Supported Native Data Types

Native data are files generated by the originating application. For example, Microsoft Word creates .doc and .docx files.

On Everlaw, you upload these files to extract their metadata and generate images (PDFs) for review. If you are not sure if you have native data, read our article Distinguish between Native and Processed Data to learn more. 

Everlaw supports native upload and processing for the file formats listed in this article.

Formats are broken into the following categories:

• Email and Chat Formats
• Container Files
• Web Formats
• Document Formats
• Image Formats
• Medical Image Formats
• CAD Formats
• Audio and Video
• Project Management Files
• GIS (Geographic Information System) Files
• Other

Email and Chat Formats

• EML, EMLX 
• Google Chat (Google Vault exports of mail-formatted chats and Hangouts JSON)
• iChat (DB)
• Microsoft Teams (HTML)
• Microsoft Teams (PST)
• Slack (as it was originally exported from Slack: a .zip file that includes files "users.json", "channels.json", and "integration_logs.json", plus any message .json files)
• Lotus Notes (NSF)
• MBox
• MSG 
• OST
• PST
• OLM (Outlook for Mac)
• iOS WhatsApp (SQLite)
  • Support for direct WhatsApp SQLite databases is limited to certain historical iOS ChatStorage.sqlite formats and may not work for newer encrypted databases. For current WhatsApp data, we recommend providing mobile forensic exports (for example, Cellebrite UFDR) and uploading those containers instead.E0
• Outlook Express databases
• TNEF (transport-neutral encapsulation format)
• Instant Bloomberg (IBXML)
  Package any associated attachments in the same container file as the IBXML file before upload

• Bloomberg Messages (MSGXML)

  Note

  Package any associated attachments in the same container file as the MSGXML file before upload.

• RSMF v2
  • Must be compressed upon upload
  • During upload and processing, Everlaw ignores the outer EML file (which is useful only for backward compatibility reasons within the Relativity ecosystem), processes the JSON file(s) into a chat file(s), and extracts and links the attachment files. This means that RSMF data will now be properly represented as chats in Everlaw.  

Container Files

• 7Zip (7Z)
  We do not currently support split zips created by WinZip
• AD1 (AccessData Images)
• E01, Ex01 (Encase)
  • Everlaw supports EnCase images of common unencrypted Windows filesystems (for example, NTFS). We do not support volumes encrypted with BitLocker or Apple disk encryption (for example, FileVault). To ingest data from these images, decrypt and/or re-image the volume or export the contents to supported natives or containers (for example, using a forensic tool such as FTK Imager) before uploading to Everlaw
• GZip, GZ
• Bzip
• Zlib-compressed data
• L01, Lx01 (Encase Logical Image)
  • We do not support password-protected/encrypted Lx01 files. Decrypt these files prior to uploading them.
  • A standalone L01 can be uploaded in the same upload as other files
  • Multi-part split archives must be structured as a directory/container, with no more than 10 same-directory companion files in the upload. A multi-part split archive cannot be mixed as loose files with unrelated loose files, and cannot share a directory with a second split archive.
• PST
• OLM (Outlook for Mac)
• RAR: You can upload multipart RAR files if they are uploaded in accordance Everlaw's split file handling
• TAR, TGZ
• JAR
• WAR
• VeraCrypt/TrueCrypt
• ZIP (including split zip files)
• AppleSingle
• CAB
• DBX
• MacBinary
• LEF (LiveNote Evidence File)
• Cellebrite UFDR Archive
• Partial support for ACCDB, MDB (Microsoft Access database file): Table data is extracted. Other objects, such as queries, forms, reports, and macros, are not extracted or rendered.

Magnet Axiom

For Magnet Axiom data to render on Everlaw, follow the following export instructions:

• In the Export/Report format step: 

  • You must select XML format

    Note

    Those with Magnet Axiom Cyber can use a standard load file export format, which is designed for upload to eDiscovery platforms.

    Note

    We do not support Portable Case exports. For Everlaw to correctly process an export in Portable Case format, you must merge the Portable Case with the primary parent case from which it originated. This must be done in the full AXIOM Examine tool, before exporting. See more in Magnet Axiom's article about Portable Case format.

• In the Configure artifact details step:
  • You must select Include source files in the attachments folder
  • For proper email handling, select Generate .MSG attachments for email Artifacts
  • We recommend including all columns
  • To include chat data, select Include chat threads as HTML
• The final export should include an “Attachments” subfolder, the Export.xml file, an ExportSummary.json file, and optionally a “Chat preview report” subfolder. 
• Zip the folder before you upload it to Everlaw

When these specifications are met, the data will be reviewable on Everlaw, with the following expectations:

• The following classes of files are expected to render and be reviewable on Everlaw:
  • Emails 
  • Videos
  • Voice recordings and voice mails
  • Images (JPEGs, PNGs, etc.)
  • XLS files
  • Chat data exported as HTML, with the following details to consider:

• The chat files will be reviewable as an HTML image of the entire thread, and will not open in the Chat view
• Chat upload configuration selections, such as segment size, do not apply to these files
• Standard Everlaw metadata fields are extracted
• Axiom metadata from the XML file will not be associated with the chat file, but is included in the XML file(s) for the Artifact from which it’s derived

• The following will be rendered as their own XML files per Artifact: 
  • Contacts
  • Phone call logs
  • Internet history

This beta release is expected to provide immediate value to teams working with Magnet Axiom exports, and we want to continue to build on that value. If files or their metadata are not rendering as you expect, or if there are additional export types and Artifacts that you want us to support, we encourage you to write to support@everlaw.com. Our support team will work with our engineering team to leverage ongoing user issues and feedback to improve support over time. We will continue to document improvements and changes to our Magnet Axiom support.

