After running the “recent activity” ingest module, a virtual folder (with a bold V) appeared in the documents folder of the user. The virtual directory corresponds to a real one folder that the user deleted and was in the recycle bin. What is the reason of autopsy doing this?

When you run RA one of the things it will do is scan the RecycleBin and restore any files that have been deleted by the users to where they resided on the disk. This is to show where the file/directory existed before it was deleted. Does that help?

Virtual Directory after Recent Activity

Autopsy Help

oscarjs November 14, 2023, 9:43pm 3

Yes, thanks Mark, your answer helps.

Virtual directories and recycle bin

Topic		Replies	Views
Virtual directories and recycle bin Autopsy Feature Requests	0	253	November 14, 2023
Section 8: Can't find Recent activity module Autopsy Online Training	2	1140	May 5, 2020
Recent Activity Autopsy Help	1	526	April 20, 2020
Proving websites were visited help? Autopsy Help	1	786	March 5, 2020
Recent activity ingest stops every single time Autopsy Help	1	197	April 16, 2024

Virtual Directory after Recent Activity

Related topics