The file-level analysis is the analysis that is performed on logical files or forensic images. This analysis differs from data content analysis, because the focus of this analysis is to extract, or piece together, data containers or collect metadata information. For Big Data investigations in which nodes were individually imaged, this is the type of analysis whereby the images are analyzed and the contents of the cluster are pieced back together for further analysis.

Because no two investigations are the same, analysis techniques serve as tools in a toolbox and can be combined or run in various orders and combinations. The primary file-level analyses are: