[sleuthkit-users] Autopsy 3.0.8 : Keyword Research ineffective

[Philippe J. <pjo...@pa...>]

Hello,

I have generated a DD file on a Ubuntu 10.04 VM. (dd if=/dev/sdb1 of=/usr3/essai3.dd)
/dev/sdb1 is EXT3.

I get 1G file. Then I transfer (Binary copy) it to my Windows XP(SP3) disk.

When Autopsy ingest this file, there is no Keyword hits detected although :

- I KNOW there is a witness non-deleted file which contains a keyword I record in Autopsy Keyword Hits.
- I could list and display my witness file on Autopsy Data Sources tree

Is somebody known this problem ?

Many thanks
Regards

Philippe JOURDIN