I am new to Autopsy and just want to carve files from a USB Thumb Drive, just as an exercise. I am using the PhotoRec Carver. This is the only feature that is selected (I am assuming this is correct).
The error I get is…
“Unable to start up one or more ingest modules, ingest cancelled. Please disable the failed modules or fix the errors before restarting ingest.”
“Errors: PhotoRec Carver: The selected file ingest filter ingnores unalocated space. This module carves unalocated space. Please choose a filter which does not ignore unalocated space or disable…”
I was working from a dd/raw image of the thumb drive generated with FTK Imager. I also tried working without an image and just added the thumb drive as a local physical disk.
How can I address this issue?
Keep in mind that all I am trying to do is demonstrate carving with Autopsy. I’ll try a different approach if that is what you suggest.
Tim
