{"id":1353,"date":"2013-05-20T21:07:19","date_gmt":"2013-05-20T21:07:19","guid":{"rendered":"http:\/\/help.cleverfiles.com\/?p=1353"},"modified":"2025-10-27T12:34:03","modified_gmt":"2025-10-27T12:34:03","slug":"forensic","status":"publish","type":"post","link":"https:\/\/www.cleverfiles.com\/help\/forensic\/","title":{"rendered":"How Can I Export Forensic Data (DFXML)?"},"content":{"rendered":"

Disk Drill is a data recovery tool<\/a> with only one “forensics” feature so far: it returns the layout information for recovered files in a machine-readable format for further processing (CSV, SQLite database or DFXML<\/a>). This allows for their forensic analysis for the purposes of identifying, preserving and retrieving sensitive data. DFXML export is available for hard drives, SSD, memory cards and other media storage devices that can be accessed directly. It’s not available for iOS<\/a> as there’s no direct access to the data storage layer.<\/p>\n

To take advantage of this feature, you must have the Enterprise Edition<\/a> of Disk Drill (or Expert if available at that time). This version can be purchased from the CleverFiles website<\/a>. If you already have the PRO version, contact us<\/a> about upgrading to Enterprise.<\/p>\n

\r\n<\/i>\r\nDownload Disk Drill data recovery app\r\nDownload now<\/a>\r\n
<\/div>\r\n<\/div>

\n

How to Export Forensic Data<\/b><\/h2>\n
\n 💡 Please note<\/b>: Export Forensic Data is available in Disk Drill for macOS only.\n<\/div>\n
    \n
  1. Launch Disk Drill and perform a scan of the volume in question, as directed in our How to Recover Lost Files with Disk Drill PRO<\/a> tutorial.<\/li>\n
  2. Once the scan is complete, select File > Export Forensic Data<\/b> from the top menu bar.\"forensic<\/li>\n
  3. When the Save window pops up, select the location you wish to save the file to (do not save it to the disk you just scanned or you risk data loss), select the file format (the default is XML, but you also have the option of saving as a DB (sqlite) or CSV format as well), and then click Save<\/b>.\"forensic<\/li>\n
  4. You can then import the forensic data file into the program of your choice for further analysis.<\/li>\n<\/ol>\n

    Samples<\/b><\/p>\n

    The exported DFXML file (in XML format) will have the following format: XML sample #1<\/a>, and XML sample #2<\/a>.<\/p>\n

    If you choose DB (sqlite) as your export format, the database will consist of two tables, which are the SQL-representations for\u00a0Digital Forensic XML. The structure of the tables looks like this:<\/p>\n

