Operating System Files
All versions of the Microsoft Windows operating system create folders on your computer hard drive into which are placed files that the operating system (OS) requires. These folders are most often identified by the names WINDOWS or WINNT. Primarily contained within these folders are binary program files called executables and dynamic link libraries, which have file extensions of the type .exe and .dll respectively. In addition the operating system also places in these folders any programs, help files, graphic files, and other files, which it deems necessary for proper operation. Unless very unusual circumstances are present, the files in these folders are not of import to the average user. The files within these folders are generally referred to as “system files”.
When a user installs programs (such as Microsoft Office, Adobe, etc), the operating system generally reserves the “Program Files” folder as the location for these items. It is the general convention that when a third party program (not Microsoft) is installed, it, and all its related files, help files, icons, etc. are placed in sub folders of the “Program Files” folder. Users do not routinely write data to these locations.
The pagefile.sys and name variants are a file that is maintained by the OS as “scratch” space. This is a very large file, usually at least as big as the available computer memory. It is disk file used by Windows for its virtual memory. A virtual memory system temporarily stores segments of the application on disk when there is not enough memory to hold all the programs called for. The OS uses this file to temporarily store information that it constantly swaps in and out of the computer memory, and CPU work area. Since the page file is constantly being altered, changed and updated, historic information is not likely to be located there. Some systems even wipe, or erase the contents of the page file when the system is shut down.
Executable Files:
Executable files are generally referred to as program files. They are files, which contain binary data that is not normally accessible or easily interpreted by the average user. These files are solely meant to be run as programs. Executable files category also contains dynamic link libraries (.dll) files and older .com files. Software manufacturers distribute executables and dll files as their software. These program files are generally found in the Windows or “Program Files” folders. Unless the subject of the inquiry is itself the executable program, or the subject is a programmer with technical knowledge of binary files, executable files are usually of no interest.
In addition to the binary files of the executable file category, there are also executable scripts. These scripts or batch files generally contain human readable text. The content of these scripts are commands, which will tell the computer to execute a program file to perform a task. Programmers or someone with sufficient technical knowledge to create useable processes generally only write these scripts.
Doc files:
The definition of a doc or document file can be as varied as there are users. Primarily the only clear file type that fits the doc category is one created by a word processor such as Word or Word Perfect. The file extensions are generally .doc, and are understood to be “documents”. Refinements, depending on the users point of view, to the definition of what a document file is can include any or all of the following.
- Files with the traditional .doc extension. These are those created with a word processor. They contain formatting instructions, meta data, and other data that is otherwise unreadable by the casual users. These files are often of a proprietary data format used by the program which created them. These .doc files are what the casual users considers “documents”
- files with a .txt extension. These are usually simple files containing only text, and do NOT contain any document formatting instructions, print instructions, or other meta data. Text files as these are called, are easily viewed with the notepad or similar program. The .txt files do not generally contain information written by the average user. These files are often found in program file folders as help, readme or instruction files.
- files with an htm or html extension. These are files which are viewable using an internet browser. Browsers use files of the htm format to display information in the browser window. Htm files contain text which provides the browser formatting instructions. These files are the “code” which is downloaded almost every time you view a web page. Many program manufacturers distribute their help files in htm (or pdf) format. Htm file content can be easily viewed with notepad type editors.
- any other file with content that is easily viewed using a notepad type editor. These files do not generally contain binary data which is difficult for the casual user to view.
Document type files can be located throughout folders on the hard drive. The .doc type files are most often located in the specific users assigned “documents and settings” or “my documents” folders, or on their desktop.
Spreadsheets:
Spreadsheets are the traditional spreadsheet files with a .xls extension. They can be created by any number of programs, but fit into this unique category.
PDF files:
Files of the .pdf file type, which are generally created and viewed with Adobe software. These files can also be created with a number of third party software programs, but all have a standard format and syntax.
What the Norcross Group will look for when searching the hard drive.
We will not search for any executable, .dll, help, script or batch files.
We will not search in any of the usually designated Windows or operating system folders.
If asked for “document” files, generally we will search the files ending in .doc (true word processor documents). We will not identify or extract files located in any of what we consider operating system folders. Which means the WINNT (Windows) or Program Files folders. Unless the situation specifically calls for it, we will not search for text files of the .txt, .bat, .ini files. We will not search for .hlp (standard help files), or .htm files.
Where we will search: Your guess is as good as mine.