Key Benefits

    • 4,242 file types supported

    • Familiar Windows File Find and DOS DIR User Interfaces

    • Identifies File Types by their Content, even when they are Locked/DenyRead

    • 109 Columns of File Details for Each File

    • Provides Outside In and PRONOM cross reference values...

    • Supports MS Windows NT/200x/XP/Vista/7/8

    • Runs from a USB drive/CD ROM without writing to the Windows Registry or the hard drive being analyzed

    • Calculates hash codes, including MD4, MD5, SHA-1, SHA-256, SHA-384 & SHA-512

    • Finds Files with Floating Headers

    • Corrects Wrong File Extensions

    • Create a statistical report as an overview of the project or a preview of data to be searched

    • Renames Files using their Metadata and File Type (FI Directory)

    • Detects Encrypted Files, including TrueCrypt

    • Displays all NTFS Alternate Data Streams & Security File Usernames

    • Displays metadata extracted from many of the supported file types*

* Forensic Innovations does not guarantee that all of a file's metadata is extracted.

FI Directory Features

Reliable, fast, and accurate computer forensic tools.
The Summary/Syntax screen shows the usage syntax, versions of the included libraries as well as a list of the Legal Hash Databases that are loaded. The screen shot on the left (click the image to enlarge) shows that we identify thousands of different file types (listed as the number of entrees in the Descriptions Database). At the bottom of the screen, there is a list of the other help screens that are available.

The Display Options screen provides you with the commands available for controlling the output formatting of your search results. You can control the size of each column individually, or use one of the preconfigured sets of columns (ex: /VD or /VM). With the /RT command, File Investigator Directory for Windows creates a report containing the statistics of all the different file types and categories found.

The Filter Options screen has commands that provide the ability to filter your search results by File Type, Platform/OS, Storage Method, Content Type and Accuracy level that File Investigator is able to achieve on each file. Using the /I command filters out all files with a file extension known to belong to their file type.

The Configuration Options screen has commands that calculate hash values, fix bad filenames and wrong file extensions as well as select the Identification Stages used. Using the /NM command, you can rename files using metadata found inside them. This is useful when recovering files from a damaged hard drive that resulted in a large number of files losing their original file names.

The Usage Examples screen list a number of example for how you can mix and match commands to produce the exact output that you need. It includes everything from removing the header & footer text and adding comma delimiters between fields for importing into a spreadsheet to sorting the files by a select column.

Here's an example of what you will see when you simply run FIWDIR.EXE without any command line parameters other than the path and filespec. Three columns are provided: Filename+Ext, Attributes and Description. The Filename+Ext column shows the long filenames and any Alternate Data Streams (ADS) hiding behind them. The Attributes column shows the usual Archive, Directory, Read-Only, Hidden & System file attributes as well as 'N' for NTFS ADS files. The Description is a name for the true file type that File Investigator has identified each file as.

Here's another example of using FIWDIR.EXE on a set of files, and adding the /VD command to show the Descriptions and Details columns. The first column is the DOS Filename (which displays the shortened 8.3 filename) in order to limit the filename to 12 characters. After that comes the same Description column as in the last example, then the Numbers Metadata Summary column. This last column combines the individual numbers metadata columns into a single field for a quick summary. Using the /Vn command, you can resize any of the 109 columns to customize the display to best fit your needs.

Price: $249 + $50 (for maintenance & support)


  • FI Directory The main page for the FI Directory from Windows with a short description about the product. [...]
  • Examples Several examples, including spreadsheets and reports, showing the results of different commands run through the command line. [...]
  • FI Tools ColumnsFile Investigator extracts many different types of information from files while performing the identification process. This is a list of the columns/fields of information available in the FI Tools applications.[...]
  • DownloadsFeel free to download any of the software titles listed here. All downloads act as Trial versions, by displaying a nag screen, until you purchase the Registration Key. [...]