[sleuthkit-users] Autopsy 3.1.0 - hash db
Brought to you by:
carrier
From: Brian S. <bhs...@ya...> - 2014-09-03 19:04:58
|
Using hfind, I created two hash db indexes (1 custom, 1 based on NSRL) and added them to Autopsy 3.1.0. Command line searching using hfind works as expected, so I know the indexes are good. When I go to ingest new media, I get the messages listed below. I'd expect the "No known bad..." entry to appear, but not the second. Is this a result of user error or a bug? I've found the wiki documentation on the hash db "import" process to be pretty weak, so it easily could be user error. Thanks for your time. -Brian Module Subject Hash lookup "No known bad hash database set" Hash lookup "No known hash database set" |