Binary Spreadsheet officedocument.spreadshe et.binary Microsoft application/vnd.openxmlf Spreadshe *.xlsx, Supported Supported for 2007 Excel Spreadsheet ormatsofficedocument.spreadshe ets *.xlsm, *.xltx, *.xlk (2007) Carving (Undocumented) Presentatio ns *.pptx, *.pptm, Supported (2007) Supported for Carving Spreadshe ets *.xlsb (Undocumented) etml.sheet Microsoft 2007 application/vnd.openxmlf ormats- PowerPoint Presentation officedocument.presentati onml.presentation *.ppsx, *.ppsm, (Undocumented) *.potx Microsoft 2007 Word application/vnd.openxmlf ormats- Document officedocument.wordproce ssingml.document Documents September 2015 Nuix Proof Finder Reference Guide *.docx, *.docm, *.dotm, *.dotx Supported (2007) Supported for Carving (Undocumented) PAGE 23 of 49 Description Microsoft Access Query String application/vnd.msaccess Kind Databases Extensions *.mdb Database Microsoft video/vnd.ms-asf Multimedia Advanced Systems *.wmv, Support Scanned for in Level Data Carving Partially Supported Supported for Carving (Text stripped) (Undocumented) Recognized Supported for *.asf, *.wma Carving (Undocumented) Format (ASF) Multimedia File Microsoft Automatic application/vnd.msjumplist-automatic- Jumplist destinations Microsoft Backup Tape application/vnd.msbackup Containers *.bkf Supported application/vnd.ms-fon System *.fon Recognized System Files *.automatic destinations Supported -ms (Undocumented) Archive Microsoft Supported for Carving Supported for Carving (Undocumented) Bitmap Font File Files Not Supported for Carving (Signature is not unique enough) Microsoft Cabinet application/vnd.ms-cabcompressed Containers application/vnd.msclipart-gallery Containers *.cag Recognized application/vnd.mshtmlhelp System Files *.chm, *.chtml Supported Archive Microsoft ClipArt *.cab, *.snp, Supported *.onepkg (Undocumented) Gallery Microsoft Compressed Supported for Carving (Undocumented) Microsoft application/vnd.ms- System *.customde Custom Jumplist jumplist-customdestinations Files stinationsms Microsoft Draw OLE application/vnd.ms-draw Images *.dat Recognized application/vnd.msdrawing Images *.dat Recognized Supported Supported for Carving (Undocumented) Object Supported for Carving (Undocumented) Object Microsoft Entourage Supported for Carving (Undocumented) HTML Help File Microsoft Drawing OLE Supported for Carving Supported for Carving (Undocumented) application/vnd.msentourage-appointment Calendar Appointment *.old14even t Partially Supported Not Supported for Carving (Metadata may not be (Signature is not unique enough) complete) September 2015 Nuix Proof Finder Reference Guide PAGE 24 of 49 Description Microsoft Entourage Query String application/vnd.msentourage-contact Kind Contacts Extensions Support Scanned for in Level Data Carving Supported (Metadata Not Supported for Carving may not be complete) (Signature is not unique enough) *.olk14folde Partially Not Supported r Supported (Metadata for Carving (Signature is not may not be complete) unique enough) Partially Supported for Supported (Microsoft Carving (Undocumented) *.olk14cont act Contact Microsoft application/vnd.ms- Entourage Folder entourage-folder Microsoft application/vnd.ms- Entourage Mailbox entourage Containers Containers *.dat Entourage 2001 2008 and Microsoft Outlook For Mac (OLM) 2011 2013) Microsoft Entourage application/vnd.msentourage-message Email *.olk14mes sage Message Partially Supported Not Supported for Carving (Metadata may not be (Signature is not unique enough) complete) Microsoft application/vnd.ms- Other Entourage Note entourage-note Documents Microsoft application/vnd.ms- Entourage Orphaned entourage-orphan Containers *.olk14note *.dat Item Microsoft application/vnd.ms- Other Entourage Task entourage-task Documents *.olk14task Partially Not Supported Supported (Metadata for Carving (Signature is not may not be complete) unique enough) Partially Not Supported Supported (Unlinked for Carving (Signature is not from parent) unique enough) Supported Not Supported for Carving (Signature is not unique enough) Microsoft Equation application/vnd.msequation Other Documents *.dat Recognized Object Microsoft Excel 95 Supported for Carving (Undocumented) application/vnd.ms-excel95 Spreadshe ets Spreadsheet September 2015 Nuix Proof Finder Reference Guide *.xls Partially Supported Supported for Carving (Undocumented) PAGE 25 of 49 Description Query String Kind Extensions Support Scanned for in Level Data Carving (Text stripped) Microsoft application/vnd.ms-excel- Excel Chart chart Microsoft application/vnd.ms-excel- Spreadshe Excel PreOLE2 pre-ole2 ets application/vnd.ms-excel Spreadshe ets Drawings *.xlc *.xls Supported Supported for (All) Carving (Undocumented) Recognized Supported for Carving (Undocumented) Spreadsheet Microsoft Excel Spreadsheet Microsoft Excel XML application/vnd.msexcel+xml Spreadshe ets *.xls, *.xlt, *.xlk, *.nxl, Supported (>= 97 Supported for Carving *.nxt, *.et, *.ett AND <= 2002) (Undocumented) *.xml, *.xls Recognized Not Supported for Carving (Text Spreadsheet Microsoft Exchange based) application/vnd.msexchange-edb Containers *.edb Server Property Supported (>= 5.5 Supported for Carving AND <= 2010) (Undocumented) Supported (>= 2000 Supported for Carving AND <= 2010) (Undocumented) Recognized Supported for Carving Store Microsoft Exchange application/vnd.msexchange-stm Containers *.stm Server Streaming Store Microsoft Form 2.0 application/vnd.ms-formobject System Files *.dat Object (Undocumented) Microsoft Graph Chart application/vnd.ms-graph Drawings *.gra Recognized (All) Microsoft HD image/vnd.ms-photo Images *.wdp, Recognized Supported for *.hdp, *.jxr (Version 1) Carving (Undocumented) *.dat Recognized Partially Supported for Carving (Undocumented) Photo Image Microsoft application/vnd.ms- System Hyperlink Record hyperlink-record Files Supported for Carving (Carved where the signature is not in the file footer) Microsoft Imaging application/vnd.ms-wim Containers Format September 2015 Nuix Proof Finder Reference Guide *.wim Recognized (All) Supported for Carving (Undocumented) PAGE 26 of 49 Description Microsoft Installer File Query String application/vnd.msinstaller Microsoft application/vnd.ms- Installer Patch installer-patch-package Kind Containers Containers Extensions Support Scanned for in Level Data Carving *.msi, *.msm, Partially Supported Supported for Carving *.pcp (Properties ) (Undocumented) *.msp Partially Supported for Supported (Properties Carving (Undocumented) Package Microsoft Installer ) application/vnd.msinstaller-transform Containers *.mst Transform File Microsoft application/vnd.ms-ie- Internet Explorer cache Databases *.dat Cache Microsoft Internet Partially Supported Supported for Carving (Properties ) (Undocumented) Supported Supported for (Version 6 & 8. Earlier Carving (Undocumented) versions untested) application/vnd.ms-iecache-entry Other Documents *.dat Explorer Cache Entry Supported (Version 6 Not Applicable (Stored in & 8. Earlier versions another type) untested) Microsoft Internet application/vnd.ms-iis-log Logs *.dat Supported (Version 6) Information Services Log Not Supported for Carving (Text based) File Microsoft Internet application/vnd.ms-iislog-entry Logs *.dat Supported (Version 6) Information Services Log Not Supported for Carving (Text based) File Entry Microsoft Journal / application/vnd.msjournal Other Documents *.jnt, *.jtp Recognized Journal Template File Microsoft (Undocumented) application/vnd.ms-mso Containers *.dat Recognized Marshaled Server Object Microsoft Media Clip Supported for Carving (Undocumented) application/vnd.msmedia-clip Multimedia *.dat Recognized OLE Object Microsoft Note-It OLE Supported for Carving Supported for Carving (Undocumented) application/vnd.ms-noteit Other Documents Object September 2015 Nuix Proof Finder Reference Guide *.dat Recognized Supported for Carving (Undocumented) PAGE 27 of 49 Description Microsoft Office Query String image/vnd.microsoftmodi Kind Images Extensions *.mdi Support Scanned for in Level Data Carving Recognized Supported for Carving Document Imaging (Undocumented) Microsoft application/vnd.ms-office- Other Office VBA File vba Documents Microsoft application/vnd.ms-ole2- Containers OLE2 Attachment attachment *.dat Recognized Supported for Carving (Undocumented) *.dat Supported Supported for Carving (Undocumented) Wrapper Microsoft OLE2 application/vnd.ms-ole2clipboard Containers *.dat Supported Clipboard Wrapper Microsoft OLE2 (Undocumented) application/vnd.ms-ole2encrypted-package Other Documents *.dat Supported Encrypted Package File Microsoft Supported for Carving Supported for Carving (Undocumented) application/vnd.ms-ole2 OLE2 File Unrecogniz *.dat Supported ed Microsoft application/vnd.ms-ole2- OLE2 Package File package Microsoft application/vnd.ms-ole2- System OLE2 Standard std-link Files application/vnd.msonenote Other Documents Containers Supported for Carving (Undocumented) *.dat Supported Supported for Carving (Undocumented) *.dat Recognized Supported for Carving (Undocumented) Link Microsoft OneNote File Microsoft OneNote application/vnd.msonenote-toc Other Documents *.one *.onetoc2 Table of Contents File Microsoft application/vnd.ms- OrgChart OLE Object orgchart Microsoft application/vnd.ms- Other Outlook Activity outlook-activity Documents Microsoft application/vnd.ms- Calendar Outlook Appointment outlook-appointment Drawings *.dat Partially Supported Supported for Carving (Text stripped) (Undocumented) Partially Supported Supported for Carving (Text stripped) (Undocumented) Recognized Supported for Carving (Undocumented) September 2015 Nuix Proof Finder Reference Guide *.msg Supported Not Applicable (Stored in another type) *.msg Supported Not Applicable (Stored in another type) PAGE 28 of 49 Description Microsoft Outlook Query String application/vnd.msoutlook-block Kind System Files Extensions *.dat Support Scanned for in Level Data Carving Supported Not Applicable (Stored in Block Microsoft Outlook another type) application/vnd.msoutlook-contact Contacts *.msg Supported application/vnd.msoutlook-express-4 Containers *.mbx Supported Contact Microsoft Outlook Not Applicable (Stored in another type) Express 4 Mailbox Supported for Carving (Undocumented) Microsoft application/vnd.ms- Outlook Express outlook-express Containers *.dbx Supported Supported for Carving (Undocumented) Mailbox Microsoft application/vnd.ms- Outlook Folder outlook-folder Microsoft application/vnd.ms- Outlook Item outlook-item Microsoft application/vnd.ms- Other Outlook Journal outlook-journal Documents Microsoft application/vnd.ms- Calendar Outlook Mac Appointment outlook-mac-appointment Microsoft application/vnd.ms- Outlook Mac Contact outlook-mac-contact Microsoft Outlook Mac application/vnd.msoutlook-mac-email Containers *.dat Supported (Stored in another type) Email *.msg Supported Contacts Email *.msg Supported *.dat *.dat *.xml Supported Not Applicable (2011) (Stored in another type) Supported Not Applicable (2011) (Stored in another type) Supported (2011) Not Applicable (Stored in another type) application/vnd.msoutlook-mac Containers *.olm Supported (2011) application/vnd.msoutlook-mac-note Other Documents *.dat Supported (2011) application/vnd.msoutlook-mac-task Other Documents *.dat Supported (2011) Supported for Carving (Undocumented) Note Microsoft Outlook