No Analysis Result

Autopsy on Linux / macOS
1

Hello Autopsy Team,

first time user of this software, I’m not sure if I’m doing something wrong or if this is a issue in the program.
None of the scans I made returned a Analysis Result. I’m trying to scan my main HD drive which was formatted by Windows on a new install, before there was a Ubuntu system running which was wiped away by Windows. The prior Ubuntu system is which I’m trying to recover, the Windows installation wiped it away where it installed the boot system on it.
First time I ran a scan, it created a vhd image which I tried to scan multiple times, the scan took several hours, almost the entire day, but as seen in the screenshot, there is no analysis result, I can only see what is currently available on the drive.
I’m a little desperate because I lost all my data, I’m not sure if it’s even possible to get it all back, but I was expecting to see the previous data on the drive but there is nothing to be found which doesn’t seem right to me.

My apologies if I’m asking a redundant question

autopsy
autopsy1561×965 142 KB

2

Hi Peter,

Data is usually only recoverable if you don’t overwrite it, and in this case it seems you installed Windows over the top of it. Autopsy can look for deleted files (that haven’t been overwritten) however the files you want are not even part of this OS. You might have some luck running Photorec or some other carving tool, but don’t hold your breath, the chances are not good.

good luck

3

Have you run the PhotoRec Carver ingest module - make sure you configure it to look for all file types. It will take ages, but as you definitely have no old metadata any more this is your only chance within the standard Autopsy tools. PhotoRec Carver tries to carve (recover) deleted files from unallocated space. As morgs says, this is only possible where it has not been overwritten, and if you have installed a whole new OS, your chances are probably slim