After running the “recent activity” ingest module, a virtual folder (with a bold V) appeared in the documents folder of the user. The virtual directory corresponds to a real one folder that the user deleted and was in the recycle bin.
What is the reason of autopsy doing this?
When you run RA one of the things it will do is scan the RecycleBin and restore any files that have been deleted by the users to where they resided on the disk. This is to show where the file/directory existed before it was deleted. Does that help?
Yes, thanks Mark, your answer helps.