# enCase E01 & Autopsy

**URL:** <https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530>\
**Category:** Autopsy Help\
**Created:** [December 20, 2022, 2:35pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530 "2022-12-20T14:35:48Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [December 20, 2022, 2:35pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/1 "2022-12-20T14:35:48Z")

</div>

I have the latest version of enCase Forensic. I do my image with it, format .e01. Then i want to open it in Autopsy, and i only have the unallocated space of my image!!! If i open my enCase E01 image if FTK Imager i have the image full, everything is there. But when i open it in Autopsy nothing beside the unallocate space!  
 ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/d/d8d5cd45a9edca1226fef7a1ed5b03854d8bd85f.png). It’s been like that for my 3 last forneisc cases, since i have enCase Forensic.

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [December 20, 2022, 3:00pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/2 "2022-12-20T15:00:12Z")

</div>

Can you post the log file that should be in the case log directory?

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [December 20, 2022, 3:42pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/3 "2022-12-20T15:42:04Z")

</div>

i have 3 logs

autopsy.log.2

2022-12-20 08:02:44.558 org.sleuthkit.autopsy.centralrepository.datamodel.RdbmsCentralRepo upgradeSchema  
INFO: Central Repository is up to date  
2022-12-20 08:02:44.607 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr  
INFO: Starting local Solr SOLR8 server  
2022-12-20 08:02:44.614 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning  
INFO: Solr server is running  
2022-12-20 08:02:44.615 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr  
INFO: Local Solr SOLR8 server is already running  
2022-12-20 08:02:44.617 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning  
INFO: Solr server is running  
2022-12-20 08:02:45.638 org.sleuthkit.autopsy.keywordsearch.Server$Collection   
INFO: Using Solr document queue size = 30  
2022-12-20 08:02:45.764 org.sleuthkit.autopsy.imagegallery.PerCaseProperties getConfigSetting  
INFO: File did not exist. Created file [Image Gallery.properties]  
2022-12-20 08:02:45.886 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas  
INFO: sqlite-jdbc version 3.25.2 loaded in native mode  
2022-12-20 08:02:45.976 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase  
INFO: Opened INC0721549 (inc0721549\_20221220\_080242) in D:\INC0721549\autopsy\INC0721549 as the current case  
2022-12-20 08:02:46.249 org.sleuthkit.autopsy.corecomponents.DataContentViewerHex   
INFO: Created HexView instance: org.sleuthkit.autopsy.corecomponents.DataContentViewerHex[,0,0,0x0,invalid,layout=javax.swing.GroupLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=java.awt.Dimension[width=100,height=58]]  
2022-12-20 08:02:46.78 org.sleuthkit.autopsy.contentviewers.MediaFileViewer   
INFO: Created MediaView instance: org.sleuthkit.autopsy.contentviewers.MediaFileViewer[,0,0,0x0,invalid,layout=java.awt.CardLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]  
2022-12-20 08:02:47.282 org.sleuthkit.autopsy.contentviewers.FileViewer   
INFO: Created ApplicationContentViewer instance: org.sleuthkit.autopsy.contentviewers.FileViewer[,0,0,0x0,invalid,layout=javax.swing.OverlayLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]  
2022-12-20 08:02:47.691 org.sleuthkit.autopsy.corecomponents.DataContentTopComponent   
INFO: Created DataContentTopComponent instance: org.sleuthkit.autopsy.corecomponents.DataContentTopComponent[Data Content,0,0,0x0,invalid,layout=javax.swing.BoxLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=256,maximumSize=,minimumSize=,preferredSize=]  
2022-12-20 08:02:48.004 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Central Repository, version = 4.19.3  
2022-12-20 08:02:48.048 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Data Source Integrity, version = 4.19.3  
2022-12-20 08:02:48.093 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = DJI Drone Analyzer, version = 4.19.3  
2022-12-20 08:02:48.135 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Embedded File Extractor, version = 4.19.3  
2022-12-20 08:02:48.137 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Encryption Detection, version = 4.19.3  
2022-12-20 08:02:48.178 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Extension Mismatch Detector, version = 4.19.3  
2022-12-20 08:02:48.222 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = File Type Identification, version = 4.19.3  
2022-12-20 08:02:48.265 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Hash Lookup, version = 4.19.3  
2022-12-20 08:02:48.265 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Interesting Files Identifier, version = 4.19.3  
2022-12-20 08:02:48.309 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Android Analyzer (aLEAPP), version = 4.19.3  
2022-12-20 08:02:48.309 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = iOS Analyzer (iLEAPP), version = 4.19.3  
2022-12-20 08:02:48.353 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = PhotoRec Carver, version = 7.0  
2022-12-20 08:02:48.396 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Picture Analyzer, version = 4.19.3  
