Hello,
The Extracted Content in the Results does not show “Operating System Information” and “Device Attached”, even after I select Recent Activity in Ingest Module while using Autopsy 4.13.0
Help me out.
Regards
Have you validated that you have the proper registry hive(s) to get the information that you are expecting as well as looking at the the registry hives for the data?
I don’t know how to validate and the process for it.
Also, please explain how and where to look into registry hives in autopsy.
I tried to look into ntuser.dat and other system files.
The image I am working with is one which i downloaded from internet for practice purpose and the image file is nps-2008-jean.E01
There was an error in the reg ripper script that had issues with the year 2020. It effects all versions of Autopsy and prevents the majority of data from the registry from being properly extracted.
This will be fixed in Autopsy 4.14. The jean image should have two OS system info results and 14 device attached results.
1 Like
Thank you so much, Highly Appreciated
Has this been fixed? I am running through the tutorial and am using Autopsy 4.14.0 for Windows. Everything so far seems to be working great, except I am not seeing the same information as mentioned above ( this is for section 8: Recent Activity).
Thank you and big thanks for opening up the tutorial!!! I am learning so much about this wonderful product!