FileList Pro

File Timeline & Disk Inventory Tool

FileList Pro is an upgrade to NTI's popular FileList software and the upgrade includes:

1. Windows NT/XP compatibility
2. SafeBack 2.x and 3.0 compatibility
3. SHA160, SHA256, SHA384 and SHA512 hashing features

If you acquired your copy of FileList within the last year, you will be upgraded free of charge. This powerful tool is also made available free of charge to our law enforcement clients. Click here for information about the law enforcement software donation by NTI.

FileList Pro is a unique computer forensic utility that is used to quickly inventory a computer storage device and to document information about both "deleted" files and allocated files. It is used to quickly process any Microsoft-based file system and it is portable so that it can either be used in the field or in a formal computer forensics laboratory setting. Because the program footprint is small, the program can be operated from a floppy diskette. In most cases the program output will fit on the same floppy diskette. Therefore bulky and complicated hardware is not required to take a "snapshot" of the files stored on one or more computer systems in the field. This can be done from portable floppy diskettes (or USB memory devices) which are small and easily carried in a pocket or briefcase.

This multi-purpose computer forensics utility was designed for covert law enforcement and military uses, security reviews and laboratory computer evidence processing. It leaves no trace that it has been used and the output is compressed so that it will usually fit on a single floppy diskette or a USB memory device. The upgraded FileList Pro is compatible with DOS, Windows, Windows 95, Windows 98, Windows NT, Windows 2000 and Windows XP. It can also be used to inventory all files contained within a bit stream backup file created with SafeBack which is NTI's evidence grade bit stream backup software. This can be done without restoring the bit stream backup.

FileList is ideal for covert reviews of computers for law enforcement and military operations and/or corporate internal investigations. The compressed program output is automatically converted into a dBASE III Plus file format by a companion program named FileConvert Pro which is provided free of charge to licensed users of FileList Pro. The dBASE III Plus file format is an industry standard that will import into most commercial spreadsheet and database applications for easy analysis and sorting.

FileList Pro, used as a stand alone tool, is ideal for internal audits, security reviews and investigations where times and dates, associated with computer files, are relevant. Computers are often used as tools by criminals in the commission of crimes. They are also used in unauthorized activities in the workplace. The dates and times that computer files were created, modified and accessed can be relevant in almost any computer-related investigation. Furthermore, time lines of computer usage can provide valuable information about the computer user and the sequence of events tied to the operation of the computer or the operation and uses of multiple computers in a conspiracy case.

FileList Pro is the perfect tool for the creation of timelines of computer usage and an inventory of deleted and normal files. It does this quickly and without making any modifications to computer evidence. The original FileList program and its uses are described in Computer Forensics, Incident Response Essentials by Warren G. Kruse II and Jay G. Heiser, Cybersecurity Operations Handbook by Dr. John W. Rittinghouse and Dr. William M. Hancock and Cyber Crime Investigator's Field Guide by Bruce Middleton.

FileList Pro - Primary Uses:

• Used to inventory normal and deleted files on a hard disk drives, floppy diskettes and most forms of removable media.


• Used to inventory the normal and deleted files from a SafeBack bit stream backup file (either SafeBack 2.x or SafeBack 3.0) without restoring the bit stream backup image.


• Its function ties perfectly to NTI's DiskSig Pro software which can be used to inventory all of the partitions and operating systems on a targeted hard disk drive.


• Used to compare the contents of all files on one or more computer systems using mathematical hashes in the comparison process. This is helpful in cases involving the renaming of stolen files in theft of trade secret cases. NTI's consulting division has used this program, and its hashing capabilities, with great success in civil litigation cases involving the theft of trade secrets.


• Used in investigations to provide a timeline of file dates and/or file times on a targeted computer system or multiple computers involved in the same case.


• Used in investigations to track a timeline of activity based on file access dates. In some cases it is helpful to know when files were last read or accessed.


• Used in investigations to track a timeline of activity based on file creation dates. In some cases it is helpful to know when specific files were created or the sequence of drafts leading to the creation of a final document.


• Used in investigations to track a timeline of activity based on file modification dates. In some cases, e.g., fraud cases, it is helpful to know when relevant files were modified, updated or backdated.


• Used in investigations to track a timeline of activity based on files that were deleted by the computer user. This is helpful in cases when willful attempts were made to destroy key evidence stored in computer files.


• Identifies computer activities and timelines based on computer usage on weekends and outside of normal working hours. This is helpful in corporate cases involving employees who use computing resources inappropriately.

FileList Pro - Program Features and Benefits:

• DOS based for speed


• No Software Dongle! - We know that software dongles get in the way and they restrict your ability to process several computers at the same time. This is why NTI does not use software dongles and our licensing of this software allows you to process multiple computers at the same time. NTI's goal is to make your life easier and this software was designed with ease of use in mind.


• Automatically interacts with SafeBack bit stream backup files (created with either SafeBack 2.x or SafeBack 3.0). This means that bit stream backups do not need to be restored before an inventory of the normal and deleted files can be made.


• The compact program fits on a single DOS system formatted floppy diskette for ease of portability and operation in the field.


• The program can be operated automatically in batch mode on a system formatted floppy diskette or it can be operated in batch mode with other forensics utilities. This is very helpful in a computer forensics laboratory setting when several computers are processed at the same time.


• FileList Pro can be copied to multiple floppy diskettes (or USB devices) and several computers can be processed at the same time with one licensed copy of the program.


• FileList Pro has the capability to create several different mathematical hashes of file content at the option of the user. The hashing options are, CRC 32, MD5, SHA160, SHA256, SHA384 and SHA512. FileList Pro's hashing capabilities are state-of-the-art and we are unaware of any competing programs that provide all of these hashing options.


• The program captures drive, path, file names, times, dates and day of week in a compressed format. Thus, the output typically fits on one or, in some cases, two floppy diskettes. This feature is helpful in covert government and law enforcement operations when the contents of one or more computers need to be determined quickly.


• FileList Pro does not modify or alter any data on the targeted computer system or storage media. Therefore, no trace of the operation is left behind. This feature is helpful in covert law enforcement and military operations.


• The program is used to process DOS, Windows, Windows 95, Windows 98, Windows NT, Windows 2000 and Windows XP-based computer systems.


• The output is easily converted into a dBASE III Plus file format with NTI's FileConvert Pro which is provided free of charge to licensed users of FileList Pro. DBase III Plus files are compabitle with all popular spreadsheet and database applications.

The current release is Version 3.0 and the GSA Product Number is FL3.0.
U. S. Government clients should click here for information about GSA purchases.