Changing Data Source path location (Local Drive)

I am having an issue with changing the Data Source’s path when opening an older case and the data source was a “Local Disk”. A prompt appears during the case opening and asks to locate the image, however, this is a not an image file, it was a physical disk. I went paroozing through the case folder looking at the config files and do not see where to modify it’s location manually. Unless it is in the case db “autopsy.db”.

How would one change the data source from say “\.\PhysicalDrive2” to “\.\PhysicalDrive3”?

Any help would be appreciated.

Yes it is in the case database “autopsy.db” under tsk_image_names. So you’ll need something like SQLite Browser to edit the “name” column.

driveLocs

1 Like

Thank you so much for the quick reply! I feel silly for asking as i figured it would have to be in there, just have not taken the time to find a good open source SQLite browser/editor. Trying to go all open-source these days.