I have the latest version of enCase Forensic. I do my image with it, format .e01. Then i want to open it in Autopsy, and i only have the unallocated space of my image!!! If i open my enCase E01 image if FTK Imager i have the image full, everything is there. But when i open it in Autopsy nothing beside the unallocate space!
. It’s been like that for my 3 last forneisc cases, since i have enCase Forensic.
Can you post the log file that should be in the case log directory?
i have 3 logs
autopsy.log.2
2022-12-20 08:02:44.558 org.sleuthkit.autopsy.centralrepository.datamodel.RdbmsCentralRepo upgradeSchema
INFO: Central Repository is up to date
2022-12-20 08:02:44.607 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Starting local Solr SOLR8 server
2022-12-20 08:02:44.614 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2022-12-20 08:02:44.615 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Local Solr SOLR8 server is already running
2022-12-20 08:02:44.617 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2022-12-20 08:02:45.638 org.sleuthkit.autopsy.keywordsearch.Server$Collection
INFO: Using Solr document queue size = 30
2022-12-20 08:02:45.764 org.sleuthkit.autopsy.imagegallery.PerCaseProperties getConfigSetting
INFO: File did not exist. Created file [Image Gallery.properties]
2022-12-20 08:02:45.886 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas
INFO: sqlite-jdbc version 3.25.2 loaded in native mode
2022-12-20 08:02:45.976 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase
INFO: Opened INC0721549 (inc0721549_20221220_080242) in D:\INC0721549\autopsy\INC0721549 as the current case
2022-12-20 08:02:46.249 org.sleuthkit.autopsy.corecomponents.DataContentViewerHex
INFO: Created HexView instance: org.sleuthkit.autopsy.corecomponents.DataContentViewerHex[,0,0,0x0,invalid,layout=javax.swing.GroupLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=java.awt.Dimension[width=100,height=58]]
2022-12-20 08:02:46.78 org.sleuthkit.autopsy.contentviewers.MediaFileViewer
INFO: Created MediaView instance: org.sleuthkit.autopsy.contentviewers.MediaFileViewer[,0,0,0x0,invalid,layout=java.awt.CardLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]
2022-12-20 08:02:47.282 org.sleuthkit.autopsy.contentviewers.FileViewer
INFO: Created ApplicationContentViewer instance: org.sleuthkit.autopsy.contentviewers.FileViewer[,0,0,0x0,invalid,layout=javax.swing.OverlayLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]
2022-12-20 08:02:47.691 org.sleuthkit.autopsy.corecomponents.DataContentTopComponent
INFO: Created DataContentTopComponent instance: org.sleuthkit.autopsy.corecomponents.DataContentTopComponent[Data Content,0,0,0x0,invalid,layout=javax.swing.BoxLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=256,maximumSize=,minimumSize=,preferredSize=]
2022-12-20 08:02:48.004 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Central Repository, version = 4.19.3
2022-12-20 08:02:48.048 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Data Source Integrity, version = 4.19.3
2022-12-20 08:02:48.093 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = DJI Drone Analyzer, version = 4.19.3
2022-12-20 08:02:48.135 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Embedded File Extractor, version = 4.19.3
2022-12-20 08:02:48.137 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Encryption Detection, version = 4.19.3
2022-12-20 08:02:48.178 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Extension Mismatch Detector, version = 4.19.3
2022-12-20 08:02:48.222 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = File Type Identification, version = 4.19.3
2022-12-20 08:02:48.265 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Hash Lookup, version = 4.19.3
2022-12-20 08:02:48.265 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Interesting Files Identifier, version = 4.19.3
2022-12-20 08:02:48.309 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Android Analyzer (aLEAPP), version = 4.19.3
2022-12-20 08:02:48.309 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = iOS Analyzer (iLEAPP), version = 4.19.3
2022-12-20 08:02:48.353 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = PhotoRec Carver, version = 7.0
2022-12-20 08:02:48.396 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Picture Analyzer, version = 4.19.3
2022-12-20 08:02:48.44 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Plaso, version = 4.19.3
2022-12-20 08:02:48.483 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Virtual Machine Extractor, version = 4.19.3
2022-12-20 08:02:48.531 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = YARA Analyzer, version = 4.19.3
2022-12-20 08:02:48.532 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Keyword Search, version = 4.19.3
2022-12-20 08:02:48.537 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Email Parser, version = 4.19.3
2022-12-20 08:02:48.539 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Recent Activity, version = 4.19.3
2022-12-20 08:02:48.608 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories
INFO: Found ingest module factory: name = GPX Parser, version = 1.2
2022-12-20 08:02:48.608 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories
INFO: Found ingest module factory: name = Android Analyzer, version = 4.19.3
2022-12-20 08:03:29.147 org.sleuthkit.autopsy.ingest.IngestMonitor$MonitorTimerAction logMonitoredRootDirectory
INFO: Monitoring disk space of D:
2022-12-20 08:03:29.148 org.sleuthkit.autopsy.ingest.IngestManager startIngestJob
INFO: Starting ingest job 0
2022-12-20 08:03:29.15 org.sleuthkit.autopsy.ingest.IngestPipelinesConfiguration getInstance
INFO: Creating ingest module loader instance
2022-12-20 08:03:29.291 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer loadConfigFile
INFO: Load successful
2022-12-20 08:03:30.733 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2022-12-20 08:03:30.788 org.sleuthkit.autopsy.modules.yara.YaraIngestModule startUp
INFO: YARA ingest module: No rule set was selected for this ingest job.
