When creating a case, how long does it take for the ingestion of files to appear in the Data Source Directory Tree ?
Files won’t appear until after the Add Data Source wizard finishes (which means all files have been added to the case database), so it’s totally dependent on the size of your image.
I am probably then doing something wrong as when I use a different tool ( Paraben) the image/files get uploaded much faster and they show much more info then Autopsy.
When you add a data source, Autopsy immediately scans the source and adds the volumes and file systems of supported partition tables and file systems. The volumes and files are added to the Data Sources in the left panel. You will have to expand the section to see them.
You will also be able to see files in the Views section under the “By Extension”, Deleted files., and MB File Size categories. (Note: the detection of deleted files is dependent on the type of file system being examined.) Be aware that the By MIME Type category will only be populated after running the File Type Identification ingest module.
The Data Sources section will populate while you are making your ingest module selections, or even if you choose to run no ingest modules. The results of are not instantaneous, and will take longer with larger media and/or more populated file systems, but you do not have to wait for Ingest modules to complete to see the results.
Hi John
FYI…I see in Autopsy the file size but outside of the 24 email addressesm I do not see any other data…
Hi, It looks like you added the image as a “Logical File” rather than a “Disk Image or VM”.
i added it by image it is showing an error
"Errors occurred while ingesting image
- Cannot determine file system type (Sector offset: 0)"