Mac Not Applicable (Stored in another type) Mailbox Microsoft Outlook Mac Not Applicable (Stored in another type) Email Microsoft Outlook Mac Not Applicable Not Applicable (Stored in another type) Task Not Applicable (Stored in another type) Microsoft application/vnd.ms- Outlook Message outlook-msg Containers September 2015 Nuix Proof Finder Reference Guide *.msg Supported Supported for Carving (Undocumented) PAGE 29 of 49 Description Microsoft Outlook Note Query String application/vnd.msoutlook-note Kind Email Extensions *.msg Support Scanned for in Level Data Carving Supported Not Applicable (Stored in another type) Microsoft Outlook application/vnd.msoutlook Containers *.pst, *.ost Supported Personal Folder Supported for Carving (Undocumented) Microsoft application/vnd.ms- System Outlook Property outlook-property-block Files application/vnd.msoutlook-schedule Calendar *.msg Supported Microsoft application/vnd.ms- Containers *.msg Supported Outlook Shortcut outlook-shortcut Microsoft application/vnd.ms- Other Outlook Sticky Note outlook-stickynote Documents Microsoft application/vnd.ms- Other Outlook Task outlook-task Documents Microsoft application/vnd.ms- Containers Photo Editor Object photo-editor Microsoft application/vnd.ms- Presentatio *.ppt, Partially Supported for PowerPoint Presentation powerpoint ns *.pot, *.pps, Supported (95 Text Carving (Undocumented) *.dps, *.dpt stripped) *.msg Supported Not Applicable (Stored in another type) Block Microsoft Outlook Schedule Not Applicable (Stored in another type) Not Applicable (Stored in another type) *.msg Supported Not Applicable (Stored in another type) *.msg Supported Not Applicable (Stored in another type) *.dat Recognized Supported for Carving (Undocumented) Supported (>= 97 AND <= 2002) Microsoft application/vnd.ms-pnf Precompiled Setup System *.pnf Recognized Files Supported for Carving (Undocumented) Information Microsoft Project File application/vnd.msproject Other Documents *.mpp, *.mpt Partially Supported Supported for Carving (95 Text stripped) (Undocumented) Supported (>= 1998) September 2015 Nuix Proof Finder Reference Guide PAGE 30 of 49 Description Microsoft Publisher File Query String application/vnd.mspublisher Kind Documents Extensions *.pub Support Scanned for in Level Data Carving Supported (All) Supported for Carving (Undocumented) Microsoft Reader application/vnd.ms-reader Other Documents *.lit Recognized application/vnd.msregistry-decoded System Files *.dat Supported eBook Microsoft Registry (Undocumented) Decoded Data Not Applicable (Stored in another type) Microsoft application/vnd.ms- Registry File registry Microsoft Registry application/vnd.msregistry-journal Databases application/vnd.msregistry-key System Files Containers *.dat Supported Supported for (All) Carving (Undocumented) *.dat Recognized Supported for Carving *.dat Supported Journal File Microsoft Registry Key Supported for Carving (Undocumented) Not Applicable (Stored in another type) Microsoft Security application/vnd.mspkiseccat System Files *.cat Recognized Catalog Not Supported for Carving (Signature is not unique enough) Microsoft application/vnd.ms-shell- Shell Scrap scrap Microsoft application/vnd.ms- System Shortcut shortcut Files Microsoft Transport application/vnd.ms-tnef Containers Containers *.shs, *.shb Supported Supported for Carving (Undocumented) *.lnk *.dat Supported Supported for (All) Carving (Undocumented) Supported Supported for Carving Neutral Encapsulatio (Undocumented) n Format File Microsoft Virtual PC / application/vnd.msvirtual-harddisk Containers *.vhd Supported (All) Server VHD Disk File Not Supported for Carving (Signature is not at the start of the file) Microsoft Visio application/vnd.ms-visio Drawings *.vsd, *.vst, *.vss Recognized (2000 <) Drawing Supported for Carving (Undocumented) Supported (>= 2000) September 2015 Nuix Proof Finder Reference Guide PAGE 31 of 49 Description Microsoft Visio XML Query String application/vnd.msvisio+xml Kind Drawings Extensions *.vdx, *.vsx, *.vtx Support Scanned for in Level Data Carving Recognized Not Supported for Carving (Text Drawing Microsoft Windows based) image/vnd.ms-ani System Files *.ani Recognized Animated Cursor Image Supported for Carving (Undocumented) Microsoft image/vnd.ms-windows- Windows Cursor Image cursor Microsoft image/vnd.ms-emf Images *.cur Supported Supported for Carving (Undocumented) Drawings *.emf Supported Partially Windows Enhanced Supported for Carving (Carved Metafile when the stronger signature is present) Microsoft Windows application/vnd.mswindows-event-log Logs *.evt Supported Event Log (pre-Vista) Supported for Carving (Undocumented) Microsoft application/vnd.ms- Windows Event Log windows-event-log-record Logs *.dat Supported Not Applicable (Stored in another type) Record (preVista) Microsoft application/vnd.ms- System Windows Help File windows-help Files Microsoft image/vnd.microsoft.icon System Windows Icon Image *.hlp Recognized Carving (Undocumented) *.ico Supported Files Microsoft application/vnd.ms- System Windows Kernel Mini- windows-kernel-minidump Files image/vnd.ms-wmf Drawings Supported for Supported for Carving (Undocumented) *.dmp Recognized Supported for Carving (Undocumented) Dump File Microsoft *.wmf Supported Windows Metafile Partially Supported for Carving (Carved when the stronger signature is present) Microsoft application/vnd.ms- System Windows windows-mini-dump Files September 2015 Nuix Proof Finder Reference Guide *.mdmp Recognized Supported for Carving (Undocumented) PAGE 32 of 49 Description Query String Kind Extensions Support Scanned for in Level Data Carving Recognized Supported for Mini-Dump File Microsoft application/vnd.ms- System Windows Prefetch File windows-prefetch Files Microsoft application/vnd.ms-sxs- System Windows Side-by-Side manifest+xml Files Microsoft application/vnd.ms- Logs Windows Vista and windows-event-logx *.pf Carving (Undocumented) *.xml Recognized Not Supported for Carving (Text based) (SxS) Manifest File *.evtx Supported Supported for Carving (Undocumented) Windows 8 Event Log Microsoft Windows application/vnd.mswindows-event-logx- Vista and Windows 8 chunk Logs *.dat Supported Not Applicable (Stored in another type) Event Log Chunk Microsoft application/vnd.ms- Windows Vista and windows-event-logxrecord Logs *.dat Supported Not Applicable (Stored in another type) Windows 8 Event Log Record Microsoft Word Art application/vnd.ms-wordart Drawings *.dat Recognized Microsoft Word application/vnd.ms-word Documents *.doc, *.dot, Partially Supported Supported for Carving *.wps, *.wpt (95 Text stripped) (Undocumented) Supported for Carving (Undocumented) Document Supported (>= 97 AND <= 2002) Microsoft Word Picture application/vnd.ms-wordpicture Drawings *.doc Recognized Supported for Carving (Undocumented) Microsoft Word Pre- application/vnd.ms-wordpre-ole2 Documents *.doc Recognized Supported for Carving (Undocumented) September 2015 Nuix Proof Finder Reference Guide PAGE 33 of 49 Description Query String Kind Extensions Support Scanned for in Level Data Carving Recognized Not Supported OLE2 Document Microsoft application/vnd.ms- Word XML Document word+xml Microsoft application/vnd.ms- Spreadshe Works Spreadsheet works-ss ets Microsoft application/vnd.ms- Documents Works Word Processor works-wp Documents *.xml, *.doc *.wks, *.xlr *.wps for Carving (Text based) Supported Supported for (Text stripped) Carving (Undocumented) Supported Supported for (Text stripped) Carving (Undocumented) Recognized Supported for Document Microsoft application/vnd.ms-xna- Other XNA Compiled content Documents application/vnd.msxpsdocument Documents *.xnb Carving (Undocumented) Content Microsoft XPS *.xps Recognized Document Microsoft XWMA Audio Supported for Carving (Undocumented) audio/x-ms-wma Multimedia *.xwma, *.wma Recognized MIDI Audio File audio/midi Multimedia *.mid, *.kar, *.rmi Recognized MIME/HTML Document application/x-mime-html Documents *.mht, *.mhtml Supported (All) MobiPocket application/x-mobipocket- Other *.mobi, Recognized eBook ebook Documents *.prc, *.azw, Mozilla Mork Database application/vnd.mozilla.m db-mork Databases *.mab, *.msf, *.dat Supported Mozilla/Firef ox Browser application/vnd.mozillabrowser-cache Databases *.dat Supported File Supported for Carving (Undocumented) Supported for Carving (Undocumented) Supported for Carving (Undocumented) Supported for Carving (Undocumented) *.azw3 Supported for Carving (Undocumented) Cache Not Supported for Carving (Multi-file format) Mozilla/Firef application/vnd.mozilla- Other ox Browser Cache Entry browser-cache-entry Documents Mozilla/Firef ox History application/vnd.mozillafirefox-history Databases *.dat Supported Not Applicable (Stored in another type) *.dat Supported Supported for Carving (Undocumented) September 2015 Nuix Proof Finder Reference Guide PAGE 34 of 49 Description Mozilla/Firef ox History Query String application/vnd.mozillafirefox-history-entry Kind Other Documents Extensions *.dat Support Scanned for in Level Data Carving Supported Not Applicable (Stored in Entry another type) Mozilla/Firef ox Session application/vnd.mozillafirefox-session-store- Store Entry entry Mozilla/Firef ox Session Other Documents *.dat Supported application/vnd.mozillafirefox-session-store Documents *.js Supported audio/mpeg Multimedia *.mp3, *.mp2 Recognized another type) Store File MPEG Audio File Not Applicable (Stored in Not Supported for Carving (Text based) Partially Supported for Carving (Carved when wrapped in ID3 or when the audio frame starts on a block boundary) MPEG Video File video/mpeg Multimedia *.mpg, *.mpeg, Recognized (MPEG-1, Partially Supported for *.mpe, *.m1v others undocume Carving (When the movie header nted) is present or when the video frame starts on a block boundary) MPEG-4 application/mp4 Multimedia Video File *.mp4, Recognized Supported for *.m4a, *.mpeg4, (All) Carving (Undocumented) Supported for Carving *.mpeg, *.m4v, *.f4v MS Money Document application/x-msmoney Databases *.mny Recognized MS SQL Server server/sqlserver-instance Databases *.dat Supported (All) (Undocumented) Instance MYOB SQL Server database) application/vnd.myob Databases Company File Native Language Not Applicable (Stored on a MS *.myo, Recognized *.prm, *.dat, *.pls application/x-nls System Files Support File September 2015 Nuix Proof Finder Reference Guide *.nls Supported for Carving (Undocumented) Recognized Supported for Carving (Undocumented) PAGE 35 of 49 Description Network Packet Query String application/vnd.tcpdump.r ecord Kind Logs Extensions *.dat Support Scanned for in Level Data Carving Supported Not Applicable (Stored in another type) Network Record application/x-network Other Documents *.dat Supported New Generation application/x-pcapng Logs *.pcapng Supported Not Applicable (Stored in another type) Packet Capture File NeXTSTEP/M Supported for Carving (Undocumented) application/x-plist acOS Property List System *.plist Files Partially Partially Supported (Binary Supported for Carving (Binary and XML formats) plists are carved, XML plists are not carved) Not Recognized (Text formats) NeXTSTEP/M acOS application/x-plist-node System Files *.dat Supported Property List Node Not Applicable (Stored in another type) Norton Ghost application/vnd.norton- Disk Image ghost Note application/x-note Containers *.gho, Recognized *.ghs Other *.dat Supported for Carving (Undocumented) Supported Documents Not Applicable (Stored in another type) NTFS File filesystem/x-ntfs-file- System Record record Files NTFS Index Record filesystem/x-ntfs-indexrecord System Files *.dat Recognized NTFS LogFile filesystem/x-ntfs-logfile System Files *.dat Recognized *.dat Recognized Supported for Carving (Undocumented) Supported for Carving (Undocumented) Supported for Carving (Undocumented) NTFS LogFile Record filesystem/x-ntfs-logfilerecord System Files *.dat Recognized Not Applicable (Stored in another type) NTFS Master File Table filesystem/x-ntfs-mft System Files *.dat Recognized Not Supported for Carving (Signature is not unique enough) September 2015 Nuix Proof Finder Reference Guide PAGE 36 of 49 Description NTFS UsnJrnl File Query String filesystem/x-ntfs-usnjrnl Kind System Files Extensions *.dat Support Scanned for in Level Data Carving Recognized Supported for Carving (Undocumented) NTFS UsnJrnl Record filesystem/x-ntfs-usnjrnlrecord System Files *.dat Recognized Nuix Evidence File application/vnd.nuixevidence Containers *.dat Supported ((Synthetic Not Supported for Carving (Text type representin based) Not Applicable (Stored in another type) g evidence containers) ) Nuix Load File Nuix Log File application/vnd.nuix-loadfile text/x-nuix-log Containers Logs *.csv *.dat Supported (ITEMPATH Not Supported for Carving (Text and metadata) based) Supported Not Supported for Carving (Text based) Nuix Logical Image File application/vnd.nuixlogical-image-file Containers *.n01, zip Supported Nullsoft Multimedia application/x-nsv-vp3mp3 Multimedia *.nsv Recognized application/vnd.nullsoft.ns is-archive Containers *.dat Recognized Supported for Carving (Undocumented) Container Nullsoft Scriptable Supported for Carving (Undocumented) Install System Supported for Carving (Undocumented) Archive Nut Multimedia application/x-nut Multimedia *.nut Recognized application/ogg Multimedia *.ogg, Recognized Container Ogg Supported for Carving (Undocumented) Multimedia Container *.ogv, *.oga, Supported for Carving (Undocumented) *.ogx Open Financial application/x-ofx Databases *.ofx, *.qfx Recognized (All) application/vnd.oasis.ope ndocument.chart Drawings *.odc, *.otc Recognized (ALL) Exchange OpenDocume nt Chart Not Supported for Carving (Text based) Supported for Carving (Undocumented) September 2015 Nuix Proof Finder Reference Guide PAGE 37 of 49 Description OpenDocume nt Database Query String application/vnd.oasis.ope ndocument.database Kind Drawings Extensions *.odb Support Scanned for in Level Data Carving Partially Supported Supported for Carving (ALL (Doesn't (Undocumented) extract text within tables)) OpenDocume nt Formula application/vnd.oasis.ope ndocument.formula Other Documents *.odf, *.otf Supported (ALL) Supported for Carving (Undocumented) OpenDocume nt Graphics application/vnd.oasis.ope ndocument.graphics Drawings *.odg, *.otg Supported (ALL) Supported for Carving (Undocumented) OpenDocume nt Image application/vnd.oasis.ope ndocument.image Images *.odi, *.oti Recognized (ALL) OpenDocume application/vnd.oasis.ope Presentatio *.odp, *.otp Supported Supported for nt Presentation ndocument.presentation ns (ALL) Carving (Undocumented) OpenDocume application/vnd.oasis.ope Spreadshe Supported Supported for nt Spreadsheet ndocument.spreadsheet ets (ALL) Carving (Undocumented) OpenDocume application/vnd.oasis.ope Documents *.odt, *.ott, Supported Supported for nt Text ndocument.text *.odm, *.oth (ALL) Carving (Undocumented) OpenType application/vnd.ms- System *.otf, *.ttf Recognized Supported for Font opentype Files OpenXPS application/oxps Documents Supported for Carving (Undocumented) *.ods, *.ots Carving (Undocumented) *.oxps Recognized Document Oxygen Export XML Carving (Undocumented) application/vnd.oxygenexport-file Containers *.xml Supported File Oxygen Export XML Supported for Not Supported for Carving (Text based) application/vnd.oxygenskype-account Containers *.dat Supported Skype Account Supported for Carving (Undocumented) Oxygen application/vnd.oxygen- Other Export XML Skype SMS skype-sms-message Documents application/vnd.oxygenskype-sms-thread Other Documents *.dat Supported Not Applicable (Stored in another type) Message Oxygen Export XML Skype SMS Thread September 2015 Nuix Proof Finder Reference Guide *.dat Supported Not Applicable (Stored in another type) PAGE 38 of 49 Description Oxygen Export XML Query String application/vnd.oxygensms-message Kind Other Documents Extensions *.dat Support Scanned for in Level Data Carving Supported Not Applicable (Stored in SMS Message another type) Palm Database File application/vnd.palm Other Documents *.pdb Supported Parallels VM Disk Image application/vnd.parallelsvirtual-harddisk Containers *.hdd, *.hds Supported (All) Parchive (Parity application/x-par Containers *.par Recognized Supported for Carving (Undocumented) Supported for Carving (Undocumented) Archive) 1.0 File Parchive (Parity (Undocumented) application/x-par2 Containers *.par, *.par2 Recognized Archive) 2.0 File PCX Image Supported for Carving Supported for Carving (Undocumented) image/pcx Images *.pcx Supported Not Supported for Carving (Signature is not unique enough) PGP/MIME Format application/pgp-encrypted Containers *.dat Supported (Requires Not Supported for Carving key and password (Signature is not unique enough) to decrypt) PGP/MIME Keyring File application/pgp-keys Other Documents *.pgp, *.gpg, *.asc Recognized (All) Not Supported for Carving (Signature is not unique enough) Pixel Index application/vnd.pixelindex Thumbnail Database -thumb-db PKCS #12 File application/x-pkcs12 Databases *.db