What occurs if you choose to “not break parent/child groups” during the DeNIST process?

In the context of the DeNIST process, opting to "not break parent/child groups" signifies that the hierarchical relationships between files will be preserved during processing. A parent file is typically a container file, such as a .zip or .tar file, which may contain multiple child files, such as individual documents or images. By choosing this option, the DeNIST process will ensure that any NIST (National Institute of Standards and Technology) files, which are often considered standard references for digital evidence and may include files like known system files or software, will only be removed if they are not part of these parent/child relationships.

Thus, if a NIST file is identified as a child within a group, and you decide not to break these groups, it will remain attached to the parent file and will not be removed during the DeNIST process. Only those standalone NIST files that are not encapsulated within parent/child structures—that is, the loose or independent files—will be considered for deletion. This retains the integrity of the data structure while still applying the DeNIST process selectively.