IX. Processing unknown files

  1. Select "File Category" -> "Unknown Files" to see a list of potentially useful files which FTK was not able to categorize.


  2. Select on of the files. By default, the viewer window on the upper right will use the "Default" view tab. Chances are that it will show a text in red indicating an error.       

  3. Try the "Natural," "Text," and if you are brave, the "Hex" views to see if there is any relevant content in the files. Chances are that you will be able to find something useful in either "Natural" or "Text."         

    While sometimes the list of unknown files can appear to be rather extensive, you will soon realize that there are usually clear patterns which will allow you to quickly dismiss certain files.

  4. To add useful files found to their corresponding category, right click select "Re-Assign File Category" (It is the second to last option at the bottom of the menu), and select the new file category. E.g. Documents - > Other Documents -> Text

Copyright © 2024 The President and Fellows of Harvard College * Accessibility * Support * Request Access * Terms of Use