.nli Forensic image file

Posted by: @mat-charb

I have a forensic image with an extension ‘.nli’

As per the associate log file, .nli file is a logical forensic image created using Nuix forensic software.

Is .nli extension nuix proprietary image format?

Does anyone know how to convert it to Raw/E01?

Thank you in advance

Yes and no, meaning that yes, it is a proprietary format, but no it is not AFAIK really-really a "forensic image" i.e. it is not "corresponding" to an .E01 or .dd/RAW. (BTW both these format are physical, NOT logical images)

Seemingly this .nli format beside being proprietary is not even a "logical" image of a fileystem (i.e. something corresponding to an Encase LEF/.L01) but rather essentially a "container" to which selected items can be saved to.

jaclaz

@jaclaz

Thanks for the reply.

Can I mount or open the same using any other tool as I don't have nuix with me?  

Posted by: @mat-charb

@jaclaz

Thanks for the reply.

Can I mount or open the same using any other tool as I don't have nuix with me?  

 

I don't think so.

The good Nuix guys seem like being the "fight club".

My guess is that people that are part of the club just use that format from within Nuix, all the rest ignore it.

Still, as said, I doubt that the contents of such a file are actually "relevant" or "useful" outside Nuix in the sense that from the little I know they are more like a "report" than anything else.

jaclaz