# Extract results in 0 KB file size for exported files. **URL:** \ **Category:** Autopsy Help\ **Created:** [August 25, 2022, 7:28pm UTC](https://sleuthkit.discourse.group/t/extract-results-in-0-kb-file-size-for-exported-files/3372 "2022-08-25T19:28:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![mikemars](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@mikemars](https://sleuthkit.discourse.group/u/mikemars)\ **Post date:** [August 25, 2022, 7:28pm UTC](https://sleuthkit.discourse.group/t/extract-results-in-0-kb-file-size-for-exported-files/3372/1 "2022-08-25T19:28:31Z")
I am new to Autopsy and seeking some assistance. I am using version 4.19.3 64bit on a Windows 11 operating system. I am having issues with “Extract Files” functionality. While in “Listing” view, I right-click on the file of interest. I select “Extract File(s). I then select the location for the selected file to be saved. Upon saving, I get a dialog message "File(s) Extracted When reviewing the files in the Export folder, all export files reflect 0 KB file size. The TXT and HTML files opens yet shows no content. The PDF and XLS files error out when attempting to open. I have Googled this issue with limited hits and nothing “on point”. I suspect “user error” and seeking guidance. ---
**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\ **Post date:** [August 25, 2022, 7:32pm UTC](https://sleuthkit.discourse.group/t/extract-results-in-0-kb-file-size-for-exported-files/3372/2 "2022-08-25T19:32:35Z")
Do the files you’re trying to export show a non-zero file size in the “Size” column in the result viewer? ![](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/d/d8f857f0a8bb062504259f2d43af58efaaedac79.png) Can you view their data on the hex tab? ![](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/6/6cae9d5bb40497a988291b04ac32186c2f0879fb.png) If all that looks good, try to export again and then look for errors in the log file. [http://sleuthkit.org/autopsy/docs/user-docs/4.19.3/troubleshooting\_page.html#troubleshooting\_logs](http://sleuthkit.org/autopsy/docs/user-docs/4.19.3/troubleshooting_page.html#troubleshooting_logs) ---
**Author:** ![mikemars](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@mikemars](https://sleuthkit.discourse.group/u/mikemars)\ **Post date:** [August 25, 2022, 8:34pm UTC](https://sleuthkit.discourse.group/t/extract-results-in-0-kb-file-size-for-exported-files/3372/3 "2022-08-25T20:34:09Z")
Continuing the discussion from [Extract results in 0 KB file size for exported files.](https://sleuthkit.discourse.group/t/extract-results-in-0-kb-file-size-for-exported-files/3372): I do see the size in the “Size” column In Hex view I get this. Not what I would expect. ![Screen2](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/2/2402f93ad66dd50563ce9109e1861649fe695ca9.jpeg) When I view the Export folder on my PC, I see the correct file names with 0 KB size. I will look at the log file but do to the fact that the Hex view shows “(offset 0-16,384 could not be read)”, I suspect something else is the issue. ---
**Author:** ![mikemars](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@mikemars](https://sleuthkit.discourse.group/u/mikemars)\ **Post date:** [August 25, 2022, 8:36pm UTC](https://sleuthkit.discourse.group/t/extract-results-in-0-kb-file-size-for-exported-files/3372/4 "2022-08-25T20:36:35Z")
Sorry…this is what I get in Hex view. ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/2X/3/3581b945895d2db97309310cdbf4e95ce5fc9951.png) ---
