I am trying to add “device1_laptop.e01” as a data source but whenever I attempt to so I receive an error message that says “Failed to add data(critical errors encountered).” The error log says: “Cannot determine file system type ( Sector offset 0).”
How do I fix this?
I managed to open the file by adding the data source as an “Unallocated Space Image File” however I still cannot add the file as a disk image file.
Disregard my previous response. Autopsy will open the file when I add it as an "Unallocated Space Image File” however everything in the file appears to be blank. After opening the file it appears as though no information is there. Due to this problem I am unable to take the quiz and finish section 3. Would someone please help me figure out a solution to the dilemma I am facing.
Did you check the hashes to make sure that the image itself is actually complete? It sounds a lot like the file is incomplete or is corrupted.
Can You give a step by step video tutorial uploaded on google drive about how to add that device1_laptop.e01 in autopsy, as this fact is not cleared in any of the videos till section-3.4.
This page has links to every step of adding an image. device1_laptop.e01 uses the Disk Image data source processor.
http://sleuthkit.org/autopsy/docs/user-docs/4.15.0/workflow_page.html
I’ve downloaded autopsy.msi , NSRL… file , video-triage module is on process.Got 4 files in that unziped NSRL… file. .DS_Store , NSRL…md5.idx, NSRL…md5.idx2, readme.
Questions:
1)Have I downloaded everything needed till section 3?
2)From the 6 data source types which one should I select for now?
I can’t find device1_laptop.e01 image or any file naming that. Sorry if it seems foolish question.
You need to download everything listed in the Download List module of Section 1.
It sounds like you have not actually downloaded the disk images. You need to click on the link(s), for example the first one shows you this. You need to download them to your system. And ensure that the hash values match, if your data is partially downloaded or corrupted it will not work.
Thank you
Thanks for helping this stupid, I enrolled this course earliar and just downloaded that .msi file. I forgot that there were more in that google drive.
