{"id":14847,"date":"2019-12-30T00:00:00","date_gmt":"2019-12-30T00:00:00","guid":{"rendered":"https:\/\/adfsolutions.com\/identifying-files\/"},"modified":"2026-03-11T14:19:44","modified_gmt":"2026-03-11T14:19:44","slug":"identifying-files","status":"publish","type":"post","link":"https:\/\/adfsolutions.com\/identifying-files\/","title":{"rendered":"How ADF Tools Identify Files"},"content":{"rendered":"\n<p>When using ADF tools to collect files, either by File Properties, Hashes, or Keywords, ADF tools provide&nbsp; three methods for file identification:<\/p>\n<!--more-->\n<ul>\n<li><em>Fast Identification<\/em><\/li>\n<li><em>Thorough identification for files without extensions<\/em><\/li>\n<li><em>Thorough identification for all files<\/em><\/li>\n<\/ul>\n<p>When creating your own File Capture it is important to know what each option will work for you.&nbsp;<\/p>\n<p><em>Fast Identification<\/em> identifies files by file extension only and is the fastest method by which we identify files.&nbsp;File extensions are the characters following the file name and . (dot). Those file extensions may look like the examples below:&nbsp;<\/p>\n<ul>\n<li>Dog Picture.jpg<\/li>\n<li>Dog Article.doc<\/li>\n<li>Dog Article.docx<\/li>\n<\/ul>\n<p>This method will not identify files without file extensions or that have the wrong file extension.<\/p>\n<p>Sometimes files do not have file extensions. This can happen with internet cache files, or apps that specifically do not save files with an extension (to prevent user interaction outside of the application). In this case we rely on the file signature, also called the file header or magic number. A <i>file signature<\/i> is a unique sequence of identifying bytes written to a file&#8217;s header. On a Windows system, a file signature is normally contained within the first 20 bytes of the file.<\/p>\n<p>When we look at a file, for example, a JPG image file, the device has interpreted it to be an image file by the file extension and displays the image to you. But if we remove the file extension JPG, how does the device know what type of file it is and what to display? The device will revert to the file header and read the first few bytes and describe prior data. These first bytes are specific to the file type.&nbsp;<\/p>\n{% video_player &#8220;embed_player&#8221; overrideable=False, type=&#8217;scriptV4&#8242;, hide_playlist=True, viral_sharing=False, embed_button=False, autoplay=False, hidden_controls=False, loop=False, muted=False, full_width=False, width=&#8217;1914&#8242;, height=&#8217;1240&#8242;, player_id=&#8217;23913318634&#8242;, style=&#8217;margin: 10px auto;&#8217; %}\n<p>The next method for identifying files is <em>thorough identification for files without extensions<\/em>. We will identify all files by file extension. However, if a file does not have a file extension, we will look at the file header for that specific file and identify it. This allows us to retain the speed of identifying files quickly to get more data, such as cache files and files specifically created without extensions. This is also referred to as &#8220;speed optimized&#8221;. Any Search Profile labeled as &#8220;speed optimized&#8221; has this identification method selected.<\/p>\n<p>Our third option is <em>thorough identification for all files<\/em>. This method exclusively looks at the file header of each and every file and determines what type of file it is, regardless of the file extension. This is a longer process; however, it will give you mismatched files, or files where the files extension does not match the file header. An example is shown here where all of the image files have the wrong file extension, and are recorded as such in the file properties.<\/p>\n<p>To summarize,&nbsp;<em>fast identification&nbsp;<\/em>is for file extensions only- we think of this as the fastest, where you can get to the low-hanging fruit.&nbsp;<em>Thorough file identification for files without extensions&nbsp;<\/em>is &#8220;speed optimized&#8221; and focuses on the file extension first, if there is no file extension file header. Finally,&nbsp;<em>thorough file identification for all files&nbsp;<\/em>is the most comprehensive option which allow for search of mismatched files and file header analysis only.&nbsp;<\/p>\n<p><a class=\"optech-default-btn btn-style cta_button\" href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/4330725\/f549031b-03c9-4f8b-b422-f167ab031f60\" target=\"_blank\" data-text=\"How to Add Custom File Types to Search Profiles\"><span class=\"btn-wraper\">How to Add Custom File Types to Search Profiles<\/span><\/a><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When using ADF tools to collect files, either by File Properties, Hashes, or Keywords, ADF tools provide&nbsp; three methods for file identification:<\/p>\n","protected":false},"author":3,"featured_media":13210,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[63,283],"tags":[95,119,36,74,33,97,87,99,141,35,142,143],"class_list":["post-14847","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","category-video","tag-computer-forensics","tag-cyber-forensics","tag-digital-evidence","tag-digital-evidence-investigator","tag-digital-forensics","tag-forensic-analysis","tag-forensic-software","tag-how-to-video","tag-knowledge-base-video","tag-mobile-device-investigator","tag-triage-g2","tag-triage-investigator","optech-blog