Supported Supported for Carving (Undocumented) Other Documents *.p12, *.pfx Recognized (All) Not Supported for Carving (Signature is not unique enough) PKCS #7 application/pkcs7-mime MIME Encrypted Other *.dat Documents Recognized Not Supported (All) for Carving (Signature is not unique enough) Plain Text text/plain Unrecogniz ed *.txt Supported (All) Not Supported for Carving (Text based) September 2015 Nuix Proof Finder Reference Guide PAGE 39 of 49 Description POP Mail Account Query String server/pop3 Kind Containers Extensions *.dat Support Scanned for in Level Data Carving Supported Not Applicable (Stored on a remote server) POP Mail Folder server/pop3-folder Containers *.dat Supported Portable Document application/pdf Documents *.pdf Partially Supported Supported for Carving (Text and JPEG (Undocumented) Not Applicable (Stored on a remote server) Format images) Portable Document application/pdf-mail Email *.pdf Format Mail Partially Supported Supported for Carving (Text and JPEG (Undocumented) images) Portable Partially Supported for Document Format Supported (Text and Carving (Undocumented) Portfolio JPEG images) Portable application/pdf-portfolio image/png Containers Images *.pdf *.png Supported Network Graphic Postscript Carving (Undocumented) application/postscript Documents File Predictive Supported for *.ps, *.eps, Recognized *.ai application/x-pmml-xml Documents *.pmml Supported for Carving (Undocumented) Recognized Model Markup Not Supported for Carving (Text based) Language Document Python Byte application/x-python- System Code byte-code Files QCP Audio File audio/qcelp Multimedia *.qcp Recognized Quattro Pro Spreadsheet application/vnd.corelquattro Spreadshe ets *.qpw, *.wq1, Recognized *.pyc, *.pyo Recognized Supported for Carving (Undocumented) Supported for Carving (Undocumented) *.wq2, *.wb1, Supported for Carving (Undocumented) *.wb2, *.wb3 September 2015 Nuix Proof Finder Reference Guide PAGE 40 of 49 Description QuickBooks Document Query String application/vnd.intuit.qbw Kind Databases Extensions *.qbw Support Scanned for in Level Data Carving Recognized Supported for Carving (Undocumented) Quicken Document application/vnd.intuit.qdf Databases *.qdf Recognized Quicken Interchange application/vnd.intuit.qif Documents *.qif Recognized video/vnd.rad-bink Multimedia *.bik Recognized Supported for Carving (Undocumented) File RAD Game Tools Bink (Undocumented) Video File Supported for Carving (Undocumented) RAR Archive application/x-rar- File compressed RDF/XML application/rdf+xml Metadata File Real Media Supported for Carving Containers *.rar Supported Carving (Undocumented) Other *.rdf, *.xml Recognized Documents audio/vnd.rn-realaudio Supported for Multimedia Not Supported for Carving (Text based) *.ra, *.rm Recognized Audio File Supported for Carving (Undocumented) Reuters application/vnd.reuters- Other Messenger Conversation conversation Documents Reuters application/vnd.reuters- Containers Messenger File messenger RFC822 Email Headers message/rfc822-headers Email *.eml Supported RFC822 Email Message message/rfc822 Email *.eml, *.mht, Supported (All) RFC822 log message/rfc822-log Containers *.dat Supported Not Applicable (Stored in another type) *.txt Supported Not Supported for Carving (Text based) Not Supported for Carving (Text based) *.zmc *.dat Supported for Carving (Undocumented) Supported Not Supported for Carving (Text based) Rich Text Format text/rtf Documents *.rtf Supported Supported for Carving (Undocumented) RIFF WAVE audio/wav Multimedia *.wav Recognized Audio File RPM Archive Supported for Carving (Undocumented) application/x-rpm Containers File September 2015 Nuix Proof Finder Reference Guide *.rpm Recognized Supported for Carving (Undocumented) PAGE 41 of 49 Description Ruby Interactive Query String application/rubyinteractive Kind System Files Extensions *.ri Support Scanned for in Level Data Carving Recognized Supported for Carving Documentati on Files (Undocumented) Samsung application/vnd.samsung- JungUm Global gul Documents *.gul Document Partially Supported for Supported (Hunmin Carving (Undocumented) Word 2000/XP and JungUm Global (No image extraction) ) Sanshiro application/x-js-sns Documents Spreadsheet File Scalable image/svg+xml Drawings *.jsd, *.jst, Recognized Supported for *.jac, *.jtc (>= 4 AND <= 2008) Carving (Undocumented) *.svg Recognized Not Supported Vector Graphic for Carving (Text based) Scraped Message message/x-scraped Email *.eml Supported SharePoint Item server/sharepoint-item Other Documents *.dat Supported (2010) Not Applicable (Stored in another type) Not Applicable (Stored on a remote server) SharePoint List server/sharepoint-list Containers *.dat Supported (2010) Not Applicable (Stored on a remote server) SharePoint Server server/sharepoint Containers *.dat Supported (2010) SharePoint Site server/sharepoint-site Containers *.dat Supported (2010) Skype application/vnd.skype- Databases *.db Supported Activity Database activity-database Skype Chat application/vnd.skype- Other Conversation chat-conversation Documents Skype Chat application/vnd.skype- Other Logs File chat-log Documents Not Applicable (Stored on a remote server) Not Applicable (Stored on a remote server) Supported for Carving (Undocumented) September 2015 Nuix Proof Finder Reference Guide *.dat Supported Not Applicable (Stored in another type) *.dbb Recognized Supported for Carving (Undocumented) PAGE 42 of 49 Description Skype Chat Message Query String application/vnd.skypechat-message Kind Other Documents Extensions *.dat Support Scanned for in Level Data Carving Supported Not Applicable (Stored in another type) Skype Chat Sync File