About Images

In Autopsy, an "Image" refers to the "Disk Image". Before an image can be analyzed, it must be added to a case.

Autopsy creates a database for each image that it imports. This database is a SQLite database and it contains all of the file system metadata from the image. When adding an image, it will take a little bit of time to populate the database. The database is stored in the case directory, but the image will stay in its original location.

Supported Formats

Currently, Autopsy only supports these formats of image:

• Raw Single (For example: *.img, *.dd, etc)
• Raw Split (For example: *.001, *.002, *.aa, *.ab, etc)
• EnCase (For example: *.e01, *e02, etc)

Adding an Image

To see how to add image to the current opened case, click here.

Removing an Image

You can remove an image in the Case Properties window.