autopsy icon indicating copy to clipboard operation
autopsy copied to clipboard

Autospy problem with a image in linux

Open Jhironsel opened this issue 4 years ago • 3 comments

This forensic image cannot be loaded in linux but in windows it can be possible. https://drive.google.com/drive/folders/1XcuR6JYoBIjhMLuiRs-5VpfAZp7Ar3Pk?usp=sharing

https://mega.nz/file/dt1SxRYD#p_JsZDjN1QM2wjkihzf11u55GFgjlNdpVfthVlu16Us

Jhironsel avatar Mar 08 '21 19:03 Jhironsel

It appears that your image is in multiple segments however on Google Drive and and Mega you only posted the file .E01 from the segment. Is it possible that you don't have all the .E01 -> .E17 files in the same directory and that is causing the issue? From your screenshot on Mega that's almost what it looks like is happening so can you confirm?

 Segment list:
  E:\DashnerWin10PC\DashnerWin10PC.E01
  E:\DashnerWin10PC\DashnerWin10PC.E02
  E:\DashnerWin10PC\DashnerWin10PC.E03
  E:\DashnerWin10PC\DashnerWin10PC.E04
  E:\DashnerWin10PC\DashnerWin10PC.E05
  E:\DashnerWin10PC\DashnerWin10PC.E06
  E:\DashnerWin10PC\DashnerWin10PC.E07
  E:\DashnerWin10PC\DashnerWin10PC.E08
  E:\DashnerWin10PC\DashnerWin10PC.E09
  E:\DashnerWin10PC\DashnerWin10PC.E10
  E:\DashnerWin10PC\DashnerWin10PC.E11
  E:\DashnerWin10PC\DashnerWin10PC.E12
  E:\DashnerWin10PC\DashnerWin10PC.E13
  E:\DashnerWin10PC\DashnerWin10PC.E14
  E:\DashnerWin10PC\DashnerWin10PC.E15
  E:\DashnerWin10PC\DashnerWin10PC.E16
  E:\DashnerWin10PC\DashnerWin10PC.E17

dkarpo avatar Mar 09 '21 23:03 dkarpo

I know that, I'm missing the images E02 -> E17, but as you can see in the mega image you should notice that in windowsOS I can see more folder with the image E01 than Linux, I only see the $Unalloc folder in linux.

Jhironsel avatar Mar 11 '21 14:03 Jhironsel

I have the same issue in the logs it shows java kernel error when I combined the segmented files with FTK imager it runs perfectly (I'm using command line inside docker container) tried to use java with bellsoft and also oracle jdk now I'm on amazon cretto

DeDuplicate avatar Mar 17 '21 11:03 DeDuplicate