Anlyzing an image in Sleith Kit
I'm new to Sleuth Kit and Autopsy, and to Linux in general, and I cannot get Autopsy to recognize a dd image created with FTK when I try to create a case. I try to add an image file to the case, but Autopsy tells me "The image format type could not be determined for this image file". I have stored the image (a single 20G image file) in my /usr/local/images folder, and have tried the "copy" as well as "symlink" option when trying to add the image.
Does anyone have any suggestions? Thanks much.
"The image format type could not be determined for this image file".
Version of Autopsy/TSK installed? Did you select type "disk" (version dependant)? Can you provide output of mmls or sfdisk -l -uS for the image?