On a logical file ingestion, I only see 00:00 results in the keyword search results pane, but in the data artifacts I do have data for last modified etc (see below) is there a way to get the data from the data artifacts (i.e internal document dates) to appear on in the search results pane, this would enable me to put the keyword search results into date order?
Best regards, Jason
As a workaround I put the logical files into a VMDX and indexed this up now I can see the metadata isthe search results table. It must be the case that parsing is at filesystem and not file. The intenal file meta data is parsed with logical ingestion and could be displayed as it would be for the physical - is that something that can be considered for the future?
There is a PR that will add the birth, modify and last access to files that are part of a logical data source. The pr is #7716 in the autopsy repo.
