MPE+ does not properly display the natural previews of files from an encrypted BlackBerry?

Created by: Brendan Bone
Created date:
Last Updated date:

BlackBerry appends the file extension .REM to files that it encrypts. When MPE+ extracts these files, even though the files have been decrypted, they will retain this .REM extension. This can cause them to render incorrectly in the Natural Preview pane. To get around this, you can either use file carving in MPE+ to carve out those files and assign them correct file extensions, or process the image with FTK which will identify the files by header rather than file extension.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request


Powered by Zendesk