I tried to search for Archive.7z under the View list but there is no File matched with given one in the lab step, how do I find it?
There are a few ways for find files in Autopsy. The most direct way, when you have a file name as is provided in the question, is to use File Search by Attributes dialog box from the Tools menus. Select the name options, and search for “archive.zip”. The search is case in-sensitive.
A more indirect method to search for Zip archives is to use the same File Search by Attributes and search for mime type application/zip.
Finally, Autopsy provides a shortcut in the left panel in the Views section: File Types -> By Extension -> Archives. Just be aware that file name extensions can be incorrect or falsified and this is the least accurate search.
2 Likes
I have the same issue, even after searching for the file using above solution the file doesn’t show up.
its like the file doesn’t exist.
I found it looking in file type> By MIME TYPE > application> zip (9)
regards