**Author:** ![mikemars](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@mikemars](https://sleuthkit.discourse.group/u/mikemars)\ **Post date:** [August 25, 2022, 9:08pm UTC](https://sleuthkit.discourse.group/t/extract-results-in-0-kb-file-size-for-exported-files/3372/5 "2022-08-25T21:08:10Z")
Here is the Log entry when attempting to do a Extract. My C drive has the operating system (Windows 11) and the Autopsy application. My D drive has the Case file and all other associated folders/files. My C drive is encrypted. My D drive is not encrypted. Is my encrypted C drive the issue? 2022-08-25 15:49:48.713 org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor visit WARNING: Error reading file ‘2021 12 24 - Payroll Timesheets CTB.xlsx’ (id=322261). org.sleuthkit.datamodel.ReadContentInputStream$ReadContentInputStreamException: Error reading file ‘2021 12 24 - Payroll Timesheets CTB.xlsx’ (id=322261) at offset 0. org.sleuthkit.datamodel.ReadContentInputStream.read(ReadContentInputStream.java:105) org.sleuthkit.datamodel.ReadContentInputStream.read(ReadContentInputStream.java:47) org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile(ContentUtils.java:211) org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.visit(ContentUtils.java:399) org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.visit(ContentUtils.java:357) org.sleuthkit.datamodel.File.accept(File.java:128) org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.extract(ContentUtils.java:393) org.sleuthkit.autopsy.directorytree.actionhelpers.ExtractActionHelper$FileExtracter.doInBackground(ExtractActionHelper.java:325) javax.swing.SwingWorker$1.call(SwingWorker.java:295) java.util.concurrent.FutureTask.run(FutureTask.java:266) javax.swing.SwingWorker.run(SwingWorker.java:334) java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) java.lang.Thread.run(Thread.java:748) org.sleuthkit.datamodel.TskCoreException: Possible encryption detected (High entropy (8.00)) org.sleuthkit.datamodel.ReadContentInputStream.read(ReadContentInputStream.java:105) org.sleuthkit.datamodel.ReadContentInputStream.read(ReadContentInputStream.java:47) org.sleuthkit.autopsy.datamodel.ContentUtils.writeToFile(ContentUtils.java:211) org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.visit(ContentUtils.java:399) org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.visit(ContentUtils.java:357) org.sleuthkit.datamodel.File.accept(File.java:128) org.sleuthkit.autopsy.datamodel.ContentUtils$ExtractFscContentVisitor.extract(ContentUtils.java:393) org.sleuthkit.autopsy.directorytree.actionhelpers.ExtractActionHelper$FileExtracter.doInBackground(ExtractActionHelper.java:325) javax.swing.SwingWorker$1.call(SwingWorker.java:295) java.util.concurrent.FutureTask.run(FutureTask.java:266) javax.swing.SwingWorker.run(SwingWorker.java:334) java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) java.lang.Thread.run(Thread.java:748) ---
**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Post date:** [August 25, 2022, 9:57pm UTC](https://sleuthkit.discourse.group/t/extract-results-in-0-kb-file-size-for-exported-files/3372/6 "2022-08-25T21:57:42Z")
Just curious is this datasource an image file and if so have you hashed the data source integrity module to make sure it is not corrupted? ---
**Author:** ![mikemars](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@mikemars](https://sleuthkit.discourse.group/u/mikemars)\ **Post date:** [August 25, 2022, 11:17pm UTC](https://sleuthkit.discourse.group/t/extract-results-in-0-kb-file-size-for-exported-files/3372/7 "2022-08-25T23:17:03Z")
I was given an “image file” (Image.E01 to image.EEM). Autopsy reads the image file with no issues or errors. I have searched the image file using Keywords and have receive hits that I suspected would be there. When trying to extract the files with these hits, is when I obtain an extracted file with 0 bytes. ---
**Author:** ![mikemars](https://avatars.discourse-cdn.com/v4/letter/m/e19b73/32.png) [@mikemars](https://sleuthkit.discourse.group/u/mikemars)\ **Post date:** [August 25, 2022, 11:19pm UTC](https://sleuthkit.discourse.group/t/extract-results-in-0-kb-file-size-for-exported-files/3372/8 "2022-08-25T23:19:20Z")
I have removed encryption from the C drive but am getting the same results when trying to Extract a file. Still 0 bytes.