2022-12-20 08:03:31.089 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage
INFO: Starting first stage analysis in streaming mode (data source = INC0721549.E01, objId = 1, pipeline id = 0, ingest job id = 1)
2022-12-20 08:08:54.857 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage
INFO: Starting full first stage analysis in streaming mode (data source = INC0721549.E01, objId = 1, pipeline id = 0, ingest job id = 1)
2022-12-20 08:08:55.211 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: Recent Activity analysis of INC0721549.E01 starting
2022-12-20 08:08:55.243 org.sleuthkit.autopsy.recentactivity.RecentDocumentsByLnk getRecentDocuments
INFO: Didn’t find any recent files.
2022-12-20 08:08:55.272 org.sleuthkit.autopsy.recentactivity.Chromium getHistory
INFO: Could not find any allocated Chrome history files.
2022-12-20 08:08:55.272 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark
INFO: Didn’t find any Chrome bookmark files.
2022-12-20 08:08:55.273 org.sleuthkit.autopsy.recentactivity.Chromium getCookie
INFO: Didn’t find any Chrome cookies files.
2022-12-20 08:08:55.273 org.sleuthkit.autopsy.recentactivity.Chromium getLogins
INFO: Didn’t find any Chrome Login Data files.
2022-12-20 08:08:55.273 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill
INFO: Didn’t find any Chrome Web Data files.
2022-12-20 08:08:55.274 org.sleuthkit.autopsy.recentactivity.Chromium getDownload
INFO: Didn’t find any Chrome download files.
2022-12-20 08:08:55.274 org.sleuthkit.autopsy.recentactivity.Chromium getHistory
INFO: Could not find any allocated Chrome history files.
2022-12-20 08:08:55.274 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark
INFO: Didn’t find any Chrome bookmark files.
2022-12-20 08:08:55.274 org.sleuthkit.autopsy.recentactivity.Chromium getCookie
INFO: Didn’t find any Chrome cookies files.
2022-12-20 08:08:55.276 org.sleuthkit.autopsy.recentactivity.Chromium getLogins
INFO: Didn’t find any Chrome Login Data files.
2022-12-20 08:08:55.276 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill
INFO: Didn’t find any Chrome Web Data files.
2022-12-20 08:08:55.276 org.sleuthkit.autopsy.recentactivity.Chromium getDownload
INFO: Didn’t find any Chrome download files.
2022-12-20 08:08:55.277 org.sleuthkit.autopsy.recentactivity.Chromium getHistory
INFO: Could not find any allocated Chrome history files.
2022-12-20 08:08:55.277 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark
INFO: Didn’t find any Chrome bookmark files.
2022-12-20 08:08:55.278 org.sleuthkit.autopsy.recentactivity.Chromium getCookie
INFO: Didn’t find any Chrome cookies files.
2022-12-20 08:08:55.278 org.sleuthkit.autopsy.recentactivity.Chromium getLogins
INFO: Didn’t find any Chrome Login Data files.
2022-12-20 08:08:55.279 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill
INFO: Didn’t find any Chrome Web Data files.
2022-12-20 08:08:55.279 org.sleuthkit.autopsy.recentactivity.Chromium getDownload
INFO: Didn’t find any Chrome download files.
