Is there a way to c...
 
Notifications
Clear all

Is there a way to change evidence "Display Name" in FTK 5.5?

2 Posts
2 Users
0 Likes
684 Views
(@sn0wstorm)
Posts: 7
Active Member
Topic starter
 

Hi All,

Bit of silly error by me, but I have an imaged hard drive (e01) and have added it and processed it in FTK 5.5 but have realised I mispelt it during the imaging process. i.e.

Image Name ACB/1
What it should read ABC/1

From what I gather FTK gets the display name from the e01 file, in my case FTK has set it as ACB-1.E01 when it should be ABC-1.E01. I have tried playing with the menus but cannot seem to rename my evidence in FTK. I noticed on 'Manage Evidence' there is a text box for "ID/Name" for each added evidence but changing this does not seem to change the name that is displayed on the evidence tab or in the report.

Is there a way to do this without having to process the case all over again?

 
Posted : 05/08/2015 2:10 pm
BraindeadVirtually
(@braindeadvirtually)
Posts: 115
Estimable Member
 

Hi All,

Bit of silly error by me, but I have an imaged hard drive (e01) and have added it and processed it in FTK 5.5 but have realised I mispelt it during the imaging process. i.e.

Image Name ACB/1
What it should read ABC/1

From what I gather FTK gets the display name from the e01 file, in my case FTK has set it as ACB-1.E01 when it should be ABC-1.E01. I have tried playing with the menus but cannot seem to rename my evidence in FTK. I noticed on 'Manage Evidence' there is a text box for "ID/Name" for each added evidence but changing this does not seem to change the name that is displayed on the evidence tab or in the report.

Is there a way to do this without having to process the case all over again?

Not that I am aware of. You should be able to remove and re-add the relevant E01 without trashing the entire case though.

 
Posted : 26/08/2015 2:00 am
Share: