Changing Data Source path location (Local Drive)

Autopsy Help
1

I am having an issue with changing the Data Source’s path when opening an older case and the data source was a “Local Disk”. A prompt appears during the case opening and asks to locate the image, however, this is a not an image file, it was a physical disk. I went paroozing through the case folder looking at the config files and do not see where to modify it’s location manually. Unless it is in the case db “autopsy.db”.

How would one change the data source from say “\.\PhysicalDrive2” to “\.\PhysicalDrive3”?

Any help would be appreciated.

2

Yes it is in the case database “autopsy.db” under tsk_image_names. So you’ll need something like SQLite Browser to edit the “name” column.

driveLocs

1 Like
3

Thank you so much for the quick reply! I feel silly for asking as i figured it would have to be in there, just have not taken the time to find a good open source SQLite browser/editor. Trying to go all open-source these days.

5

As a follow on to this I am looking at an old case where a large number of logical files were added as a source and their location has changed.
Looking at autopsy.db the ‘tsk_image_names’ table is empty. I am assuming this is due to not adding the source as an image file or local disk.
I do see all the previous file paths located under the ‘tsk_files_path’ table.

Would I just have to change the first part of the path to point to the new location?
Can someone provide an example sqlite statement that would accomplish this for all rows if so?

Thank you

6

Yes you should just have to change that path. I just tested it out. Make a copy of autopsy.db before starting.

I made a small case with some logical files in a folder named “ABC”.

renamePath1
renamePath1758×395 19.8 KB

I closed Autopsy then I renamed that folder to “XYZ” and ran this on the database:

UPDATE tsk_files_path SET path = REPLACE(path, ‘R:\work\images\Test files\ABC’, ‘R:\work\images\Test files\XYZ’);

renamePath2
renamePath2758×386 19.6 KB

Then I loaded up the case again and everything looked good.

7

Thank you for the quick reply Ann. Worked like a charm! :tada:

1 Like