I am having an issue adding a “local drive” as well as a “disk image” of the same drive (e01 - should have tried single file raw DD but I doubt that’s the issue) to an autopsy case. I get the following errors,
“*Failed to add data source (critical errors encountered). Click below to view the log.”
Errors occurred while ingesting image
- Cannot determine file system type (Sector offset: 0)
I believe this drive to be empty (wiped), however, my compressed e01 of the drive is over 1GB (750gb physical drive) and to me, that seems reasonable to believe there might be something on there. Regardless of data present, how are you supposed to analyze a drive that is raw (not containing a file system)? FTK Imager pulls it up without flaw so i browse in HEX view. Of course, I don’t want to browse in the HEX view to find anything. I’d rather have a tool carve it for me.
Any suggestions? Am I ingesting the image/drive incorrectly?
Any and all help is appreciated.