Re: [sleuthkit-users] Error Adding Disk Image To Host in Autopsy - TSK 2.00, Autopsy 2.04

[Brian C. <ca...@sl...>]

On Apr 4, 2005, at 5:35 AM, Bradley B wrote:

> Hello, I created a case in Autopsy and added a host. I then attempted 
> to add
> a Disk Image (eg. dd if=/dev/had, not /dev/hda1) as now is possible in
> Autopsy. It is a disk image of a machine running DOS with a FAT16 
> partition.
> The output of mmls is as follows:

...

> In Autopsy I get the message:
> Testing partitions
> Linking image(s) into evidence locker
> Image file added with ID img1
> Missing Volume System Type

...

> When restarting Autopsy I cannot access the image, it does not seem to 
> show
> up in the image chooser.

Did autopsy show any errors before the missing volume system  type 
error? Did it say that it could not determine the volume system type or 
did you initially choose volume instead of disk? I can't find a way 
that the type would be missing, so I'm not sure if there is some other 
path that I missed.

Anyway, I changed the code a little to  make sure that the type is 
determined in case there is a situation that I missed.  Replace the 
lib/Caseman.pm file with the one at the below URL and try again.  If 
you haven't added anything to the host, you are probably best off to 
delete the host directory in the case directory of the evidence locker 
and add it again.

http://sleuthkit.sourceforge.net/autopsy/Caseman.pm

thanks,
brian