Issues Adding Source Data "failed to add data source" - drive with no FS

I am having an issue adding a “local drive” as well as a “disk image” of the same drive (e01 - should have tried single file raw DD but I doubt that’s the issue) to an autopsy case. I get the following errors,

“*Failed to add data source (critical errors encountered). Click below to view the log.”

Log below,

Errors occurred while ingesting image

  1. Cannot determine file system type (Sector offset: 0)

I believe this drive to be empty (wiped), however, my compressed e01 of the drive is over 1GB (750gb physical drive) and to me, that seems reasonable to believe there might be something on there. Regardless of data present, how are you supposed to analyze a drive that is raw (not containing a file system)? FTK Imager pulls it up without flaw so i browse in HEX view. Of course, I don’t want to browse in the HEX view to find anything. I’d rather have a tool carve it for me.

Any suggestions? Am I ingesting the image/drive incorrectly?

Any and all help is appreciated.

Thank you!

Try and add the data source as an “Unallocated Space Image File”.

Appears to have added the file. Does this work with all image types (raw, dd, e01, segmentation, etc)? Also is there a way to essentially add an “unallocated” physical drive?

Yes it should work with all image types. Not sure if you can add a “unallocated” physical drive.

1 Like

Thank you for your help. Unfortunately it does not appear that you can add an “unallocated” physical drive. Hopefully this can be put in as a feature request!