Web Formats

• HTML (HTM, HTML, XHTML, SHTML)
• MHTML, MHT
• SVG

Document Formats

• Microsoft: Word, PowerPoint, Excel, OneNote (DOCX, DOC, DOCM, DOC95, RTF, PPT, PPS, PPTX, PPM, XLS, XLSX, XLT, XLS95, XLT5, XLSM, XLR, XLSB)
  • OneNote 2010 files (ONE)
  • Everlaw does not support Sensitivity labels for Microsoft files 
  • Everlaw does not extract metadata about track changes or drafts in Word documents
• Spreadsheets
• Visio
• OpenOffice document formats
• PDF

• iWork (Pages, Numbers, Key)

  Note

  iWork support is limited. We recommend converting Numbers documents to .xlsx or Google Sheets.

• WPD (WordPerfect)
• RTF (Rich text)
• All plain text files (TXT, CSV, XML, JSON, source code, etc.)
  • Everlaw treats JSON as a plain text format by default. JSON-based exports from unsupported chat or social-media platforms (for example, TikTok or Snapchat) will upload as plain text/JSON files and will not be rendered as chats or structured conversations. Where possible, work with your vendor to export these data in a standard eDiscovery format (for example, Concordance-style load files, supported UFDR exports, or RSMF files).
• QuattroPro (QPW, limited support)
• Lotus
• Google Drive files
• XPS
• EPUB
• PTX
• XFA

• HWP and HWPx (Hancom)

  Note

  • Visual differences vs Hancom editors: The Everlaw PDF rendition may not exactly match how the same file appears in Hancom editors. In particular, bold styling, background colors, whitespace/line spacing, placement of shapes, and chart rendering may differ.
  • Charts and complex layout elements: Charts and some drawing/shape elements in HWP/HWPx files may not render or may render simplistically in the Everlaw PDF viewer. Underlying text content is still extracted where available.
  • Footnotes in HWPx files: Footnotes in HWPx files may not appear in the Everlaw PDF rendition. A follow-up improvement is planned to improve table and footnote handling.
  • Format scope: Support is focused on standard HWP (v5) and HWPx documents. Very old or unusual variants may not process correctly and could still require off-platform conversion.

Image Formats

Most common image formats, i ncluding: GIF, TIF, TIFF, PNG, JPG, JPEG, HEIF, HEIC, PBM, TGA, JXR, DNG, WMF (Windows Metafile), EMF, BMP 

Medical Image Formats

• DICOM (DCM) 

CAD Formats

• DGN (V7, V8)
• DWG
• DXF

• Solidworks: .sldprtt, .slddrw, .sladasm

  Important

  For Solidworks file types, a preview image will only be extracted from files containing an embedded preview image.

Audio and Video

Most common audio and video formats, including MP3, AAC, WMA, WAV, FLAC, M4A, OGG, AIFF, OGA, AMR, VOX, MPG, MPEG, AVI, WMV, FLV, OGV, MOV, QT, M4V, MP4, WEBM, MPE, ASF, OPUS

Project Management Files

• Microsoft Project (MPP)
• Microsoft Project Exchange (MPX)
• Microsoft Project Data Interchange Format (MSPDI)
• Primavera XML for P3 & P6
• Primavera P6 (XER)
• Primavera Self-Extracting Archive for P3 & P6 (PRX)

• Jira exports (Excel, Word, CSV, XML, HTML, PDF)

  Note

  Uploads made via Everlaw's Jira connector are displayed in a different format than those exported from Jira and manually uploaded.

GIS (Geographic Information System) Files

Limited support is provided for:

• KMZ/KML (GoogleKeyhole Markup Language)
• SHP/SHX (Esri Shapefile)
  There may be additional files that make up a Shapefile, such as .DBF and/or .PRJ, are identified as Database and Text types files, respectively. To capture the entirety of your Shapefiles, make sure you keep track of your GIS file collections and broaden any searches as needed.
  • GPX (GPS eXchange Format)
  • GEOJSON (Geographic JavaScript Object Notation)

Filesystems

• NTFS
• AFPS
• EXT4/EXT3/EXT2
• FAT32

Other

• PTX (electronic transcript)
• ICS (iCalendar)
• Apple PropertyList
• PostScript
• All plain text files (TXT, CSV, XML, source code, etc.)
• SQLite databases (SQLITE, SQLITE2)
• Disk Images (ISO, etc.)
  • macOS DMG disk images are not supported. To ingest DMG content, either extract the files locally and upload them as natives, or convert the image to a supported forensic container (such as L01 or E01) before upload.
• Common binary file formats (EXE, DLL, MSI, PGP, etc.)
• PCAP
• Zendesk exports
• DBF (database) 
• eCTD (in zip or submitted as a folder)