    create table fileobject(\r\n    fileid integer primary key,\r\n    filename text,\r\n    family text,\r\n    filesize integer,\r\n    mtime integer\r\n);\r\n\r\ncreate table run(\r\n    fileid integer references fileobject(fileid),\r\n    file_offset integer,\r\n    img_offset integer,\r\n    len integer\r\n);\r\n<\/pre>\n
    Here are two samples of the CSV files\u00a0generated by\u00a0Disk Drill: CSV sample #1<\/a>, and CSV sample #2<\/a>. If you export forensic data into CSV, the data fields will be\u00a0stored in this sequence:<\/p>\n
    filename, family, filesize, mtime, file_offset1, img_offset1, len1, \u2026,\r\nfile_offset8, img_offset8, len8\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
    Disk Drill is a data recovery tool with only one “forensics” feature so far: it returns the layout information for recovered files in a machine-readable format for further processing (CSV, SQLite database or DFXML). This allows for their forensic analysis […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,6],"tags":[],"class_list":{"0":"post-1353","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-recovery","7":"category-extras"},"acf":[],"yoast_head":"\nHow Can I Export Forensic Data (DFXML)?<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cleverfiles.com\/help\/forensic\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How Can I Export Forensic Data (DFXML)?\" \/>\n<meta property=\"og:description\" content=\"Disk Drill is a data recovery tool with only one “forensics” feature so far: it returns the layout information for recovered files in a machine-readable format for further processing (CSV, SQLite database or DFXML). This allows for their forensic analysis […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cleverfiles.com\/help\/forensic\/\" \/>\n<meta property=\"og:site_name\" content=\"Mac Data Recovery\" \/>\n<meta property=\"article:published_time\" content=\"2013-05-20T21:07:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-27T12:34:03+00:00\" \/>\n<meta name=\"author\" content=\"CleverFiles Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Cleverfiles\" \/>\n<meta name=\"twitter:site\" content=\"@Cleverfiles\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"CleverFiles Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.cleverfiles.com\/help\/forensic\/\",\"url\":\"https:\/\/www.cleverfiles.com\/help\/forensic\/\",\"name\":\"How Can I Export Forensic Data (DFXML)?\",\"isPartOf\":{\"@id\":\"https:\/\/www.cleverfiles.com\/help\/#website\"},\"datePublished\":\"2013-05-20T21:07:19+00:00\",\"dateModified\":\"2025-10-27T12:34:03+00:00\",\"author\":{\"@id\":\"https:\/\/www.cleverfiles.com\/help\/#\/schema\/person\/3a87553dc95c810c60a9592a062d4c40\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.cleverfiles.com\/help\/forensic\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.cleverfiles.com\/help\/#website\",\"url\":\"https:\/\/www.cleverfiles.com\/help\/\",\"name\":\"Mac Data Recovery\",\"description\":\"Disk Drill, advanced data recovery app for macOS and Windows\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.cleverfiles.com\/help\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.cleverfiles.com\/help\/#\/schema\/person\/3a87553dc95c810c60a9592a062d4c40\",\"name\":\"CleverFiles Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.cleverfiles.com\/help\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2e7ffe17fc516de4f17d555861c5abc9d6c4bb9491c6672e08b1dbca4c63b878?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2e7ffe17fc516de4f17d555861c5abc9d6c4bb9491c6672e08b1dbca4c63b878?s=96&d=mm&r=g\",\"caption\":\"CleverFiles Team\"},\"url\":\"\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How Can I Export Forensic Data (DFXML)?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cleverfiles.com\/help\/forensic\/","og_locale":"en_US","og_type":"article","og_title":"How Can I Export Forensic Data (DFXML)?","og_description":"Disk Drill is a data recovery tool with only one “forensics” feature so far: it returns the layout information for recovered files in a machine-readable format for further processing (CSV, SQLite database or DFXML). This allows for their forensic analysis […]","og_url":"https:\/\/www.cleverfiles.com\/help\/forensic\/","og_site_name":"Mac Data Recovery","article_published_time":"2013-05-20T21:07:19+00:00","article_modified_time":"2025-10-27T12:34:03+00:00","author":"CleverFiles Team","twitter_card":"summary_large_image","twitter_creator":"@Cleverfiles","twitter_site":"@Cleverfiles","twitter_misc":{"Written by":"CleverFiles Team","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.cleverfiles.com\/help\/forensic\/","url":"https:\/\/www.cleverfiles.com\/help\/forensic\/","name":"How Can I Export Forensic Data (DFXML)?","isPartOf":{"@id":"https:\/\/www.cleverfiles.com\/help\/#website"},"datePublished":"2013-05-20T21:07:19+00:00","dateModified":"2025-10-27T12:34:03+00:00","author":{"@id":"https:\/\/www.cleverfiles.com\/help\/#\/schema\/person\/3a87553dc95c810c60a9592a062d4c40"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cleverfiles.com\/help\/forensic\/"]}]},{"@type":"WebSite","@id":"https:\/\/www.cleverfiles.com\/help\/#website","url":"https:\/\/www.cleverfiles.com\/help\/","name":"Mac Data Recovery","description":"Disk Drill, advanced data recovery app for macOS and Windows","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cleverfiles.com\/help\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.cleverfiles.com\/help\/#\/schema\/person\/3a87553dc95c810c60a9592a062d4c40","name":"CleverFiles Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cleverfiles.com\/help\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/2e7ffe17fc516de4f17d555861c5abc9d6c4bb9491c6672e08b1dbca4c63b878?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2e7ffe17fc516de4f17d555861c5abc9d6c4bb9491c6672e08b1dbca4c63b878?s=96&d=mm&r=g","caption":"CleverFiles Team"},"url":""}]}},"modified_by":"Jeff Cochin","_links":{"self":[{"href":"https:\/\/www.cleverfiles.com\/help\/wp-json\/wp\/v2\/posts\/1353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cleverfiles.com\/help\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cleverfiles.com\/help\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cleverfiles.com\/help\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cleverfiles.com\/help\/wp-json\/wp\/v2\/comments?post=1353"}],"version-history":[{"count":6,"href":"https:\/\/www.cleverfiles.com\/help\/wp-json\/wp\/v2\/posts\/1353\/revisions"}],"predecessor-version":[{"id":19335,"href":"https:\/\/www.cleverfiles.com\/help\/wp-json\/wp\/v2\/posts\/1353\/revisions\/19335"}],"wp:attachment":[{"href":"https:\/\/www.cleverfiles.com\/help\/wp-json\/wp\/v2\/media?parent=1353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cleverfiles.com\/help\/wp-json\/wp\/v2\/categories?post=1353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cleverfiles.com\/help\/wp-json\/wp\/v2\/tags?post=1353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}