blog-single"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How ADF Tools Identify Files - ADF Solutions<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/adfsolutions.com\/identifying-files\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How ADF Tools Identify Files - ADF Solutions\" \/>\n<meta property=\"og:description\" content=\"When using ADF tools to collect files, either by File Properties, Hashes, or Keywords, ADF tools provide&nbsp; three methods for file identification:\" \/>\n<meta property=\"og:url\" content=\"https:\/\/adfsolutions.com\/identifying-files\/\" \/>\n<meta property=\"og:site_name\" content=\"ADF Solutions\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/adfsolutions\" \/>\n<meta property=\"article:published_time\" content=\"2019-12-30T00:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-11T14:19:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Identifying-Files-Using-ADF-Tools-Featured-Image-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1080\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Richard T. Frawley\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@adfsolutions\" \/>\n<meta name=\"twitter:site\" content=\"@adfsolutions\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Richard T. Frawley\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/adfsolutions.com\/identifying-files\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/adfsolutions.com\/identifying-files\/\"},\"author\":{\"name\":\"Richard T. Frawley\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39\"},\"headline\":\"How ADF Tools Identify Files\",\"datePublished\":\"2019-12-30T00:00:00+00:00\",\"dateModified\":\"2026-03-11T14:19:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/adfsolutions.com\/identifying-files\/\"},\"wordCount\":592,\"publisher\":{\"@id\":\"https:\/\/adfsolutions.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/identifying-files\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Identifying-Files-Using-ADF-Tools-Featured-Image-1.png\",\"keywords\":[\"Computer Forensics\",\"Cyber Forensics\",\"Digital Evidence\",\"Digital Evidence Investigator\",\"Digital Forensics\",\"Forensic Analysis\",\"Forensic Software\",\"How To Video\",\"Knowledge Base Video\",\"Mobile Device Investigator\",\"Triage-G2\",\"Triage-Investigator\"],\"articleSection\":[\"News\",\"Video\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/adfsolutions.com\/identifying-files\/\",\"url\":\"https:\/\/adfsolutions.com\/identifying-files\/\",\"name\":\"How ADF Tools Identify Files - ADF Solutions\",\"isPartOf\":{\"@id\":\"https:\/\/adfsolutions.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/adfsolutions.com\/identifying-files\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/identifying-files\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Identifying-Files-Using-ADF-Tools-Featured-Image-1.png\",\"datePublished\":\"2019-12-30T00:00:00+00:00\",\"dateModified\":\"2026-03-11T14:19:44+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/adfsolutions.com\/identifying-files\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/adfsolutions.com\/identifying-files\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/adfsolutions.com\/identifying-files\/#primaryimage\",\"url\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Identifying-Files-Using-ADF-Tools-Featured-Image-1.png\",\"contentUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Identifying-Files-Using-ADF-Tools-Featured-Image-1.png\",\"width\":1920,\"height\":1080},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/adfsolutions.com\/identifying-files\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/adfsolutions.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How ADF Tools Identify Files\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/adfsolutions.com\/#website\",\"url\":\"https:\/\/adfsolutions.com\/\",\"name\":\"ADF Solutions\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/adfsolutions.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/adfsolutions.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/adfsolutions.com\/#organization\",\"name\":\"ADF Solutions\",\"url\":\"https:\/\/adfsolutions.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png\",\"contentUrl\":\"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png\",\"width\":512,\"height\":512,\"caption\":\"ADF Solutions\"},\"image\":{\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/adfsolutions\",\"https:\/\/x.com\/adfsolutions\",\"https:\/\/www.linkedin.com\/company\/adf-solutions\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39\",\"name\":\"Richard T. Frawley\",\"url\":\"https:\/\/adfsolutions.com\/author\/richardtfrawley\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How ADF Tools Identify Files - ADF Solutions","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/adfsolutions.com\/identifying-files\/","og_locale":"en_US","og_type":"article","og_title":"How ADF Tools Identify Files - ADF Solutions","og_description":"When using ADF tools to collect files, either by File Properties, Hashes, or Keywords, ADF tools provide&nbsp; three methods for file identification:","og_url":"https:\/\/adfsolutions.com\/identifying-files\/","og_site_name":"ADF Solutions","article_publisher":"https:\/\/www.facebook.com\/adfsolutions","article_published_time":"2019-12-30T00:00:00+00:00","article_modified_time":"2026-03-11T14:19:44+00:00","og_image":[{"width":1920,"height":1080,"url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Identifying-Files-Using-ADF-Tools-Featured-Image-1.png","type":"image\/png"}],"author":"Richard T. Frawley","twitter_card":"summary_large_image","twitter_creator":"@adfsolutions","twitter_site":"@adfsolutions","twitter_misc":{"Written by":"Richard T. Frawley","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/adfsolutions.com\/identifying-files\/#article","isPartOf":{"@id":"https:\/\/adfsolutions.com\/identifying-files\/"},"author":{"name":"Richard T. Frawley","@id":"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39"},"headline":"How ADF Tools Identify Files","datePublished":"2019-12-30T00:00:00+00:00","dateModified":"2026-03-11T14:19:44+00:00","mainEntityOfPage":{"@id":"https:\/\/adfsolutions.com\/identifying-files\/"},"wordCount":592,"publisher":{"@id":"https:\/\/adfsolutions.com\/#organization"},"image":{"@id":"https:\/\/adfsolutions.com\/identifying-files\/#primaryimage"},"thumbnailUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Identifying-Files-Using-ADF-Tools-Featured-Image-1.png","keywords":["Computer Forensics","Cyber Forensics","Digital Evidence","Digital Evidence Investigator","Digital Forensics","Forensic Analysis","Forensic Software","How To Video","Knowledge Base Video","Mobile Device Investigator","Triage-G2","Triage-Investigator"],"articleSection":["News","Video"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/adfsolutions.com\/identifying-files\/","url":"https:\/\/adfsolutions.com\/identifying-files\/","name":"How ADF Tools Identify Files - ADF Solutions","isPartOf":{"@id":"https:\/\/adfsolutions.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/adfsolutions.com\/identifying-files\/#primaryimage"},"image":{"@id":"https:\/\/adfsolutions.com\/identifying-files\/#primaryimage"},"thumbnailUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Identifying-Files-Using-ADF-Tools-Featured-Image-1.png","datePublished":"2019-12-30T00:00:00+00:00","dateModified":"2026-03-11T14:19:44+00:00","breadcrumb":{"@id":"https:\/\/adfsolutions.com\/identifying-files\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/adfsolutions.com\/identifying-files\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adfsolutions.com\/identifying-files\/#primaryimage","url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Identifying-Files-Using-ADF-Tools-Featured-Image-1.png","contentUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/Identifying-Files-Using-ADF-Tools-Featured-Image-1.png","width":1920,"height":1080},{"@type":"BreadcrumbList","@id":"https:\/\/adfsolutions.com\/identifying-files\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/adfsolutions.com\/"},{"@type":"ListItem","position":2,"name":"How ADF Tools Identify Files"}]},{"@type":"WebSite","@id":"https:\/\/adfsolutions.com\/#website","url":"https:\/\/adfsolutions.com\/","name":"ADF Solutions","description":"","publisher":{"@id":"https:\/\/adfsolutions.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/adfsolutions.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/adfsolutions.com\/#organization","name":"ADF Solutions","url":"https:\/\/adfsolutions.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/","url":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png","contentUrl":"https:\/\/adfsolutions.com\/wp-content\/uploads\/2026\/01\/favicon.png","width":512,"height":512,"caption":"ADF Solutions"},"image":{"@id":"https:\/\/adfsolutions.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/adfsolutions","https:\/\/x.com\/adfsolutions","https:\/\/www.linkedin.com\/company\/adf-solutions\/"]},{"@type":"Person","@id":"https:\/\/adfsolutions.com\/#\/schema\/person\/f7fc6bb598702f2c7fd213ae40c2ac39","name":"Richard T. Frawley","url":"https:\/\/adfsolutions.com\/author\/richardtfrawley\/"}]}},"_links":{"self":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/14847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/comments?post=14847"}],"version-history":[{"count":2,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/14847\/revisions"}],"predecessor-version":[{"id":16716,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/posts\/14847\/revisions\/16716"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/media\/13210"}],"wp:attachment":[{"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/media?parent=14847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/categories?post=14847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adfsolutions.com\/wp-json\/wp\/v2\/tags?post=14847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}