Key Benefits

    • 4,242 file types supported

    • Familiar Windows File Find and DOS DIR User Interfaces

    • Identifies File Types by their Content, even when they are Locked/DenyRead

    • 109 Columns of File Details for Each File

    • Provides Outside In and PRONOM cross reference values...

    • Supports MS Windows NT/200x/XP/Vista/7/8

    • Runs from a USB drive/CD ROM without writing to the Windows Registry or the hard drive being analyzed

    • Calculates hash codes, including MD4, MD5, SHA-1, SHA-256, SHA-384 & SHA-512

    • Finds Files with Floating Headers

    • Corrects Wrong File Extensions

    • Create a statistical report as an overview of the project or a preview of data to be searched

    • Renames Files using their Metadata and File Type (FI Directory)

    • Detects Encrypted Files, including TrueCrypt

    • Displays all NTFS Alternate Data Streams & Security File Usernames

    • Displays metadata extracted from many of the supported file types*

* Forensic Innovations does not guarantee that all of a file's metadata is extracted.

FI Directory Examples

Reliable, fast, and accurate computer forensic tools.
This is a Spreadsheet Export example using the following command line:

fiwdir.exe C:\test\*.* /C /VM >C:\fiwdir8.csv

/VM expands all columns to their maximum width and /C surrounds all fields with quotes and separates them with commas.

Here's another Spreadsheet Export example with the addition of more commands:

fiwdir.exe C:\test\*.* /C /VM /ST0 /HCC /HC4 >C:\fiwdir8a.csv

/ST0 instructs File Investigator to compare each file's hash codes to external legal hash databases before using the rest of our file analysis stages. You will see some files identified as Legal Hash Database(s) Match rather than the detailed description that we typically provide. The /HCC and /HC4 instruct File Investigator to calculate the CRC-32 and MD4 hash codes for every file. Notice that most files had Checksum and Hash values calculated, because the loaded legal hash databases required those values for identification. Three files were a match for these databases, and were given the description "Legal Hash Database(s) Match (Good)". This means that they are known good files that belong to the software package listed as a "Source" in the extracted Text Metadata values. Those same files did not get their Checksum & MD4 hash values calculated, because they weren't required to match with the legal databases that they were located in.

This is a Report on the statistics collected while analyzing a typical hard drive with MS Windows XP and a number of other applications installed. When you want a preview of a hard drive, before you start your investigation, this report will give you an overview of the types of files and data you will be searching through. The command line used was:

fiwdir.exe c:\*.* /D /RTc:\fiwdir9.txt /S

/D instructs File Investigator to recursively scan directories for directory, file and size totals. /RT is the report command, which is followed by the name of the file to create for the report. /S is used to recurse through subdirectories when searching for files to analyze.
In this report, you will notice that 98% of the 183,793 files were identified with 90% or higher accuracy. That is unprecedented in the Electronic Discovery industry. The files being analyzed take up 73 GB, and the whole process completed in 2 hours and 23 minutes.

Price: $249 + $50 (for maintenance & support)

  • Features A list of common features that can be found while using the FI Directory for Windows product. [...]
  • FI Directory The main page for the FI Directory from Windows with a short description about the product. [...]
  • FI Tools ColumnsFile Investigator extracts many different types of information from files while performing the identification process. This is a list of the columns/fields of information available in the FI Tools applications.[...]
  • DownloadsFeel free to download any of the software titles listed here. All downloads act as Trial versions, by displaying a nag screen, until you purchase the Registration Key. [...]