I have been using Autopsy (via Helix3) to try and create file activity timelines, but. I can't figure out how to get filesystem images to show up in the Create Data File step in the Timelines section.
I have a volume image( sda1-img.dd) on a mounted usb stick and it shows up on the Case Manager page but when I click the file activity timelines button and then the Create Data file tab the image doesn't show up in the subsequent page where step 1 asks to "Select one or more of the following images to collect data from"
There is no list of images to choose from.
Any help would be much appreciated.
lynch719
I started a new case using a 100MB boot partition (/dev/sda1) as my image and it showed up in the Create Data File step. I can now generate a data file to use for creating a timeline file.
Can anyone explain why the .dd image from the usb stick did not show up? ?
Just saw this thread from 2009 as I'm having the same problem with an image created from an external drive. The image shows in the case, but does not show when I try to create a timeline. Using Autopsy 2 as I'm on a Mac. Any help would be appreciated.