# Adding Data Source

**URL:** <https://sleuthkit.discourse.group/t/adding-data-source/756>\
**Category:** Autopsy Online Training\
**Created:** [April 13, 2020, 11:58am UTC](https://sleuthkit.discourse.group/t/adding-data-source/756 "2020-04-13T11:58:43Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![frizzo62](https://avatars.discourse-cdn.com/v4/letter/f/3d9bf3/32.png) [@frizzo62](https://sleuthkit.discourse.group/u/frizzo62)\
**Post date:** [April 13, 2020, 11:58am UTC](https://sleuthkit.discourse.group/t/adding-data-source/756/1 "2020-04-13T11:58:43Z")

</div>

When creating a case, how long does it take for the ingestion of files to appear in the Data Source Directory Tree ?

---

<div class="post-metadata">

**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\
**Post date:** [April 13, 2020, 12:01pm UTC](https://sleuthkit.discourse.group/t/adding-data-source/756/2 "2020-04-13T12:01:33Z")

</div>

Files won’t appear until after the Add Data Source wizard finishes (which means all files have been added to the case database), so it’s totally dependent on the size of your image.

---

<div class="post-metadata">

**Author:** ![frizzo62](https://avatars.discourse-cdn.com/v4/letter/f/3d9bf3/32.png) [@frizzo62](https://sleuthkit.discourse.group/u/frizzo62)\
**Post date:** [April 13, 2020, 12:07pm UTC](https://sleuthkit.discourse.group/t/adding-data-source/756/3 "2020-04-13T12:07:20Z")

</div>

I am probably then doing something wrong as when I use a different tool ( Paraben) the image/files get uploaded much faster and they show much more info then Autopsy.

---

<div class="post-metadata">

**Author:** ![John\_Lehr](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/john_lehr/32/45_2.png) [@John\_Lehr](https://sleuthkit.discourse.group/u/John_Lehr)\
**Post date:** [April 13, 2020, 2:53pm UTC](https://sleuthkit.discourse.group/t/adding-data-source/756/4 "2020-04-13T14:53:54Z")

</div>

When you add a data source, Autopsy immediately scans the source and adds the volumes and file systems of supported partition tables and file systems. The volumes and files are added to the Data Sources in the left panel. You will have to expand the section to see them.

You will also be able to see files in the Views section under the “By Extension”, Deleted files., and MB File Size categories. (Note: the detection of deleted files is dependent on the type of file system being examined.) Be aware that the By MIME Type category will only be populated after running the File Type Identification ingest module.

The Data Sources section will populate while you are making your ingest module selections, or even if you choose to run no ingest modules. The results of are not instantaneous, and will take longer with larger media and/or more populated file systems, but you do not have to wait for Ingest modules to complete to see the results.

---

<div class="post-metadata">

**Author:** ![frizzo62](https://avatars.discourse-cdn.com/v4/letter/f/3d9bf3/32.png) [@frizzo62](https://sleuthkit.discourse.group/u/frizzo62)\
**Post date:** [April 13, 2020, 4:01pm UTC](https://sleuthkit.discourse.group/t/adding-data-source/756/5 "2020-04-13T16:01:59Z")

</div>

> [@John\_Lehr](#):
>
> being

Hi John  
Thanks for the reply  
This is what I am seeing now

 ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/1X/8ae5e8bb3ae509a45d2486e9fd552c39d73d9b20.png)

---

<div class="post-metadata">

**Author:** ![frizzo62](https://avatars.discourse-cdn.com/v4/letter/f/3d9bf3/32.png) [@frizzo62](https://sleuthkit.discourse.group/u/frizzo62)\
**Post date:** [April 13, 2020, 4:05pm UTC](https://sleuthkit.discourse.group/t/adding-data-source/756/6 "2020-04-13T16:05:15Z")

</div>

…and from Paraben…

 ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/1X/920652718e3384d2fbd3600d5d7ddf269d3c022d.png)

---

<div class="post-metadata">

**Author:** ![frizzo62](https://avatars.discourse-cdn.com/v4/letter/f/3d9bf3/32.png) [@frizzo62](https://sleuthkit.discourse.group/u/frizzo62)\
**Post date:** [April 13, 2020, 4:10pm UTC](https://sleuthkit.discourse.group/t/adding-data-source/756/7 "2020-04-13T16:10:37Z")

</div>

Hi John  
FYI…I see in Autopsy the file size but outside of the 24 email addressesm I do not see any other data…

 ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/1X/596a0a110b04016f181946d226d6376bb585562f.png)

---

<div class="post-metadata">

**Author:** ![John\_Lehr](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/john_lehr/32/45_2.png) [@John\_Lehr](https://sleuthkit.discourse.group/u/John_Lehr)\
**Post date:** [April 13, 2020, 4:24pm UTC](https://sleuthkit.discourse.group/t/adding-data-source/756/8 "2020-04-13T16:24:51Z")

</div>

Hi, It looks like you added the image as a “Logical File” rather than a “Disk Image or VM”.

---

<div class="post-metadata">

**Author:** ![frizzo62](https://avatars.discourse-cdn.com/v4/letter/f/3d9bf3/32.png) [@frizzo62](https://sleuthkit.discourse.group/u/frizzo62)\
**Post date:** [April 13, 2020, 4:32pm UTC](https://sleuthkit.discourse.group/t/adding-data-source/756/9 "2020-04-13T16:32:14Z")

</div>

Hi

Seems to have worked…TY!

 ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/1X/415a4cd90eaa6535cfcfceff1ac4661b25f2e9a7.png)

---

<div class="post-metadata">

**Author:** ![Deepak\_Singh](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/deepak_singh/32/436_2.png) [@Deepak\_Singh](https://sleuthkit.discourse.group/u/Deepak_Singh)\
**Post date:** [April 13, 2020, 10:38pm UTC](https://sleuthkit.discourse.group/t/adding-data-source/756/10 "2020-04-13T22:38:56Z")

</div>

i added it by image it is showing an error  
"Errors occurred while ingesting image

1. Cannot determine file system type (Sector offset: 0)"
