I have following error in log file when i add an image to the case.
Errors occurred while ingesting image
- Cannot determine file system type (Sector offset: 1026048, Partition Type: Microsoft reserved partition)
My image is an E01 files (total E01 file size about 80GB) and imaged disk size is about 1TB.
- Will this affect the injest? How to solve this?
That’s fine. When adding an image, Autopsy looks at every partition and tries to figure out what file system is present. Some partitions will never have a file system (such as your https://en.wikipedia.org/wiki/Microsoft_Reserved_Partition). These are reported as non-critical errors. The data in each of these partitions is then added to the case as an unallocated block.
Here I have a image with several blocks without file systems. You can see that these are added to the case as unallocated blocks.
1 Like
