Key Benefits

    • 4,797 file types supported

    • Familiar Windows File Find and DOS DIR User Interfaces

    • 109 Columns of File Details for Each File

    • Provides Outside In and PRONOM cross reference values

    • Can Wipe files using four different methods, to keep deleted data from being recovered

    • Supports MS Windows NT/200x/XP/Vista/7/8

    • Calculates hash codes, including MD4, MD5, SHA-1, SHA-256, SHA-384 & SHA-512

    • Finds Files with Floating Headers

    • Corrects Wrong File Extensions

    • Identifies File Types by their Content, even when they are Locked/DenyRead

    • Renames Files using their Metadata and File Type (FI Directory)

    • Detects Encrypted Files, including TrueCrypt

    • Displays all NTFS Alternate Data Streams & Security File Usernames

    • Displays metadata extracted from many of the supported file types*

* Forensic Innovations does not guarantee that all of a file's metadata is extracted.

FI File Find Features

Reliable, fast, and accurate computer forensic tools.
The Name & Location tab provides you with the usual Name filespec (ex: *.doc), as well as the drive and folder location to Look in. The screen shot on the left (click the image to enlarge) shows three of the 109 different columns of information available. The Description column indicates what type each file is. This type goes far beyond the file extension match provided from the MS Windows Registry. File Investigator analyzes the contents of every file and definitively identifies the file type. Even when none of your installed applications can recognize a file, File Investigator File Find still identifies it. The third column, in this example, provides some useful metadata for many file types. You can see image resolutions, color depths, sound sampling rates, compression codecs, etc. The Preview window (bottom pane) is displaying one of the files in hexadecimal.

The Content tab provides the ability to filter your search results by File Type, Platform/OS, Storage Method, Content Type and Accuracy level that File Investigator is able to achieve on each file. Checking the 'Has wrong file extension' box filters out all files with a file extension known to belong to their file type. The screen shot on the left (click the image to enlarge) shows the same three columns used previously, but now it only includes files that are known to include Video content. The Preview window now displays the highlighted MS Audio/Visual Interleave file as a playable movie. The video previewer uses the MS Multimedia Player to play the multimedia files that codecs have been installed for.

The Date Modified tab can be used to filter your search by a range of Created and Modified dates. The screen shot on the left (click the image to enlarge) shows five new columns. Valid MIME Label(s) lists the type values typically used to describe each attachment file type in email communications. The Text Metadata Summary is displaying text strings extracted from the files. These strings are organized by the type of information they are providing. The fourth column provides categories by the type of Content typically found in each file type. As you can see from the Scan Time column (displayed in seconds) each file only requires a fraction of a second to be analyzed. The SHA-1 column provides a hash value for each file. The Preview window is using the Text Previewer to display all of the text strings found in the highlighted file.

The Text & Attributes tab filters your search with a text string, by file size and file attributes. The NTFS ADS (Alternate Data Streams) filter is a recent addition that can either filter out the hidden streams or filter out everything but the streams. These streams are files that hide behind regular files. Unless you use a utility designed to see them, you don't know they are there, but they can contain malicious content. The Preview window is using the Details Previewer to display all of the information that File Investigator extracts from the selected file. This view is useful when you need more information that isn't in one of the columns that you selected to display (using the Options Dialog below). The Background section can provide links to applications for viewing, editing and converting the selected file as well as programmer references.

Price: $249 + $50 (for maintenance & support)


  • FI File Find The main page for the FI File Find for Windows with a short description about the product. [...]
  • Menus A description of the more complicated menu items with screenshots of the self explanatory menu items. [...]
  • Options DialogFI File Find for Windows has an advanced listing of options to provide flexibility in selecting the identification stages, hash codes and checksums calculated, and user interface. [...]
  • DownloadsFeel free to download any of the software titles listed here. All downloads act as Trial versions, by displaying a nag screen, until you purchase the Registration Key. [...]