Re: [sleuthkit-users] Viewing Image files in autopsy

[Brian C. <ca...@sl...>]

Rich,

> Howdy,
> 
> I am a new user to the Sleuthkit and Autopsy (love 'em
> BTW) and have a question.  Whne veiwing the case,
> under file analysis I see the files represented, cool,
> and when I click on them I get a frame at the bottom
> with some info about them.  But how do I view the
> files, especially jpg/gif types (or any type for that
> matter).  When I click 'export' it wants to export a
> raw file but it won't show me the pic after I export
> it.

If the 'File Type' value has the string 'image data', 'HTML document', or 'bitmap data' 
in it, then Autopsy will provide a 'View' link next to the 'export' button.  Click on that 
and it will show the actual image or HTML page.  If the file type is not one of the 
above, then it may not really be a graphic image.  The 'File Type' is identified using 
the 'file' command.  

> 
> What am I doing wrong??  I accidentally got a word
> file to open, BUT it was called image.dls in the
> export folder nothiong like its file name from the
> file analysis.

The 'image.dls' file is likely the file that was created when you told Autopsy to 
extract the unallocated data.  The '.dls' extension is used to identify the files created 
by 'dls', which is done from the keyword search mode.

brian