2022-12-20 08:02:48.44 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Plaso, version = 4.19.3  
2022-12-20 08:02:48.483 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Virtual Machine Extractor, version = 4.19.3  
2022-12-20 08:02:48.531 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = YARA Analyzer, version = 4.19.3  
2022-12-20 08:02:48.532 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Keyword Search, version = 4.19.3  
2022-12-20 08:02:48.537 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Email Parser, version = 4.19.3  
2022-12-20 08:02:48.539 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Recent Activity, version = 4.19.3  
2022-12-20 08:02:48.608 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories  
INFO: Found ingest module factory: name = GPX Parser, version = 1.2  
2022-12-20 08:02:48.608 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories  
INFO: Found ingest module factory: name = Android Analyzer, version = 4.19.3  
2022-12-20 08:03:29.147 org.sleuthkit.autopsy.ingest.IngestMonitor$MonitorTimerAction logMonitoredRootDirectory  
INFO: Monitoring disk space of D:  
2022-12-20 08:03:29.148 org.sleuthkit.autopsy.ingest.IngestManager startIngestJob  
INFO: Starting ingest job 0  
2022-12-20 08:03:29.15 org.sleuthkit.autopsy.ingest.IngestPipelinesConfiguration getInstance  
INFO: Creating ingest module loader instance  
2022-12-20 08:03:29.291 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer loadConfigFile  
INFO: Load successful  
2022-12-20 08:03:30.733 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning  
INFO: Solr server is running  
2022-12-20 08:03:30.788 org.sleuthkit.autopsy.modules.yara.YaraIngestModule startUp  
INFO: YARA ingest module: No rule set was selected for this ingest job.  
2022-12-20 08:03:31.089 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage  
INFO: Starting first stage analysis in streaming mode (data source = INC0721549.E01, objId = 1, pipeline id = 0, ingest job id = 1)  
2022-12-20 08:08:54.857 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage  
INFO: Starting full first stage analysis in streaming mode (data source = INC0721549.E01, objId = 1, pipeline id = 0, ingest job id = 1)  
2022-12-20 08:08:55.211 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: Recent Activity analysis of INC0721549.E01 starting  
2022-12-20 08:08:55.243 org.sleuthkit.autopsy.recentactivity.RecentDocumentsByLnk getRecentDocuments  
INFO: Didn’t find any recent files.  
2022-12-20 08:08:55.272 org.sleuthkit.autopsy.recentactivity.Chromium getHistory  
INFO: Could not find any allocated Chrome history files.  
2022-12-20 08:08:55.272 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark  
INFO: Didn’t find any Chrome bookmark files.  
2022-12-20 08:08:55.273 org.sleuthkit.autopsy.recentactivity.Chromium getCookie  
INFO: Didn’t find any Chrome cookies files.  
2022-12-20 08:08:55.273 org.sleuthkit.autopsy.recentactivity.Chromium getLogins  
INFO: Didn’t find any Chrome Login Data files.  
2022-12-20 08:08:55.273 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill  
INFO: Didn’t find any Chrome Web Data files.  
2022-12-20 08:08:55.274 org.sleuthkit.autopsy.recentactivity.Chromium getDownload  
INFO: Didn’t find any Chrome download files.  
2022-12-20 08:08:55.274 org.sleuthkit.autopsy.recentactivity.Chromium getHistory  
INFO: Could not find any allocated Chrome history files.  
2022-12-20 08:08:55.274 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark  
INFO: Didn’t find any Chrome bookmark files.  
2022-12-20 08:08:55.274 org.sleuthkit.autopsy.recentactivity.Chromium getCookie  
INFO: Didn’t find any Chrome cookies files.  
2022-12-20 08:08:55.276 org.sleuthkit.autopsy.recentactivity.Chromium getLogins  
INFO: Didn’t find any Chrome Login Data files.  
2022-12-20 08:08:55.276 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill  
INFO: Didn’t find any Chrome Web Data files.  
2022-12-20 08:08:55.276 org.sleuthkit.autopsy.recentactivity.Chromium getDownload  
INFO: Didn’t find any Chrome download files.  
2022-12-20 08:08:55.277 org.sleuthkit.autopsy.recentactivity.Chromium getHistory  
INFO: Could not find any allocated Chrome history files.  
2022-12-20 08:08:55.277 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark  
INFO: Didn’t find any Chrome bookmark files.  
2022-12-20 08:08:55.278 org.sleuthkit.autopsy.recentactivity.Chromium getCookie  
INFO: Didn’t find any Chrome cookies files.  
2022-12-20 08:08:55.278 org.sleuthkit.autopsy.recentactivity.Chromium getLogins  
INFO: Didn’t find any Chrome Login Data files.  
2022-12-20 08:08:55.279 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill  
INFO: Didn’t find any Chrome Web Data files.  
2022-12-20 08:08:55.279 org.sleuthkit.autopsy.recentactivity.Chromium getDownload  
INFO: Didn’t find any Chrome download files.  
2022-12-20 08:08:55.28 org.sleuthkit.autopsy.recentactivity.Chromium getHistory  
INFO: Could not find any allocated Chrome history files.  
2022-12-20 08:08:55.28 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark  
INFO: Didn’t find any Chrome bookmark files.  
2022-12-20 08:08:55.281 org.sleuthkit.autopsy.recentactivity.Chromium getCookie  
INFO: Didn’t find any Chrome cookies files.  