2022-12-20 08:08:55.28 org.sleuthkit.autopsy.recentactivity.Chromium getHistory
INFO: Could not find any allocated Chrome history files.
2022-12-20 08:08:55.28 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark
INFO: Didn’t find any Chrome bookmark files.
2022-12-20 08:08:55.281 org.sleuthkit.autopsy.recentactivity.Chromium getCookie
INFO: Didn’t find any Chrome cookies files.
2022-12-20 08:08:55.281 org.sleuthkit.autopsy.recentactivity.Chromium getLogins
INFO: Didn’t find any Chrome Login Data files.
2022-12-20 08:08:55.281 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill
INFO: Didn’t find any Chrome Web Data files.
2022-12-20 08:08:55.282 org.sleuthkit.autopsy.recentactivity.Chromium getDownload
INFO: Didn’t find any Chrome download files.
2022-12-20 08:08:55.282 org.sleuthkit.autopsy.recentactivity.Chromium getHistory
INFO: Could not find any allocated Chrome history files.
2022-12-20 08:08:55.282 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark
INFO: Didn’t find any Chrome bookmark files.
2022-12-20 08:08:55.282 org.sleuthkit.autopsy.recentactivity.Chromium getCookie
INFO: Didn’t find any Chrome cookies files.
2022-12-20 08:08:55.283 org.sleuthkit.autopsy.recentactivity.Chromium getLogins
INFO: Didn’t find any Chrome Login Data files.
2022-12-20 08:08:55.283 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill
INFO: Didn’t find any Chrome Web Data files.
2022-12-20 08:08:55.283 org.sleuthkit.autopsy.recentactivity.Chromium getDownload
INFO: Didn’t find any Chrome download files.
2022-12-20 08:08:55.284 org.sleuthkit.autopsy.recentactivity.Chromium getHistory
INFO: Could not find any allocated Chrome history files.
2022-12-20 08:08:55.284 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark
INFO: Didn’t find any Chrome bookmark files.
2022-12-20 08:08:55.284 org.sleuthkit.autopsy.recentactivity.Chromium getCookie
INFO: Didn’t find any Chrome cookies files.
2022-12-20 08:08:55.285 org.sleuthkit.autopsy.recentactivity.Chromium getLogins
INFO: Didn’t find any Chrome Login Data files.
2022-12-20 08:08:55.285 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill
INFO: Didn’t find any Chrome Web Data files.
2022-12-20 08:08:55.286 org.sleuthkit.autopsy.recentactivity.Chromium getDownload
INFO: Didn’t find any Chrome download files.
2022-12-20 08:08:55.286 org.sleuthkit.autopsy.recentactivity.Chromium getHistory
INFO: Could not find any allocated Chrome history files.
2022-12-20 08:08:55.286 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark
INFO: Didn’t find any Chrome bookmark files.
2022-12-20 08:08:55.287 org.sleuthkit.autopsy.recentactivity.Chromium getCookie
INFO: Didn’t find any Chrome cookies files.
2022-12-20 08:08:55.287 org.sleuthkit.autopsy.recentactivity.Chromium getLogins
INFO: Didn’t find any Chrome Login Data files.
2022-12-20 08:08:55.288 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill
INFO: Didn’t find any Chrome Web Data files.
2022-12-20 08:08:55.288 org.sleuthkit.autopsy.recentactivity.Chromium getDownload
INFO: Didn’t find any Chrome download files.
2022-12-20 08:08:55.291 org.sleuthkit.autopsy.recentactivity.Firefox getHistory
INFO: No FireFox history files found.
2022-12-20 08:08:55.291 org.sleuthkit.autopsy.recentactivity.Firefox getBookmark
INFO: Didn’t find any firefox bookmark files.
2022-12-20 08:08:55.291 org.sleuthkit.autopsy.recentactivity.Firefox getDownloadPreVersion24
INFO: Didn’t find any pre-version-24.0 Firefox download files.
2022-12-20 08:08:55.292 org.sleuthkit.autopsy.recentactivity.Firefox getDownloadVersion24
INFO: Didn’t find any version-24.0 Firefox download files.
2022-12-20 08:08:55.292 org.sleuthkit.autopsy.recentactivity.Firefox getCookie
INFO: Didn’t find any Firefox cookie files.
2022-12-20 08:08:55.292 org.sleuthkit.autopsy.recentactivity.Firefox getFormsHistory
INFO: No FireFox form history files found.
2022-12-20 08:08:55.292 org.sleuthkit.autopsy.recentactivity.Firefox getAutofillProfiles
INFO: Didn’t find any Firefox Autofill Profiles files.
2022-12-20 08:08:55.294 org.sleuthkit.autopsy.recentactivity.ExtractIE getBookmark
INFO: Didn’t find any IE bookmark files.
2022-12-20 08:08:55.295 org.sleuthkit.autopsy.recentactivity.ExtractIE getCookie
INFO: Didn’t find any IE cookies files.
2022-12-20 08:08:55.295 org.sleuthkit.autopsy.recentactivity.ExtractIE getHistory
INFO: Pasco results path: C:\Users\li296n\AppData\Local\Temp\Autopsy\inc0721549_20221220_080242\Temp\RecentActivity\IE_0\results
2022-12-20 08:08:55.296 org.sleuthkit.autopsy.recentactivity.ExtractIE getHistory
INFO: Pasco2 home: C:\Program Files\Autopsy-4.19.3\autopsy\pasco2
2022-12-20 08:08:55.297 org.sleuthkit.autopsy.recentactivity.ExtractIE getHistory
INFO: No InternetExplorer history files found.
2022-12-20 08:08:55.299 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer findSearchQueries
INFO: Processing 0 blackboard artifacts.
2022-12-20 08:08:55.3 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer findSearchQueries
INFO: Extracted 0 queries from the blackboard
2022-12-20 08:08:55.3 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer process
INFO: Search Engine stats:
Google : 0
Yahoo : 0
Twitter : 0
LinkedIn : 0
Facebook : 0
Bing : 0
Baidu : 0
Sogou : 0
Soso : 0
Youdao : 0
Yandex : 0
Biglobe : 0
Linkestan : 0
Parseek : 0
Parset : 0
Amazon : 0
DuckDuckGo : 0
Youtube : 0
Reddit : 0
CCSearch : 0
Swisscows : 0
GIbiru : 0
Wiki : 0
Cutestat : 0
Givewater : 0
Ekoru : 0
Ecosia : 0
Slideshare : 0
Wikipedia : 0
Wiki : 0
2022-12-20 08:08:55.3 org.sleuthkit.autopsy.recentactivity.ExtractWebAccountType extractDomainRoles
INFO: Processing 0 blackboard artifacts.
2022-12-20 08:08:55.301 org.sleuthkit.autopsy.recentactivity.ExtractWebAccountType$RoleProcessor createArtifacts
INFO: Didn’t find any web accounts.
2022-12-20 08:09:00.684 org.sleuthkit.autopsy.recentactivity.DomainCategoryRunner findDomainTypes
INFO: Processing 0 blackboard artifacts.
2022-12-20 08:09:00.684 org.sleuthkit.autopsy.recentactivity.DomainCategoryRunner findDomainTypes
INFO: Extracted 0 distinct messaging domain(s) from the blackboard. Of the 0 artifact(s) with valid hosts, 0 url(s) contained messaging domain suffix.
2022-12-20 08:09:00.685 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer complete
INFO: Search Engine URL Query Analyzer has completed.
2022-12-20 08:09:00.685 org.sleuthkit.autopsy.recentactivity.DomainCategoryRunner complete
INFO: Domain categorization completed.
2022-12-20 08:09:00.685 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: Recent Activity analysis of INC0721549.E01 finished
2022-12-20 08:09:00.685 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: Encryption Detection analysis of INC0721549.E01 starting
2022-12-20 08:09:00.686 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: Encryption Detection analysis of INC0721549.E01 finished
2022-12-20 08:09:00.686 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: Virtual Machine Extractor analysis of INC0721549.E01 starting
2022-12-20 08:09:00.686 org.sleuthkit.autopsy.modules.vmextractor.VMExtractorIngestModule process
INFO: Looking for virtual machine files in data source INC0721549.E01
2022-12-20 08:09:00.687 org.sleuthkit.autopsy.modules.vmextractor.VMExtractorIngestModule process
INFO: No virtual machine files found in data source INC0721549.E01
2022-12-20 08:09:00.687 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: Virtual Machine Extractor analysis of INC0721549.E01 finished
2022-12-20 08:09:00.687 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: DJI Drone Analyzer analysis of INC0721549.E01 starting
2022-12-20 08:09:00.69 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: DJI Drone Analyzer analysis of INC0721549.E01 finished
2022-12-20 08:09:00.691 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: Plaso analysis of INC0721549.E01 starting
2022-12-20 08:09:00.693 org.sleuthkit.autopsy.modules.plaso.PlasoIngestModule process
INFO: Starting Plaso Run.
