I am looking for details on the various file counters and their links present in Autopsy 4.19.3 on window 11
I am interested in your feedback and/or any link to detailed documentation of the ingests concerned explaining these counters.
1- Count of undeleted files
Where can I find the total number of undeleted files (= allocated files,…) of a hard disk with one or more volumes?
In autopsy for the same digital medium, I have two different numbers 37524 (Cf. screenshot “datasourcesummary”) and 16080 (Cf screenshot “Graphic”)
Neither of these two numbers match the DOS command output of 17321…
2- Enumeration of Deleted Files
Obviously, the number of unallocated files of 3052 does not include the number of slack files of 18392 (cf. “graphic” screenshot)…
When I add up the number of files present in the pie chart (cf. “graphic” screenshot) (“images” = 319 + “video” = 5, …) we have 19132, which corresponds
to the sum of the allocated files of 16080 and unallocated of 3052 → the salckfiles are not included in the pie chart, is that right?
Is there a way to get a pie chart without the unnalocated files?
In the “File views / Deleted Files” item, the number of deleted files is 3226 (see tree screenshot), I don’t see the link with the numbers present
in the “graphic” screenshot (3052,…)
In the “File views / Deleted Files” item, there is “File System” and “ALL”, which always seem identical…if they are different, what does that mean?
3- video number link in the “graphic” screenshot and in the “tree” screenshot
In the “graphical” screenshot, I have 5 videos
In the screenshot “tree”, In the item “File views / Files Type / By Extension”, I have 28 videos
In the “tree” screenshot, “File views / Files Type / By MIME type”, I have 11 (1+6+4) videos.
How are these differences explained?
thank you for your help and have a good week.
