Re: [sleuthkit-users] Autopsy: File Activity Timelines not working

[Brian C. <ca...@sl...>]

On Feb 21, 2006, at 2:12 PM, "" <gim...@we...> <gim...@we...>  
wrote:

> Hi,
>
> i want to create timeline of activities with Autopsy.
> I have build new case, loaded up my image and opened page "File
> Activity Timelines", then clicked on "Create Data File", OK and then
> got this error message:
>
> No images were given for analysis. At least one must be selected.
>
> What could be wrong?
> Perhaps anything is bad with my image file?
> It is a dd dump with 4 Partitions.
> I added Partition 4 to case and it was partition i choosed to make
> timeline of.

Was partition 4 added as a specific file system (i.e. can you go into  
the file analysis mode of Autopsy and view the directory listing?)?   
Only file systems are shown in the timeline view.  If it was added as  
raw or swap then it will not be shown in the timeline view.

brian