[sleuthkit-users] Unusual behavior

[Eagle I. S. I. <in...@ea...>]

I'm using the latest Sluthkit and Autopsy. 

I separated out the partition from a raw image file and symlinked it into
Autopsy. It's an NTFS partition. 

(The extracted partition sits on a Firewire drive, if that matters)

Anyway, when I choose File Type and the choose to save only the graphic
images and make thumbnails, and hi OK, the sorter immediately executes and
almost immediately produces a result: 

Images:

/evidence/brew/Compaq/images/brewpart.dd

Files (3)

Allocated (0)
Unallocated (3)

Files Skipped (3)

Non Files (3) 

 - all subsequent entries are 0. 

I've used this many times before and fully expected it to take a few
hours.....it returned these results in less than 1 second. 

Any idea what's going on here. I've viewed hundreds of images on this
partition with another tool...I was looking for a one step way to thumnail
them.......

Niall.