Chapter 25: Generalized Editors and Viewers

---

Overview

Choosing appropriate editors and viewers is the fundamental basis of all successful forensic analysis. Without the means to view suspicious files properly, an investigator could come to an incorrect conclusion. For example, imagine an analyst who depends on an image viewer to provide the proper results for a file named image.tiff. If the file image.tiff is actually an MP3 music file, it will not be displayed correctly in a viewer designed specifically for images. Therefore, a more generic viewer must be utilized. Lucky for the analyst, such generic viewers are available.

This chapter is dedicated to the editors and viewers used during a typical forensic analysis. These viewers are defined as generic in the sense that they support many different file types. Some of the viewers presented will even support an unlimited number of file formats. Moreover, even though “editing” is not typically performed during an investigation, this chapter will illustrate that editors, too, can add powerful features to the analyst’s tool kit.

---