application/vnd.skypechat-sync Other Documents *.dat Partially Supported Supported for Carving (Not all versions (Undocumented) supported) Skype Contact application/vnd.skypecontact Contacts *.dat Supported Skype Voice or Video Call application/vnd.skype-call Other Documents *.dat Supported Socket filesystem/socket System *.dat Supported Not Applicable (Stored in another type) Not Applicable (Stored in another type) Files Not Supported for Carving (Signature is not unique enough) Sonic Global Image application/vnd.sonicglobal-image Containers *.gi Recognized Sony BBeb eBook application/x-sony-bbeb Other Documents *.lrf Recognized Supported for Carving (Undocumented) Supported for Carving (Undocumented) SQLite Database application/vnd.sqlitedatabase Databases *.db, *.sqlite, Supported *.sqlitedb, *.db3, Supported for Carving (Undocumented) *.sqlite3 StarCalc Spreadsheet application/vnd.stardivisio n.calc Spreadshe ets *.sdc Recognized (All) Supported for Carving (Undocumented) StarCalc XML application/vnd.sun.xml.c Spreadshe Spreadsheet alc ets StarDraw application/vnd.stardivisio Drawings Drawing n.draw StarDraw application/vnd.sun.xml.d XML Drawing raw StarImpress application/vnd.stardivisio Presentatio Presentation n.impress ns Drawings September 2015 Nuix Proof Finder Reference Guide *.sxc, *.stc *.sda *.sxd, *.std *.sdd, *.sdp Supported Supported for (All) Carving (Undocumented) Recognized Supported for (All) Carving (Undocumented) Supported Supported for (All) Carving (Undocumented) Recognized Supported for (All) Carving (Undocumented) PAGE 43 of 49 Description StarImpress XML Query String application/vnd.sun.xml.i mpress Kind Presentatio ns Extensions *.sxi, *.sti Support Scanned for in Level Data Carving Supported (All) Supported for Carving Presentation (Undocumented) StarMath Formula application/vnd.stardivisio n.math Other Documents *.smf Recognized (All) StarOMath XML Formula application/vnd.sun.xml. math Other Documents *.sxm Supported (All) StarWriter Document application/vnd.stardivisio n.writer Documents *.sdw, *.sgl, *.vor Recognized (All) Supported for Carving (Undocumented) Supported for Carving (Undocumented) Supported for Carving (Undocumented) StarWriter application/vnd.sun.xml.w XML Document riter StuffIt application/x-stuffit Documents Containers *.sxw, Recognized Supported for *.stw, *.sxg (All) Carving (Undocumented) *.sit, *.sitx Recognized Supported for Archive File Sun Basic Carving (Undocumented) audio/basic Multimedia *.au Recognized Audio File Supported for Carving (Undocumented) Sun JRE application/vnd.sun-jre- System Timezone Data timezone Files Symantec application/vnd.symantec System KVS IIS File -kvs-iis Files Symbolic Link filesystem/symlink System Files *.dat Recognized Supported for Carving (Undocumented) *.dat *.dat Partially Supported for Supported Carving (Undocumented) Recognized Not Supported for Carving (Signature is not unique enough) System system/x-process Process Tagged Other *.dat Supported Documents image/tiff Images (Stored on a remote server) *.tiff, *.tif Supported Image Format File tar Archive Not Applicable Supported for Carving (Undocumented) application/x-tar Containers *.tar Supported File Not Supported for Carving (Signature is not unique enough) Targa Image image/tga Images File *.tga Partially Not Supported Supported for Carving (Signature is not unique enough) September 2015 Nuix Proof Finder Reference Guide PAGE 44 of 49 Description Tencent Foxmail Box Query String application/vnd.tencentfoxmail-box Kind Containers Extensions *.box Support Scanned for in Level Data Carving Supported Supported for Carving File (Undocumented) The Local Machine application/vnd.nuixlocal-host Containers *.dat Supported Not Applicable (No support) TrueType application/x-font-ttf System *.ttf Recognized Supported for Font TrueType Files application/x-font-ttc Font Collection TwinVQ Audio File System Carving (Undocumented) *.ttc Recognized Files audio/x-twinvq Multimedia Supported for Carving (Undocumented) *.vqf Recognized Supported for Carving (Undocumented) Type 1 Font application/x-font-type1 System Files *.pfm, *.pfb, *.pfa Recognized Unallocated Space filesystem/unallocatedspace Containers *.dat Supported Supported for Carving (Undocumented) Not Applicable (Represents the space that will be carved) Uniform application/vnd.uof.prese Presentatio Office Presentation ntation ns application/vnd.uof.sprea dsheet Spreadshe ets *.uop, *.uof Recognized Not Supported for Carving (Text based) File Uniform Office *.uos, *.uof Recognized Spreadsheet File Uniform Office Text based) application/vnd.uof.text Documents *.uot, *.uof Recognized UNIX Ar Archive File application/x-ar Containers *.ar, *.deb, *.udeb, Supported UNIX compress- application/x-compress Containers File *.z, *.taz Supported for Carving (Undocumented) Supported Compressed File Supported for Carving (Undocumented) application/x-cpio Containers *.cpio Supported Archive File UNIX Portable Not Supported for Carving (Text based) *.lib, *.a UNIX CPIO Not Supported for Carving (Text Supported for Carving (Undocumented) image/x-portable-bitmap Images *.pbm Supported Supported for Carving (Undocumented) September 2015 Nuix Proof Finder Reference Guide PAGE 45 of 49 Description Query String Kind Extensions Support Scanned for in Level Data Carving Supported Supported for Bitmap Graphic UNIX image/x-portable- Portable Graymap graymap Images *.pgm Carving (Undocumented) Graphic UNIX Portable image/x-portable-pixmap Images *.ppm Supported Pixelmap Graphic UNIX/Linux (Undocumented) application/x-elf ELF Executable Unknown Binary File System *.dat Recognized Files application/octet-stream Unrecogniz ed User