Re: [sleuthkit-users] Autopsy: delete image file from case

[Barry J. G. <bg...@im...>]

On Tue, 2006-02-21 at 20:07 +0100, gim...@we... wrote:

> how can i delete an image file from case?
> On the page "Select a volume to analyze or add a new image file.", i
> only have option to analyze, add image file, close host but not any
> option to delete image file.

I'm not sure that there is an option within autopsy to "delete" an image
file.  Brian would have to comment on this, but I imagine it has
something to do with maintaining case integrity.  

If you are testing and playing with the software, you could "remove" the
image by deleting the link (or mv/cp'd) image
from ./CASENAME/HOSTNAME/images/ and then editing the host config
file ./CASENAME/HOSTNAME/images/host.aut (The above paths are within
your evidence locker).

-- 
/***************************************
Special Agent Barry J. Grundy
NASA Office of Inspector General
Computer Crimes Division 
Goddard Space Flight Center
Code 190
Greenbelt Rd.
Greenbelt, MD 20771
(301)286-3358
**************************************/