2022-12-20 08:23:55.098 org.sleuthkit.autopsy.modules.plaso.PlasoIngestModule createPlasoArtifacts
INFO: PlasoDB was empty: D:\INC0721549\autopsy\INC0721549\ModuleOutput\plaso\2022-12-20 08-09-00 EST\plasodb.db3
2022-12-20 08:23:55.099 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: Plaso analysis of INC0721549.E01 finished
2022-12-20 08:23:55.099 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage
INFO: Finished first stage analysis (data source = INC0721549.E01, objId = 1, pipeline id = 0, ingest job id = 1)
2022-12-20 08:23:55.101 org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule shutDown
INFO: Keyword search ingest module instance 1 shutting down
2022-12-20 08:23:55.122 org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModule shutDown
INFO: 1 artifacts in db for case: INC0721549 ds:INC0721549.E01
2022-12-20 08:23:55.13 org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule shutDown
INFO: Keyword search ingest module instance 0 shutting down
2022-12-20 08:23:55.14 org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule shutDown
INFO: Indexed files count: 0
2022-12-20 08:23:55.142 org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule shutDown
INFO: Indexed file chunks count: 0
2022-12-20 08:23:55.145 org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModule shutDown
INFO: 1 artifacts in db for case: INC0721549 ds:INC0721549.E01
2022-12-20 08:23:55.146 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage
INFO: Starting second stage ingest task pipelines for INC0721549.E01 (objID=1, jobID=0) (data source = INC0721549.E01, objId = 1, pipeline id = 0, ingest job id = 1)
2022-12-20 08:23:55.146 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: Data Source Integrity analysis of INC0721549.E01 starting
2022-12-20 08:23:55.148 org.sleuthkit.autopsy.modules.dataSourceIntegrity.DataSourceIntegrityIngestModule process
INFO: Total chunks = 15 560 128
2022-12-20 08:23:55.148 org.sleuthkit.autopsy.modules.dataSourceIntegrity.DataSourceIntegrityIngestModule process
INFO: Starting hash calculation for INC0721549.E01
2022-12-20 08:24:51.094 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask
INFO: Data Source Integrity analysis of INC0721549.E01 finished
2022-12-20 08:24:51.094 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage
INFO: Finished all tasks (data source = INC0721549.E01, objId = 1, pipeline id = 0, ingest job id = 1)
2022-12-20 08:24:51.105 org.sleuthkit.autopsy.ingest.IngestManager finishIngestJob
INFO: Ingest job 0 completed
2022-12-20 08:24:54.407 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase
INFO: Closing current case INC0721549 (inc0721549_20221220_080242) in D:\INC0721549\autopsy\INC0721549
2022-12-20 08:24:56.45 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Shutting down image gallery controller for case INC0721549 (inc0721549_20221220_080242)
2022-12-20 08:24:56.451 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB close
INFO: Closing the drawable.db
2022-12-20 08:24:56.454 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Completed shut down of image gallery controller for case INC0721549 (inc0721549_20221220_080242)
2022-12-20 08:27:13.596 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Stopping Solr 8 server
2022-12-20 08:27:13.596 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Setting Solr 8 directory: C:\Program Files\Autopsy-4.19.3\autopsy\solr
2022-12-20 08:27:13.597 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Running Solr 8 command: [C:\Program Files\Autopsy-4.19.3\autopsy\solr\bin\autopsy-solr.cmd, stop, -k, jjk#09s, -p, 23232] from C:\Program Files\Autopsy-4.19.3\autopsy\solr
2022-12-20 08:27:13.63 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Finished running Solr 8 command
2022-12-20 08:27:13.63 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Waiting for Solr server to stop
autopsy.log.1
2022-12-20 08:27:33.423 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2022-12-20 08:27:33.822 org.sleuthkit.autopsy.centralrepository.datamodel.RdbmsCentralRepo upgradeSchema
INFO: Central Repository is up to date
2022-12-20 08:27:33.987 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: New Solr process PID: [21200]
2022-12-20 08:27:33.987 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Starting local Solr SOLR8 server
2022-12-20 08:27:33.992 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2022-12-20 08:27:33.992 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Local Solr SOLR8 server is already running
