Opening the extracted files in UFED Physical Analyzer

Step 1:

Find for the ufd file you extracted from the target device and double click it

Step 2:

Click next to progress the opening of the case

Step 3:

If you have a hash-set of commonly used applications or files, you can use it to compare with the files that already exists in the device’s extracted information and if it is a known safe file, such as operating system files or common application files, it can be eliminated from further analysis, if it is known contraband files, it can be quickly identified and bookmarked.

Data carving - is the checking of the file header of the deleted files to check for known file formats and to retrieve them

Which are both methods of analyzing the file signature