The File Sizes Tutorial

File sizes are like metric. Mostly. Enough that it should be simple to get a sense of the basic concept.

Size unit names use a metric prefix + “byte.” Byte is the basic unit of measurement (think gram) for electronic data.

So,

  • 1 kilobyte (KB) is 1,000 bytes

  • 1 megabyte (MB) is 1,000 KB, or 1,000,000 bytes

  • 1 gigabyte (GB) is 1,000 MB, 1,000,000 KB, or 1,000,000,000 bytes

  • 1 terabyte (TB) is 1,000 GB, 1,000,000 MB, 1,000,000,000 KB, or a trillion bytes

The chart below shows typical ranges of file sizes, device capacity sizes and the various media (discs and drives and stuff) we have available to copy them to.

This version of the chart is a placeholder.

This chart will be updated.

While phones are typically available in the sizes noted in the chart, when we receive extractions, they are usually smaller than the full capacity of the extracted devices. The same applies for computers.

The chart lists the minimum capacity by device type for a single file or device. You’ll have to do some math for multiple files.

Here is a visual comparison of the relative capacity of various media types:

File System Types

File system refers to the way a storage device, such as a USB, an external drive, or a drive in a phone or a computer organizes files on that device. You don’t need to think particularly deeply about how that works, but it would behoove you (remember when that was an expression?) to be aware of two particular file system types.

  • NTFS - This is the file system used by Microsoft Windows. It is also generally the file system on external hard drives.

  • FAT32 / exFAT

    • exFAT is a newer version of FAT32. For our purposes, you can think of them as the same. Basically, this is the format that USBs come with.

    • FAT32 and exFAT are compatible with NTFS, meaning you can stick a USB in your Windows computer and copy things back and forth.

    • One characteristic of FAT32 / exFAT is that the maximum size for a single file on a FAT32 / exFAT device is 4 GB. This means that although a USB can hold up to like 256 GB, it can’t hold a single file* that is greater than 4 GB. An example of a file that would be greater than 4 GB would be the data file associated with a phone extraction.

      • *(Since someone asked - having multiple files over 4 GB rather than just one does not somehow overturn this principle.)

Any drive can be reformatted to any file system, so a USB can be formatted to NTFS; this will allow you to store files larger than 4 GB, such as a phone or computer extraction. There are screenshots and stuff on how to do this a little further below, in case it’s more information than you want right now.

Like I have any idea how big any of my files are

You can see the sizes of files on your computer in folder windows when your view setting is set to show details. Windows charmingly insists on you telling you the size in KB. It’s like a tutorial reminder!

Note, the largest video shown here is not the longest; the size of a video file is also dependent on the quality of the video.

You can also check a single file’s size by right clicking on it and clicking Properties. And it’ll tell you the size in appropriate units (MB, GB…). You can also do this with a folder, which annoyingly does not show its combined contents size in normal Windows windows.

Why won’t this one file fit on this USB when there’s totally space available on it?

As noted earlier, USBs by default are formatted FAT32 or exFAT. And again, FAT32 and exFAT do not allow individual files to be larger than 4 GB. So if you have say a discovery production that is a total of 25 GB and included in it is a Cellebrite report with a 5 GB .ufdr file, you would be able to copy the rest of the discovery to a 32 GB or bigger USB, but not the 5GB file no matter how big the USB.

You can, however, reformat a USB to NTFS, which is the file system used on Windows computers and most external drives and which can hold files larger than 4 GB. To do this, right click (using the computer) on the USB, and click Format… (ellipses in original). Change the File system option to NTFS, and click start! Note, this will erase everything if anything currently on the drive and create a blank drive.

The maximum file size on NTFS is 256 TB, so it won’t be a problem for a while.

What if I’m working on a Mac?

MacOS uses a different file system, called APFS. One reason FAT32 and exFAT have been common for so long is their high level of compatibility; they work seamlessly with both NTFS and APFS (meaning you can stick a FAT32 USB in a Windows computer or a Mac and copy and write files back and forth).

NTFS and APFS are less compatible. A Mac can read files on an NTFS drive, but it can’t write files to it or save any changes to documents on it.

.ufdr files associated with Cellebrite reports are the most common type of file that we deal with that tend to be larger than 4 GB. Cellebrite reports don’t run on Macs anyway though, so that takes care of that.

The main thing to note if you’re working on a Mac and want to be able to transfer files from and to Windows computers is to use USBs formatted FAT32 or exFAT. And if you need the capacity, external drives can also be formatted exFAT.