2022-12-20 08:08:55.281 org.sleuthkit.autopsy.recentactivity.Chromium getLogins  
INFO: Didn’t find any Chrome Login Data files.  
2022-12-20 08:08:55.281 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill  
INFO: Didn’t find any Chrome Web Data files.  
2022-12-20 08:08:55.282 org.sleuthkit.autopsy.recentactivity.Chromium getDownload  
INFO: Didn’t find any Chrome download files.  
2022-12-20 08:08:55.282 org.sleuthkit.autopsy.recentactivity.Chromium getHistory  
INFO: Could not find any allocated Chrome history files.  
2022-12-20 08:08:55.282 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark  
INFO: Didn’t find any Chrome bookmark files.  
2022-12-20 08:08:55.282 org.sleuthkit.autopsy.recentactivity.Chromium getCookie  
INFO: Didn’t find any Chrome cookies files.  
2022-12-20 08:08:55.283 org.sleuthkit.autopsy.recentactivity.Chromium getLogins  
INFO: Didn’t find any Chrome Login Data files.  
2022-12-20 08:08:55.283 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill  
INFO: Didn’t find any Chrome Web Data files.  
2022-12-20 08:08:55.283 org.sleuthkit.autopsy.recentactivity.Chromium getDownload  
INFO: Didn’t find any Chrome download files.  
2022-12-20 08:08:55.284 org.sleuthkit.autopsy.recentactivity.Chromium getHistory  
INFO: Could not find any allocated Chrome history files.  
2022-12-20 08:08:55.284 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark  
INFO: Didn’t find any Chrome bookmark files.  
2022-12-20 08:08:55.284 org.sleuthkit.autopsy.recentactivity.Chromium getCookie  
INFO: Didn’t find any Chrome cookies files.  
2022-12-20 08:08:55.285 org.sleuthkit.autopsy.recentactivity.Chromium getLogins  
INFO: Didn’t find any Chrome Login Data files.  
2022-12-20 08:08:55.285 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill  
INFO: Didn’t find any Chrome Web Data files.  
2022-12-20 08:08:55.286 org.sleuthkit.autopsy.recentactivity.Chromium getDownload  
INFO: Didn’t find any Chrome download files.  
2022-12-20 08:08:55.286 org.sleuthkit.autopsy.recentactivity.Chromium getHistory  
INFO: Could not find any allocated Chrome history files.  
2022-12-20 08:08:55.286 org.sleuthkit.autopsy.recentactivity.Chromium getBookmark  
INFO: Didn’t find any Chrome bookmark files.  
2022-12-20 08:08:55.287 org.sleuthkit.autopsy.recentactivity.Chromium getCookie  
INFO: Didn’t find any Chrome cookies files.  
2022-12-20 08:08:55.287 org.sleuthkit.autopsy.recentactivity.Chromium getLogins  
INFO: Didn’t find any Chrome Login Data files.  
2022-12-20 08:08:55.288 org.sleuthkit.autopsy.recentactivity.Chromium getAutofill  
INFO: Didn’t find any Chrome Web Data files.  
2022-12-20 08:08:55.288 org.sleuthkit.autopsy.recentactivity.Chromium getDownload  
INFO: Didn’t find any Chrome download files.  
2022-12-20 08:08:55.291 org.sleuthkit.autopsy.recentactivity.Firefox getHistory  
INFO: No FireFox history files found.  
2022-12-20 08:08:55.291 org.sleuthkit.autopsy.recentactivity.Firefox getBookmark  
INFO: Didn’t find any firefox bookmark files.  
2022-12-20 08:08:55.291 org.sleuthkit.autopsy.recentactivity.Firefox getDownloadPreVersion24  
INFO: Didn’t find any pre-version-24.0 Firefox download files.  
2022-12-20 08:08:55.292 org.sleuthkit.autopsy.recentactivity.Firefox getDownloadVersion24  
INFO: Didn’t find any version-24.0 Firefox download files.  
2022-12-20 08:08:55.292 org.sleuthkit.autopsy.recentactivity.Firefox getCookie  
INFO: Didn’t find any Firefox cookie files.  
2022-12-20 08:08:55.292 org.sleuthkit.autopsy.recentactivity.Firefox getFormsHistory  
INFO: No FireFox form history files found.  
2022-12-20 08:08:55.292 org.sleuthkit.autopsy.recentactivity.Firefox getAutofillProfiles  
INFO: Didn’t find any Firefox Autofill Profiles files.  
2022-12-20 08:08:55.294 org.sleuthkit.autopsy.recentactivity.ExtractIE getBookmark  
INFO: Didn’t find any IE bookmark files.  
2022-12-20 08:08:55.295 org.sleuthkit.autopsy.recentactivity.ExtractIE getCookie  
INFO: Didn’t find any IE cookies files.  
2022-12-20 08:08:55.295 org.sleuthkit.autopsy.recentactivity.ExtractIE getHistory  
INFO: Pasco results path: C:\Users\li296n\AppData\Local\Temp\Autopsy\inc0721549\_20221220\_080242\Temp\RecentActivity\IE\_0\results  
2022-12-20 08:08:55.296 org.sleuthkit.autopsy.recentactivity.ExtractIE getHistory  
INFO: Pasco2 home: C:\Program Files\Autopsy-4.19.3\autopsy\pasco2  
2022-12-20 08:08:55.297 org.sleuthkit.autopsy.recentactivity.ExtractIE getHistory  
INFO: No InternetExplorer history files found.  
2022-12-20 08:08:55.299 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer findSearchQueries  
INFO: Processing 0 blackboard artifacts.  
2022-12-20 08:08:55.3 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer findSearchQueries  
INFO: Extracted 0 queries from the blackboard  
2022-12-20 08:08:55.3 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer process  
INFO: Search Engine stats:  
Google : 0  
Yahoo : 0  
Twitter : 0  
LinkedIn : 0  
Facebook : 0  
Bing : 0  
Baidu : 0  
Sogou : 0  
Soso : 0  
Youdao : 0  
Yandex : 0  
Biglobe : 0  
Linkestan : 0  
Parseek : 0  
Parset : 0  
Amazon : 0  
DuckDuckGo : 0  
Youtube : 0  
Reddit : 0  
CCSearch : 0  
Swisscows : 0  
GIbiru : 0  
Wiki : 0  
Cutestat : 0  
Givewater : 0  
Ekoru : 0  
Ecosia : 0  
Slideshare : 0  
Wikipedia : 0  
Wiki : 0

2022-12-20 08:08:55.3 org.sleuthkit.autopsy.recentactivity.ExtractWebAccountType extractDomainRoles  
INFO: Processing 0 blackboard artifacts.  
2022-12-20 08:08:55.301 org.sleuthkit.autopsy.recentactivity.ExtractWebAccountType$RoleProcessor createArtifacts  
INFO: Didn’t find any web accounts.  
2022-12-20 08:09:00.684 org.sleuthkit.autopsy.recentactivity.DomainCategoryRunner findDomainTypes  
INFO: Processing 0 blackboard artifacts.  
2022-12-20 08:09:00.684 org.sleuthkit.autopsy.recentactivity.DomainCategoryRunner findDomainTypes  
INFO: Extracted 0 distinct messaging domain(s) from the blackboard. Of the 0 artifact(s) with valid hosts, 0 url(s) contained messaging domain suffix.  
2022-12-20 08:09:00.685 org.sleuthkit.autopsy.recentactivity.SearchEngineURLQueryAnalyzer complete  
INFO: Search Engine URL Query Analyzer has completed.  
2022-12-20 08:09:00.685 org.sleuthkit.autopsy.recentactivity.DomainCategoryRunner complete  
INFO: Domain categorization completed.  
2022-12-20 08:09:00.685 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: Recent Activity analysis of INC0721549.E01 finished  
2022-12-20 08:09:00.685 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: Encryption Detection analysis of INC0721549.E01 starting  
2022-12-20 08:09:00.686 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: Encryption Detection analysis of INC0721549.E01 finished  
2022-12-20 08:09:00.686 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: Virtual Machine Extractor analysis of INC0721549.E01 starting  
2022-12-20 08:09:00.686 org.sleuthkit.autopsy.modules.vmextractor.VMExtractorIngestModule process  
INFO: Looking for virtual machine files in data source INC0721549.E01  
2022-12-20 08:09:00.687 org.sleuthkit.autopsy.modules.vmextractor.VMExtractorIngestModule process  
INFO: No virtual machine files found in data source INC0721549.E01  
2022-12-20 08:09:00.687 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: Virtual Machine Extractor analysis of INC0721549.E01 finished  
2022-12-20 08:09:00.687 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: DJI Drone Analyzer analysis of INC0721549.E01 starting  
2022-12-20 08:09:00.69 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: DJI Drone Analyzer analysis of INC0721549.E01 finished  
2022-12-20 08:09:00.691 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: Plaso analysis of INC0721549.E01 starting  
2022-12-20 08:09:00.693 org.sleuthkit.autopsy.modules.plaso.PlasoIngestModule process  
INFO: Starting Plaso Run.  
2022-12-20 08:23:55.098 org.sleuthkit.autopsy.modules.plaso.PlasoIngestModule createPlasoArtifacts  
INFO: PlasoDB was empty: D:\INC0721549\autopsy\INC0721549\ModuleOutput\plaso\2022-12-20 08-09-00 EST\plasodb.db3  
2022-12-20 08:23:55.099 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: Plaso analysis of INC0721549.E01 finished  
2022-12-20 08:23:55.099 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage  
INFO: Finished first stage analysis (data source = INC0721549.E01, objId = 1, pipeline id = 0, ingest job id = 1)  
2022-12-20 08:23:55.101 org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule shutDown  
INFO: Keyword search ingest module instance 1 shutting down  
2022-12-20 08:23:55.122 org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModule shutDown  
INFO: 1 artifacts in db for case: INC0721549 ds:INC0721549.E01  
2022-12-20 08:23:55.13 org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule shutDown  
INFO: Keyword search ingest module instance 0 shutting down  
2022-12-20 08:23:55.14 org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule shutDown  
INFO: Indexed files count: 0  
2022-12-20 08:23:55.142 org.sleuthkit.autopsy.keywordsearch.KeywordSearchIngestModule shutDown  
INFO: Indexed file chunks count: 0  
2022-12-20 08:23:55.145 org.sleuthkit.autopsy.centralrepository.ingestmodule.CentralRepoIngestModule shutDown  
INFO: 1 artifacts in db for case: INC0721549 ds:INC0721549.E01  
2022-12-20 08:23:55.146 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage  
INFO: Starting second stage ingest task pipelines for INC0721549.E01 (objID=1, jobID=0) (data source = INC0721549.E01, objId = 1, pipeline id = 0, ingest job id = 1)  
2022-12-20 08:23:55.146 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: Data Source Integrity analysis of INC0721549.E01 starting  
2022-12-20 08:23:55.148 org.sleuthkit.autopsy.modules.dataSourceIntegrity.DataSourceIntegrityIngestModule process  
INFO: Total chunks = 15 560 128  
2022-12-20 08:23:55.148 org.sleuthkit.autopsy.modules.dataSourceIntegrity.DataSourceIntegrityIngestModule process  
INFO: Starting hash calculation for INC0721549.E01  
2022-12-20 08:24:51.094 org.sleuthkit.autopsy.ingest.DataSourceIngestPipeline$DataSourcePipelineModule executeTask  
INFO: Data Source Integrity analysis of INC0721549.E01 finished  
2022-12-20 08:24:51.094 org.sleuthkit.autopsy.ingest.IngestJobPipeline logInfoMessage  
INFO: Finished all tasks (data source = INC0721549.E01, objId = 1, pipeline id = 0, ingest job id = 1)  
2022-12-20 08:24:51.105 org.sleuthkit.autopsy.ingest.IngestManager finishIngestJob  
INFO: Ingest job 0 completed  
2022-12-20 08:24:54.407 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase  
INFO: Closing current case INC0721549 (inc0721549\_20221220\_080242) in D:\INC0721549\autopsy\INC0721549  
2022-12-20 08:24:56.45 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown  
INFO: Shutting down image gallery controller for case INC0721549 (inc0721549\_20221220\_080242)  
2022-12-20 08:24:56.451 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB close  
INFO: Closing the drawable.db  
2022-12-20 08:24:56.454 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown  
INFO: Completed shut down of image gallery controller for case INC0721549 (inc0721549\_20221220\_080242)  
2022-12-20 08:27:13.596 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr  
INFO: Stopping Solr 8 server  
2022-12-20 08:27:13.596 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand  
INFO: Setting Solr 8 directory: C:\Program Files\Autopsy-4.19.3\autopsy\solr  
2022-12-20 08:27:13.597 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand  
INFO: Running Solr 8 command: [C:\Program Files\Autopsy-4.19.3\autopsy\solr\bin\autopsy-solr.cmd, stop, -k, jjk#09s, -p, 23232] from C:\Program Files\Autopsy-4.19.3\autopsy\solr  
2022-12-20 08:27:13.63 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand  
INFO: Finished running Solr 8 command  
2022-12-20 08:27:13.63 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr  
INFO: Waiting for Solr server to stop

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [December 20, 2022, 3:43pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/4 "2022-12-20T15:43:04Z")

</div>

autopsy.log.1

2022-12-20 08:27:33.423 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning  
INFO: Solr server is running  
2022-12-20 08:27:33.822 org.sleuthkit.autopsy.centralrepository.datamodel.RdbmsCentralRepo upgradeSchema  
INFO: Central Repository is up to date  
2022-12-20 08:27:33.987 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr  
INFO: New Solr process PID: [21200]  
2022-12-20 08:27:33.987 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr  
INFO: Starting local Solr SOLR8 server  
2022-12-20 08:27:33.992 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning  
INFO: Solr server is running  
2022-12-20 08:27:33.992 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr  
INFO: Local Solr SOLR8 server is already running  
2022-12-20 08:27:33.994 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning  
INFO: Solr server is running  
2022-12-20 08:27:34.976 org.sleuthkit.autopsy.keywordsearch.Server$Collection   
INFO: Using Solr document queue size = 30  
2022-12-20 08:27:35.144 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas  
INFO: sqlite-jdbc version 3.25.2 loaded in native mode  
2022-12-20 08:27:35.201 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase  
INFO: Opened INC0721549 (inc0721549\_20221220\_080242) in D:\INC0721549\autopsy\INC0721549 as the current case  
2022-12-20 08:27:35.201 org.sleuthkit.autopsy.progress.LoggingProgressIndicator progress  
INFO: Retrieving images for case: autopsy.db…  
2022-12-20 08:27:35.203 org.sleuthkit.autopsy.progress.LoggingProgressIndicator progress  
INFO: Opening all filesystems for image: INC0721549.E01…  
2022-12-20 08:27:35.326 org.sleuthkit.autopsy.corecomponents.DataContentViewerHex   
INFO: Created HexView instance: org.sleuthkit.autopsy.corecomponents.DataContentViewerHex[,0,0,0x0,invalid,layout=javax.swing.GroupLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=java.awt.Dimension[width=100,height=58]]  
2022-12-20 08:27:35.563 org.sleuthkit.autopsy.contentviewers.MediaFileViewer   
INFO: Created MediaView instance: org.sleuthkit.autopsy.contentviewers.MediaFileViewer[,0,0,0x0,invalid,layout=java.awt.CardLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]  
2022-12-20 08:27:35.696 org.sleuthkit.autopsy.contentviewers.FileViewer   
INFO: Created ApplicationContentViewer instance: org.sleuthkit.autopsy.contentviewers.FileViewer[,0,0,0x0,invalid,layout=javax.swing.OverlayLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]  
2022-12-20 08:27:35.806 org.sleuthkit.autopsy.corecomponents.DataContentTopComponent   
INFO: Created DataContentTopComponent instance: org.sleuthkit.autopsy.corecomponents.DataContentTopComponent[Data Content,0,0,0x0,invalid,layout=javax.swing.BoxLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=256,maximumSize=,minimumSize=,preferredSize=]  
2022-12-20 08:28:06.72 org.sleuthkit.autopsy.contentviewers.FileViewer isSupported  
INFO: Mimetype not known for file: Unalloc\_6\_121109131264\_122182873088  
2022-12-20 08:28:15.226 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr  
INFO: Stopping Solr 8 server  
2022-12-20 08:28:15.227 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand  
INFO: Setting Solr 8 directory: C:\Program Files\Autopsy-4.19.3\autopsy\solr  
2022-12-20 08:28:15.227 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand  
INFO: Running Solr 8 command: [C:\Program Files\Autopsy-4.19.3\autopsy\solr\bin\autopsy-solr.cmd, stop, -k, jjk#09s, -p, 23232] from C:\Program Files\Autopsy-4.19.3\autopsy\solr  
2022-12-20 08:28:15.261 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand  
INFO: Finished running Solr 8 command  
2022-12-20 08:28:15.261 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr  
INFO: Waiting for Solr server to stop  
2022-12-20 08:28:17.619 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr  
INFO: Finished stopping Solr server  
2022-12-20 08:28:17.619 org.sleuthkit.autopsy.core.Installer   
INFO: core installer created  
2022-12-20 08:28:17.665 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase  
INFO: Closing current case INC0721549 (inc0721549\_20221220\_080242) in D:\INC0721549\autopsy\INC0721549  
2022-12-20 08:28:19.672 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown  
INFO: Shutting down image gallery controller for case INC0721549 (inc0721549\_20221220\_080242)  
2022-12-20 08:28:19.674 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB close  
INFO: Closing the drawable.db  
2022-12-20 08:28:19.676 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown  
INFO: Completed shut down of image gallery controller for case INC0721549 (inc0721549\_20221220\_080242)

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [December 20, 2022, 3:44pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/5 "2022-12-20T15:44:36Z")

</div>

autopsy.log.0

2022-12-20 08:36:01.07 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning  
INFO: Solr server is running  
2022-12-20 08:36:01.751 org.sleuthkit.autopsy.centralrepository.datamodel.RdbmsCentralRepo upgradeSchema  
INFO: Central Repository is up to date  
2022-12-20 08:36:01.808 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr  
INFO: New Solr process PID: [15764]  
2022-12-20 08:36:01.814 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr  
INFO: Starting local Solr SOLR8 server  
2022-12-20 08:36:01.82 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning  
INFO: Solr server is running  
2022-12-20 08:36:01.82 org.sleuthkit.autopsy.keywordsearch.Server startLocalSolr  
INFO: Local Solr SOLR8 server is already running  
2022-12-20 08:36:01.823 org.sleuthkit.autopsy.keywordsearch.Server isLocalSolrRunning  
INFO: Solr server is running  
2022-12-20 08:36:02.826 org.sleuthkit.autopsy.keywordsearch.Server$Collection   
INFO: Using Solr document queue size = 30  
2022-12-20 08:36:02.97 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas  
INFO: sqlite-jdbc version 3.25.2 loaded in native mode  
2022-12-20 08:36:03.058 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase  
INFO: Opened INC0721549 (inc0721549\_20221220\_080242) in D:\INC0721549\autopsy\INC0721549 as the current case  
2022-12-20 08:36:03.059 org.sleuthkit.autopsy.progress.LoggingProgressIndicator progress  
INFO: Retrieving images for case: autopsy.db…  
2022-12-20 08:36:03.06 org.sleuthkit.autopsy.progress.LoggingProgressIndicator progress  
INFO: Opening all filesystems for image: INC0721549.E01…  
2022-12-20 08:36:03.181 org.sleuthkit.autopsy.corecomponents.DataContentViewerHex   
INFO: Created HexView instance: org.sleuthkit.autopsy.corecomponents.DataContentViewerHex[,0,0,0x0,invalid,layout=javax.swing.GroupLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=java.awt.Dimension[width=100,height=58]]  
2022-12-20 08:36:03.384 org.sleuthkit.autopsy.contentviewers.MediaFileViewer   
INFO: Created MediaView instance: org.sleuthkit.autopsy.contentviewers.MediaFileViewer[,0,0,0x0,invalid,layout=java.awt.CardLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]  
2022-12-20 08:36:03.535 org.sleuthkit.autopsy.contentviewers.FileViewer   
INFO: Created ApplicationContentViewer instance: org.sleuthkit.autopsy.contentviewers.FileViewer[,0,0,0x0,invalid,layout=javax.swing.OverlayLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=9,maximumSize=,minimumSize=,preferredSize=]  
2022-12-20 08:36:03.68 org.sleuthkit.autopsy.corecomponents.DataContentTopComponent   
INFO: Created DataContentTopComponent instance: org.sleuthkit.autopsy.corecomponents.DataContentTopComponent[Data Content,0,0,0x0,invalid,layout=javax.swing.BoxLayout,alignmentX=0.0,alignmentY=0.0,border=,flags=256,maximumSize=,minimumSize=,preferredSize=]  
2022-12-20 08:37:58.062 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Central Repository, version = 4.19.3  
2022-12-20 08:37:58.068 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Data Source Integrity, version = 4.19.3  
2022-12-20 08:37:58.073 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = DJI Drone Analyzer, version = 4.19.3  
2022-12-20 08:37:58.078 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Embedded File Extractor, version = 4.19.3  
2022-12-20 08:37:58.079 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Encryption Detection, version = 4.19.3  
2022-12-20 08:37:58.084 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Extension Mismatch Detector, version = 4.19.3  
2022-12-20 08:37:58.089 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = File Type Identification, version = 4.19.3  
2022-12-20 08:37:58.094 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Hash Lookup, version = 4.19.3  
2022-12-20 08:37:58.094 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Interesting Files Identifier, version = 4.19.3  
2022-12-20 08:37:58.099 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Android Analyzer (aLEAPP), version = 4.19.3  
2022-12-20 08:37:58.099 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = iOS Analyzer (iLEAPP), version = 4.19.3  
2022-12-20 08:37:58.104 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = PhotoRec Carver, version = 7.0  
2022-12-20 08:37:58.11 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Picture Analyzer, version = 4.19.3  
2022-12-20 08:37:58.115 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Plaso, version = 4.19.3  
2022-12-20 08:37:58.12 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Virtual Machine Extractor, version = 4.19.3  
2022-12-20 08:37:58.125 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = YARA Analyzer, version = 4.19.3  
2022-12-20 08:37:58.126 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Keyword Search, version = 4.19.3  
2022-12-20 08:37:58.128 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Email Parser, version = 4.19.3  
2022-12-20 08:37:58.129 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader addFactory  
INFO: Found ingest module factory: name = Recent Activity, version = 4.19.3  
2022-12-20 08:37:58.194 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories  
INFO: Found ingest module factory: name = GPX Parser, version = 1.2  
2022-12-20 08:37:58.194 org.sleuthkit.autopsy.ingest.IngestModuleFactoryLoader getIngestModuleFactories  
INFO: Found ingest module factory: name = Android Analyzer, version = 4.19.3  
2022-12-20 08:41:13.329 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr  
INFO: Stopping Solr 8 server  
2022-12-20 08:41:13.329 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand  
INFO: Setting Solr 8 directory: C:\Program Files\Autopsy-4.19.3\autopsy\solr  
2022-12-20 08:41:13.33 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand  
INFO: Running Solr 8 command: [C:\Program Files\Autopsy-4.19.3\autopsy\solr\bin\autopsy-solr.cmd, stop, -k, jjk#09s, -p, 23232] from C:\Program Files\Autopsy-4.19.3\autopsy\solr  
2022-12-20 08:41:13.364 org.sleuthkit.autopsy.keywordsearch.Server runLocalSolr8ControlCommand  
INFO: Finished running Solr 8 command  
2022-12-20 08:41:13.364 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr  
INFO: Waiting for Solr server to stop  
2022-12-20 08:41:15.95 org.sleuthkit.autopsy.keywordsearch.Server stopLocalSolr  
INFO: Finished stopping Solr server  
2022-12-20 08:41:15.95 org.sleuthkit.autopsy.core.Installer   
INFO: core installer created  
2022-12-20 08:41:16.027 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase  
INFO: Closing current case INC0721549 (inc0721549\_20221220\_080242) in D:\INC0721549\autopsy\INC0721549  
2022-12-20 08:41:18.035 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown  
INFO: Shutting down image gallery controller for case INC0721549 (inc0721549\_20221220\_080242)  
2022-12-20 08:41:18.039 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB close  
INFO: Closing the drawable.db  
2022-12-20 08:41:18.042 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown  
INFO: Completed shut down of image gallery controller for case INC0721549 (inc0721549\_20221220\_080242)

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [December 21, 2022, 12:39pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/6 "2022-12-21T12:39:56Z")

</div>

When i add a data source i do this :  
 ![2](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/5/5372222dc9c137f7b579441bcc9598bea6de5fd8.png)  
i choose the E01 file.

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [January 5, 2023, 1:21pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/7 "2023-01-05T13:21:16Z")

</div>

Any idea what’s wrong?

