.nli Forensic image...
 
Notifications
Clear all

.nli Forensic image file  

  RSS
Mat Charb
(@mat-charb)
New Member

I have a forensic image with an extension ‘.nli’

As per the associate log file, .nli file is a logical forensic image created using Nuix forensic software.

Is .nli extension nuix proprietary image format?

Does anyone know how to convert it to Raw/E01?

Thank you in advance

Quote
Posted : 24/08/2020 2:41 pm
jaclaz
(@jaclaz)
Community Legend
Posted by: @mat-charb

I have a forensic image with an extension ‘.nli’

As per the associate log file, .nli file is a logical forensic image created using Nuix forensic software.

Is .nli extension nuix proprietary image format?

Does anyone know how to convert it to Raw/E01?

Thank you in advance

Yes and no, meaning that yes, it is a proprietary format, but no it is not AFAIK really-really a "forensic image" i.e. it is not "corresponding" to an .E01 or .dd/RAW. (BTW both these format are physical, NOT logical images)

Seemingly this .nli format beside being proprietary is not even a "logical" image of a fileystem (i.e. something corresponding to an Encase LEF/.L01) but rather essentially a "container" to which selected items can be saved to.

jaclaz

ReplyQuote
Posted : 24/08/2020 6:41 pm
Mat Charb
(@mat-charb)
New Member

@jaclaz

Thanks for the reply.

Can I mount or open the same using any other tool as I don't have nuix with me?  

 

ReplyQuote
Posted : 25/08/2020 5:43 am
jaclaz
(@jaclaz)
Community Legend
Posted by: @mat-charb

@jaclaz

Thanks for the reply.

Can I mount or open the same using any other tool as I don't have nuix with me?  

 

I don't think so.

The good Nuix guys seem like being the "fight club".

My guess is that people that are part of the club just use that format from within Nuix, all the rest ignore it.

Still, as said, I doubt that the contents of such a file are actually "relevant" or "useful" outside Nuix in the sense that from the little I know they are more like a "report" than anything else.

jaclaz

 

 

ReplyQuote
Posted : 25/08/2020 10:44 am
Share: