About Disk Images

In Autopsy, an "image" refers to a byte-for-byte copy of a hard drive or other storage media. To analyze an image, you must use the Add Image Wizardto add it to a case.

Autopsy populates an embedded database for each image that it imports. This database is a SQLite database and it contains all of the file system metadata from the image. The database is stored in the case directory, but the image will stay in its original location. The image must remain accessible for the duration of the anlaysis because the database contains only basic file system information. The image is needed to retrieve file content.

Supported Formats

Currently, Autopsy supports these image formats:

Removing an Image

You cannot currently remove an image from a case.