System

Files that belong to the computer itself rather than to a document: whole disks and floppy disks copied into one file, keys and certificates, recordings of network traffic, shortcuts, settings and the logs an operating system keeps.

Groups

Disk & VM images

A whole disc or hard disk in one file, for burning, mounting or running a virtual machine.

3 formats

Floppy & tape images

Copies of floppy disks and tapes from older computers, used by emulators.

2 formats

Keys & certificates

Cryptographic keys and the certificates that vouch for them.

1 format

Network captures

Recordings of network traffic, one packet at a time, with the time each was seen.

1 format

Shortcuts & settings

Links to other files and the stored settings of programs and the system.

2 formats

Logs

Records of events kept by the operating system and its services.

1 format

All system formats

Format	Name	About
Disk & VM images
`.ISO`	ISO 9660 disc image	A CD, DVD or Blu-ray copied sector by sector into one file.
`.QCOW2`	QEMU copy-on-write disk image	QEMU’s growable virtual disk with snapshots and backing files.
`.VHD`	Virtual Hard Disk	Microsoft’s virtual machine disk: raw or dynamic data with a 512-byte footer.
Floppy & tape images
`.ADF`	Amiga Disk File	An Amiga floppy disk, every 512-byte sector in order.
`.D64`	Commodore 64 disk image	A Commodore 1541 floppy disk: 683 sectors of 256 bytes, in track order.
Keys & certificates
`.PEM`	Privacy-Enhanced Mail encoding	Keys and certificates as base64 text between BEGIN and END lines.
Network captures
`.PCAP`	libpcap packet capture	Recorded network packets, each with a timestamp, after a 24-byte header.
Shortcuts & settings
`.LNK`	Windows shortcut	A Windows shortcut: a header, the target’s location, strings and extra data.
`.PLIST`	Apple property list	Apple’s settings files: a tree of values saved as XML or as binary.
Logs
`.EVTX`	Windows XML Event Log	Windows event logs: 64 KB chunks of records stored as binary XML.