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [January 5, 2023, 2:38pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/8 "2023-01-05T14:38:50Z")

</div>

What are the first 6 bytes of the E01 files?

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [January 5, 2023, 3:01pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/9 "2023-01-05T15:01:51Z")

</div>

Here is the first screencapture for the file encase that i cannot open in Autopsy:

![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/6/645a9a59752b45a2063f6435bd7317115c7e003e.png)

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [January 5, 2023, 3:02pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/10 "2023-01-05T15:02:23Z")

</div>

and here info about an encase file that was able to open in Autopsy:

![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/1/1a2327b102862df6e0b94b27ab257192996c2dcd.png)

---

<div class="post-metadata">

**Author:** ![tbell032](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/tbell032/32/1721_2.png) [@tbell032](https://sleuthkit.discourse.group/u/tbell032)\
**Post date:** [January 5, 2023, 3:14pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/11 "2023-01-05T15:14:53Z")

</div>

[https://www.sleuthkit.org/informer/sleuthkit-informer-23.txt](https://www.sleuthkit.org/informer/sleuthkit-informer-23.txt)

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [January 5, 2023, 3:17pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/12 "2023-01-05T15:17:16Z")

</div>

??? what i have to look for in this link?

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [January 5, 2023, 3:30pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/13 "2023-01-05T15:30:44Z")

</div>

Can you create a small test image that does not work and send it to me so I can see what the issue is?

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [January 5, 2023, 3:32pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/14 "2023-01-05T15:32:16Z")

</div>

ok i will do this as soon as i can.

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [January 13, 2023, 2:03pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/15 "2023-01-13T14:03:27Z")

</div>

i didn’t have time yet to create a test file . but i’m in another forensic case, and still the same probleme. the file .e01 is open in FTK imager but cannot see the file system in Autopsy:

 ![Capture](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/c/ccec02853a536bbccf04166c97b697a9fb300e12.png)

---

<div class="post-metadata">

**Author:** ![Adriana\_Reinoso\_Vasq](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/adriana_reinoso_vasq/32/1793_2.png) [@Adriana\_Reinoso\_Vasq](https://sleuthkit.discourse.group/u/Adriana_Reinoso_Vasq)\
**Post date:** [March 21, 2023, 1:32pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/16 "2023-03-21T13:32:39Z")

</div>

Hello, can you resolve the problem, actually i have the same problem. Can you help me

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [March 21, 2023, 5:46pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/17 "2023-03-21T17:46:35Z")

</div>

If you can provide a image file I can try and see what the issue is but without the sample image I can’t determine if and what the problem is.

---

<div class="post-metadata">

**Author:** ![Adriana\_Reinoso\_Vasq](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/adriana_reinoso_vasq/32/1793_2.png) [@Adriana\_Reinoso\_Vasq](https://sleuthkit.discourse.group/u/Adriana_Reinoso_Vasq)\
**Post date:** [March 21, 2023, 9:55pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/18 "2023-03-21T21:55:25Z")

</div>

the image file is big, but when load the image in autopsy this is the result

 ![2023-03-21_16-52-53](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/1/1530cc5b89135dbdade19b71aeb14bfea6e69d82.jpeg)

And in logs says:  
WARNING: Non-critical error occurred adding image C:\Users\adrir\Desktop\Disco.E01  
org.sleuthkit.datamodel.TskDataException: Errors occurred while ingesting image

1. Cannot determine file system type (Sector offset: 1, Partition Type: GPT Safety Partition (0xee))

2. Cannot determine file system type (Sector offset: 1, Partition Type: GPT Safety Partition (0xee))

2023-03-21 16:37:43.389 org.sleuthkit.autopsy.casemodule.AddImageWizardAddingProgressPanel lambda$dataSourceProcessorDone$1  
WARNING: DatasourceID: 7e490750-bf5a-4e06-9c5d-5025fe26c069 Error Message:  
Possible Incomplete Image: Error reading volume at offset 2.199.023.255.040  
2023-03-21 16:43:25.134 org.sleuthkit.autopsy.contentviewers.FileViewer isSupported  
INFO: Mimetype not known for file: Unalloc\_4\_1008243573248\_1009317315072

Can you Help me please?

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [March 22, 2023, 12:46pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/19 "2023-03-22T12:46:30Z")

</div>

If you run the data source integrity ingest module what are the results from the run?

---

<div class="post-metadata">

**Author:** ![nadvig](https://avatars.discourse-cdn.com/v4/letter/n/f6c823/32.png) [@nadvig](https://sleuthkit.discourse.group/u/nadvig)\
**Post date:** [March 22, 2023, 1:01pm UTC](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530/20 "2023-03-22T13:01:19Z")

</div>

Hello there !

since my 4-5 last acquisitions i do not have the probleme once in Autopsy when i opened the E01 file 🙂

look at the screenshot : i only have to “check” Entries and go to Acquire.

 ![2](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/1/1e238d8fc81912bed8a330025e31f7a1c2ff9936.png)

since i “check” Entries & do the Acquisitions, when i open the E01 file in Autopsy everything is there (file system…).

[Next page](https://sleuthkit.discourse.group/t/encase-e01-autopsy/3530.md?page=2)