How to view file fragmentation

You can see if files are fragmented by using the file system browser in OSForensics. In the file system browser choose "Add device to case" from the File menu and select the drive letter or image file you wish to view. You can then navigate to the folder/files you wish to check for fragmentation. Entries that have "(MFT)" as their value are files that are stored wholly within the master file table.

If you need to defragment an individual file you can use the PassMark Fragger utility (however this utility cannot be used on image files unless they have been mounted to a drive letter with read/write access).

Note: OSForensics version 1.1 or higher required