Nuix Supported File Types Guide
This introduction covers the following information:
File types are classified by Nuix Workstation MIME-type
Support levels for file formats
Other terms used in File Types' tables
Formats supported for forensic images
File systems that support processing images
File types are classified by Nuix Workstation MIME-type
The file types detailed in the following sections of this document mirror the MIME types you see in Nuix Workstation's Edit Processing Profile window when you select the MIME Type Settings tab.
In alphabetical order, the rest of the guide details all the supported file formats for each file type per its MIME-type classification or category.
Support levels for file formats
Nuix provides various levels of support for file formats used by a wide variety of its applications, including Nuix Workstation, which you see in the Support Level column of the file type tables:
| Support Level |
Description |
| Supported |
Nuix fully supports the file type, being able to extract all its metadata and content. |
| Supported (All) |
Nuix has tested or verified information a specific version or versions. |
| Partially Supported |
Nuix recognized the file type but was unable to process all its data. On detection of a file type identified from the item's header (even when given the wrong extension), Nuix attempts to extract the metadata and text intelligently, but cannot always categorize the metadata over all versions. Then, you see "Text stripped" or "version 7+" to clarify why the file type has only partial support. |
| Recognized |
Nuix recognized the file format by its header but does not fully support it. This file type designation is text stripped. |
Other terms used in File Types' tables
Definitions for other terms used in the tables, besides those used in the preceding Support levels for file formats table, include those for the following terms:
| Term |
Definition |
| Supported for Data Carving |
Nuix was able to identify and extract this file type based on its file signature. |
| Not supported for Data Carving |
Nuix was unable to identify and extract this file type based on its file signature. |
| Undocumented |
Nuix was unable to confirm which versions of the file type it supports. Therefore, you can assume that all versions of the file type are supported. |
| Signature is not unique enough |
The number was not long enough or unique enough to use when determining if the start of a carving block was a file or random data with another file. |
| Stored on a remote server |
Reserved mostly for the IMAP/POP3 email type file, these files live on a server. Therefore, the type is not relevant because carving requires the file to be on a local disk or disk image. |
| Stored in another type |
For items contained in another file type in a database (for example, a database row), which is the object carved during file carving. |
Formats supported for forensic images
Nuix Workstation can directly consume some forensic images, allowing Nuix Workstation to process the source data without interference from the operating system or the filesystem security.
| Type |
|
Nuix Workstation supports |
| Encase |
E01, E02, E03, and so on |
Supports direct processing of Encase images; both single E01 files and segmented. |
|
|
L01, L02, L03, and so on |
Supports direct processing of Encase Logical Volumes. |
| dd Images |
dd |
Supports direct processing of single file dd images. |
|
|
dd.01, dd.02, dd.03, and so on |
Can process Split DD files using the Add Split DD Files option option when adding evidence. All split files for the same image must reside in the same folder for processing. |
| AccessData |
ad1 files |
|
File systems that support processing images
Nuix Workstation processes images of the following file systems:
| Machine type |
File system |
| Windows |
FAT32/16/12, NTFS, exFAT |
| Linux |
EXT2, EXT3, EXT4 |
| Apple |
HFS+, HFSX |
Supported partition types: IBM, APM, GPT
You can add the following file disk images as evidence:
A single file
Complete E01 or dd images
Add segmented Encase images
To add segmented Encase images:
Create a directory with all of the segments associated with a given image.
Create a piece of Nuix Workstation evidence at the parent directory level. This ensures that all the files are associated with a single image.