Hi All,
Bit of silly error by me, but I have an imaged hard drive (e01) and have added it and processed it in FTK 5.5 but have realised I mispelt it during the imaging process. i.e.
Image Name ACB/1
What it should read ABC/1
From what I gather FTK gets the display name from the e01 file, in my case FTK has set it as ACB-1.E01 when it should be ABC-1.E01. I have tried playing with the menus but cannot seem to rename my evidence in FTK. I noticed on 'Manage Evidence' there is a text box for "ID/Name" for each added evidence but changing this does not seem to change the name that is displayed on the evidence tab or in the report.
Is there a way to do this without having to process the case all over again?
Hi All,
Bit of silly error by me, but I have an imaged hard drive (e01) and have added it and processed it in FTK 5.5 but have realised I mispelt it during the imaging process. i.e.
Image Name ACB/1
What it should read ABC/1From what I gather FTK gets the display name from the e01 file, in my case FTK has set it as ACB-1.E01 when it should be ABC-1.E01. I have tried playing with the menus but cannot seem to rename my evidence in FTK. I noticed on 'Manage Evidence' there is a text box for "ID/Name" for each added evidence but changing this does not seem to change the name that is displayed on the evidence tab or in the report.
Is there a way to do this without having to process the case all over again?
Not that I am aware of. You should be able to remove and re-add the relevant E01 without trashing the entire case though.