2022-12-20 08:27:33.994 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2022-12-20 08:27:34.976 org.sleuthkit.autopsy.keywordsearch.Server$Collection
INFO: Using Solr document queue size = 30
2022-12-20 08:27:35.144 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas
INFO: sqlite-jdbc version 3.25.2 loaded in native mode
2022-12-20 08:27:35.201 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase
INFO: Opened INC0721549 (inc0721549_20221220_080242) in D:\INC0721549\autopsy\INC0721549 as the current case
2022-12-20 08:27:35.201 org.sleuthkit.autopsy.progress.LoggingProgressIndicator progress
INFO: Retrieving images for case: autopsy.db…
2022-12-20 08:27:35.203 org.sleuthkit.autopsy.progress.LoggingProgressIndicator progress
INFO: Opening all filesystems for image: INC0721549.E01…
2022-12-20 08:27:35.326 org.sleuthkit.autopsy.corecomponents.DataContentViewerHex
INFO: Created HexView instance: org.sleuthkit.autopsy.corecomponents.DataContentViewerHex[,0,0,0x0,invalid,layout=javax.swing.GroupLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=java.awt.Dimension[width=100,height=58]]
2022-12-20 08:27:35.563 org.sleuthkit.autopsy.contentviewers.MediaFileViewer
INFO: Created MediaView instance: org.sleuthkit.autopsy.contentviewers.MediaFileViewer[,0,0,0x0,invalid,layout=java.awt.CardLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]
2022-12-20 08:27:35.696 org.sleuthkit.autopsy.contentviewers.FileViewer
INFO: Created ApplicationContentViewer instance: org.sleuthkit.autopsy.contentviewers.FileViewer[,0,0,0x0,invalid,layout=javax.swing.OverlayLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]
2022-12-20 08:27:35.806 org.sleuthkit.autopsy.corecomponents.DataContentTopComponent
INFO: Created DataContentTopComponent instance: org.sleuthkit.autopsy.corecomponents.DataContentTopComponent[Data Content,0,0,0x0,invalid,layout=javax.swing.BoxLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=256,maximumSize=,minimumSize=,preferredSize=]
2022-12-20 08:28:06.72 org.sleuthkit.autopsy.contentviewers.FileViewer isSupported
INFO: Mimetype not known for file: Unalloc_6_121109131264_122182873088
2022-12-20 08:28:15.226 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Stopping Solr 8 server
2022-12-20 08:28:15.227 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Setting Solr 8 directory: C:\Program Files\Autopsy-4.19.3\autopsy\solr
2022-12-20 08:28:15.227 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Running Solr 8 command: [C:\Program Files\Autopsy-4.19.3\autopsy\solr\bin\autopsy-solr.cmd, stop, -k, jjk#09s, -p, 23232] from C:\Program Files\Autopsy-4.19.3\autopsy\solr
2022-12-20 08:28:15.261 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Finished running Solr 8 command
2022-12-20 08:28:15.261 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Waiting for Solr server to stop
2022-12-20 08:28:17.619 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Finished stopping Solr server
2022-12-20 08:28:17.619 org.sleuthkit.autopsy.core.Installer
INFO: core installer created
2022-12-20 08:28:17.665 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase
INFO: Closing current case INC0721549 (inc0721549_20221220_080242) in D:\INC0721549\autopsy\INC0721549
2022-12-20 08:28:19.672 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Shutting down image gallery controller for case INC0721549 (inc0721549_20221220_080242)
2022-12-20 08:28:19.674 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB close
INFO: Closing the drawable.db
2022-12-20 08:28:19.676 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Completed shut down of image gallery controller for case INC0721549 (inc0721549_20221220_080242)
autopsy.log.0
2022-12-20 08:36:01.07 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2022-12-20 08:36:01.751 org.sleuthkit.autopsy.centralrepository.datamodel.RdbmsCentralRepo upgradeSchema
INFO: Central Repository is up to date
2022-12-20 08:36:01.808 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: New Solr process PID: [15764]
2022-12-20 08:36:01.814 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Starting local Solr SOLR8 server
2022-12-20 08:36:01.82 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2022-12-20 08:36:01.82 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr
INFO: Local Solr SOLR8 server is already running
2022-12-20 08:36:01.823 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning
INFO: Solr server is running
2022-12-20 08:36:02.826 org.sleuthkit.autopsy.keywordsearch.Server$Collection
INFO: Using Solr document queue size = 30
2022-12-20 08:36:02.97 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas
INFO: sqlite-jdbc version 3.25.2 loaded in native mode
2022-12-20 08:36:03.058 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase
INFO: Opened INC0721549 (inc0721549_20221220_080242) in D:\INC0721549\autopsy\INC0721549 as the current case
2022-12-20 08:36:03.059 org.sleuthkit.autopsy.progress.LoggingProgressIndicator progress
INFO: Retrieving images for case: autopsy.db…
2022-12-20 08:36:03.06 org.sleuthkit.autopsy.progress.LoggingProgressIndicator progress
INFO: Opening all filesystems for image: INC0721549.E01…
2022-12-20 08:36:03.181 org.sleuthkit.autopsy.corecomponents.DataContentViewerHex
INFO: Created HexView instance: org.sleuthkit.autopsy.corecomponents.DataContentViewerHex[,0,0,0x0,invalid,layout=javax.swing.GroupLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=java.awt.Dimension[width=100,height=58]]
2022-12-20 08:36:03.384 org.sleuthkit.autopsy.contentviewers.MediaFileViewer
INFO: Created MediaView instance: org.sleuthkit.autopsy.contentviewers.MediaFileViewer[,0,0,0x0,invalid,layout=java.awt.CardLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]
2022-12-20 08:36:03.535 org.sleuthkit.autopsy.contentviewers.FileViewer
INFO: Created ApplicationContentViewer instance: org.sleuthkit.autopsy.contentviewers.FileViewer[,0,0,0x0,invalid,layout=javax.swing.OverlayLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]
2022-12-20 08:36:03.68 org.sleuthkit.autopsy.corecomponents.DataContentTopComponent
INFO: Created DataContentTopComponent instance: org.sleuthkit.autopsy.corecomponents.DataContentTopComponent[Data Content,0,0,0x0,invalid,layout=javax.swing.BoxLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=256,maximumSize=,minimumSize=,preferredSize=]
2022-12-20 08:37:58.062 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Central Repository, version = 4.19.3
2022-12-20 08:37:58.068 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Data Source Integrity, version = 4.19.3
2022-12-20 08:37:58.073 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = DJI Drone Analyzer, version = 4.19.3
2022-12-20 08:37:58.078 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Embedded File Extractor, version = 4.19.3
2022-12-20 08:37:58.079 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Encryption Detection, version = 4.19.3
2022-12-20 08:37:58.084 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Extension Mismatch Detector, version = 4.19.3
2022-12-20 08:37:58.089 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = File Type Identification, version = 4.19.3
2022-12-20 08:37:58.094 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Hash Lookup, version = 4.19.3
2022-12-20 08:37:58.094 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Interesting Files Identifier, version = 4.19.3
2022-12-20 08:37:58.099 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Android Analyzer (aLEAPP), version = 4.19.3
2022-12-20 08:37:58.099 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = iOS Analyzer (iLEAPP), version = 4.19.3
2022-12-20 08:37:58.104 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = PhotoRec Carver, version = 7.0
2022-12-20 08:37:58.11 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Picture Analyzer, version = 4.19.3
2022-12-20 08:37:58.115 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Plaso, version = 4.19.3
2022-12-20 08:37:58.12 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Virtual Machine Extractor, version = 4.19.3
2022-12-20 08:37:58.125 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = YARA Analyzer, version = 4.19.3
2022-12-20 08:37:58.126 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Keyword Search, version = 4.19.3
2022-12-20 08:37:58.128 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Email Parser, version = 4.19.3
2022-12-20 08:37:58.129 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory
INFO: Found ingest module factory: name = Recent Activity, version = 4.19.3
2022-12-20 08:37:58.194 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories
INFO: Found ingest module factory: name = GPX Parser, version = 1.2
2022-12-20 08:37:58.194 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories
INFO: Found ingest module factory: name = Android Analyzer, version = 4.19.3
2022-12-20 08:41:13.329 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Stopping Solr 8 server
2022-12-20 08:41:13.329 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Setting Solr 8 directory: C:\Program Files\Autopsy-4.19.3\autopsy\solr
2022-12-20 08:41:13.33 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Running Solr 8 command: [C:\Program Files\Autopsy-4.19.3\autopsy\solr\bin\autopsy-solr.cmd, stop, -k, jjk#09s, -p, 23232] from C:\Program Files\Autopsy-4.19.3\autopsy\solr
2022-12-20 08:41:13.364 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand
INFO: Finished running Solr 8 command
2022-12-20 08:41:13.364 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Waiting for Solr server to stop
2022-12-20 08:41:15.95 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr
INFO: Finished stopping Solr server
2022-12-20 08:41:15.95 org.sleuthkit.autopsy.core.Installer
INFO: core installer created
2022-12-20 08:41:16.027 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase
INFO: Closing current case INC0721549 (inc0721549_20221220_080242) in D:\INC0721549\autopsy\INC0721549
2022-12-20 08:41:18.035 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Shutting down image gallery controller for case INC0721549 (inc0721549_20221220_080242)
2022-12-20 08:41:18.039 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB close
INFO: Closing the drawable.db
2022-12-20 08:41:18.042 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Completed shut down of image gallery controller for case INC0721549 (inc0721549_20221220_080242)
When i add a data source i do this :
i choose the E01 file.
Any idea what’s wrong?
What are the first 6 bytes of the E01 files?
Here is the first screencapture for the file encase that i cannot open in Autopsy:
and here info about an encase file that was able to open in Autopsy:
??? what i have to look for in this link?
Can you create a small test image that does not work and send it to me so I can see what the issue is?
ok i will do this as soon as i can.
i didn’t have time yet to create a test file . but i’m in another forensic case, and still the same probleme. the file .e01 is open in FTK imager but cannot see the file system in Autopsy:
Hello, can you resolve the problem, actually i have the same problem. Can you help me
If you can provide a image file I can try and see what the issue is but without the sample image I can’t determine if and what the problem is.
the image file is big, but when load the image in autopsy this is the result
And in logs says:
WARNING: Non-critical error occurred adding image C:\Users\adrir\Desktop\Disco.E01
org.sleuthkit.datamodel.TskDataException: Errors occurred while ingesting image
-
Cannot determine file system type (Sector offset: 1, Partition Type: GPT Safety Partition (0xee))
org.sleuthkit.datamodel.SleuthkitJNI.runAddImgNat(Native Method)
org.sleuthkit.datamodel.SleuthkitJNI.access$2200(SleuthkitJNI.java:52)
org.sleuthkit.datamodel.SleuthkitJNI$CaseDbHandle$AddImageProcess.run(SleuthkitJNI.java:584)
org.sleuthkit.autopsy.casemodule.AddImageTask.runAddImageProcess(AddImageTask.java:167)
org.sleuthkit.autopsy.casemodule.AddImageTask.run(AddImageTask.java:117)
java.lang.Thread.run(Thread.java:748)
2023-03-21 16:37:43.389 org.sleuthkit.autopsy.casemodule.AddImageWizardAddingProgressPanel lambda$dataSourceProcessorDone$1
WARNING: DatasourceID: 7e490750-bf5a-4e06-9c5d-5025fe26c069 Error Message: Errors occurred while ingesting image -
Cannot determine file system type (Sector offset: 1, Partition Type: GPT Safety Partition (0xee))
2023-03-21 16:37:43.389 org.sleuthkit.autopsy.casemodule.AddImageWizardAddingProgressPanel lambda$dataSourceProcessorDone$1
WARNING: DatasourceID: 7e490750-bf5a-4e06-9c5d-5025fe26c069 Error Message:
Possible Incomplete Image: Error reading volume at offset 2.199.023.255.040
2023-03-21 16:43:25.134 org.sleuthkit.autopsy.contentviewers.FileViewer isSupported
INFO: Mimetype not known for file: Unalloc_4_1008243573248_1009317315072
Can you Help me please?
If you run the data source integrity ingest module what are the results from the run?
Hello there !
since my 4-5 last acquisitions i do not have the probleme once in Autopsy when i opened the E01 file 
look at the screenshot : i only have to “check” Entries and go to Acquire.
since i “check” Entries & do the Acquisitions, when i open the E01 file in Autopsy everything is there (file system…).