mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-06 21:00:22 +00:00
31 lines
1.7 KiB
HTML
31 lines
1.7 KiB
HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<html>
|
|
<head>
|
|
<title>Disk Image Basics</title>
|
|
<link rel="stylesheet" href="nbdocs:/org/netbeans/modules/usersguide/ide.css" type="text/css">
|
|
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
|
</head>
|
|
<body>
|
|
<h2>About Disk Images</h2>
|
|
<p>
|
|
In Autopsy, an "image" refers to a byte-for-byte copy of a hard drive or other storage media. To analyze an image, you must use the <a href="nbdocs:/org/sleuthkit/autopsy/casemodule/docs/addImage.html">Add Image Wizard</a>to add it to a <a href="nbdocs:/org/sleuthkit/autopsy/casemodule/docs/casemodule-about.html">case</a>.
|
|
</p>
|
|
<p>Autopsy populates an embedded database for each image that it imports. This database is a SQLite database and it contains all of the file system metadata from the image. The database is stored in the case directory, but the image will stay in its original location. The image must remain accessible for the duration of the anlaysis because the database contains only basic file system information. The image is needed to retrieve file content.</p>
|
|
|
|
<h2>Supported Formats</h2>
|
|
<p>
|
|
Currently, Autopsy supports these image formats:
|
|
<ul type="circle">
|
|
<li>Raw Single (For example: *.img, *.dd, etc)</li>
|
|
<li>Raw Split (For example: *.001, *.002, *.aa, *.ab, etc)</li>
|
|
<li>EnCase (For example: *.e01, *e02, etc)</li>
|
|
</ul>
|
|
|
|
<h2>Removing an Image</h2>
|
|
<p>
|
|
You cannot currently remove an image from a case.
|
|
</p>
|
|
|
|
</body>
|
|
</html>
|