Account application/x-user- Other Record account Documents User Status application/x-user-status- Other Update update Documents Uuencoded application/x-uuencoded Containers Supported for Carving (Undocumented) *.dat *.dat Supported (Used for Not Applicable (Used for unrecogniz ed types.) unrecognized types.) Supported Not Applicable (Stored in another type) *.dat Supported Not Applicable (Stored in another type) *.uue, *.uu Supported Content Valve GCF Supported for Carving Not Supported for Carving (Text based) application/vnd.valve-gcf Containers *.gcf Recognized Archive File Not Supported for Carving (Signature is not unique enough) Valve Pak application/vnd.valve-pak Containers *.vpk Recognized Archive File Carving (Undocumented) Valve VBSP application/vnd.valve- Map File vbsp vCalendar text/x-vcalendar Containers *.bsp Recognized Supported for Carving (Undocumented) Containers *.vcs Recognized Data File vCard Supported for Not Supported for Carving (Text based) text/vcard-contact Contacts Contact *.vcf Supported Not Supported (Versions: 2.1; 3.0; for Carving (Text based) 4.0) September 2015 Nuix Proof Finder Reference Guide PAGE 46 of 49 Description vCard File Query String text/vcard Kind Containers Extensions *.vcf Support Scanned for in Level Data Carving Supported Not Supported for Carving (Text based) vCard XML File application/vcard+xml Containers *.vcf, *.xml Supported VGM Audio File audio/x-vgm Multimedia *.vgm Recognized Vivo Video File video/vnd.vivo Multimedia *.viv Recognized Not Supported for Carving (Text based) Supported for Carving (Undocumented) Supported for Carving (Undocumented) VMWare Disk application/vnd.vmware.v Descriptor File mdk-descriptor VMWare application/vnd.vmware.v Sparse Disk Image mdk-sparse Containers Containers *.vmdk *.vmdk Supported Not Supported (All) for Carving (Text based) Supported Supported for (>= 4) Carving (Undocumented) Supported Not Applicable (Stored in Segment Voice Mail Record application/x-voice-mailrecord Other Documents *.dat another type) WavPack Audio File audio/x-wavpack Multimedia *.wv Recognized WebM Video File video/webm Multimedia *.webm Recognized WebP Image image/webp Images *.webp Recognized Supported for (All) Carving (Undocumented) Recognized Not Applicable Supported for Carving (Undocumented) Supported for Carving (Undocumented) Windows 7 application/vnd.ms- Sticky Notes File stickynote Windows image/bmp Containers *.snt (Stored in another type) Images *.bmp Supported Bitmap Graphic Windows Carving (Undocumented) application/dll Dynamic Link Library Windows Executable Supported for application/exe System *.dll, *.ocx, Files *.drv, *.tlb, *.sys System Files *.exe, *.prx, *.scr, *.pif Recognized Supported for Carving (Undocumented) Recognized Partially Supported for Carving (64 and 32 bit PE images carved, 16 bit September 2015 Nuix Proof Finder Reference Guide PAGE 47 of 49 Description Query String Kind Extensions Support Scanned for in Level Data Carving images do not have a strong enough signature) Windows text/x-windows-registry RegEdit File Windows Thumbs DB Other *.reg Recognized Documents application/x-thumbs-db Containers (No support) *.db Supported File Wireless Bitmap Supported for Carving (Undocumented) image/vnd.wap.wbmp Images *.wbmp Supported Graphic WordPerfect Document Not Applicable Not Supported for Carving (Signature is not unique enough) application/vnd.corelwordperfect Documents *.wpd, *.wp, Partially Supported Supported for Carving *.wp7, *.wp6, (Text stripped) (Undocumented) Supported for Carving *.wp5, *.wp4, *.mlm WordPerfect Slide Show application/vnd.corelslideshow Presentatio ns *.shw Recognized X11 Font application/x-font-pmf System Files *.pmf Recognized (Undocumented) Supported for Carving (Undocumented) XSL Formatting application/xslfo+xml Other Documents *.fo, *.xml Recognized Objects File XSL Transformati Not Supported for Carving (Text based) application/xslt+xml System Files *.xsl, *.xslt, *.xml Recognized X-Ways File application/vnd.x- Containers *.ctr Partially Partially System Image ways.filesystem Supported (XWFS1 Supported for Carving (XWFS1 only, not all only) on File Not Supported for Carving (Text based) metadata extracted) Xxencoded application/x-xxencoded Containers *.xxe, *.xx Recognized Content XZ Not Supported for Carving (Text based) application/x-xz Containers Compressed File September 2015 Nuix Proof Finder Reference Guide *.xz, *.txz Recognized Supported for (All) Carving (Undocumented) PAGE 48 of 49 Description ZipCompressed Query String application/x-zipcompressed Kind Containers Extensions *.zip, *.zipx File Support Scanned for in Level Data Carving Supported (Shrunk, Supported for Carving Imploded, Deflated, (Undocumented) Deflate64, LZMA, bzip2 and noncompresse d entries) ZLIB application/zlib Containers *.dat Supported Compressed File Not Supported for Carving (Signature is not unique enough) ZLIB Compressed application/x-zlib-stream Containers *.dat Supported Stream ZOO Not Supported for Carving (Signature is not unique enough) application/x-zoo Containers Compressed File *.zoo Recognized Supported for Carving (Undocumented) © 2015 Nuix Software. All rights reserved. Nuix believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. The information in this publication is provided “as is.” Nuix makes no representations or warranties of any kind with respect to the information in this publication and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Using, copying, and distribution of any Nuix software described in this publication requires an applicable software license. September 2015 Nuix Proof Finder Reference Guide PAGE 49 of 49
Related documents