Re: [sleuthkit-users] Autopsy: The image format type could not be determined for this image file

[Brian C. <ca...@sl...>]

I just tried this and got similar results, except that I got a Windows 
dialog box saying that cygcrypto-0.9.8.dll was not found and then 
Autopsy reported that the image type could not be detected (likely 
because img_stat could not run).

Based on the Using TSK/Autopsy with Cygwin doc:

http://www.sleuthkit.org/sleuthkit/docs/lucas_cygwin.pdf

I started to copy the missing dll files into the TSK bin directory. 
After 3 or 4 files, it eventually worked.

Any cygwin experts here that can tell me how to make this process 
easier?  I updated my system path to include c:\cygwin\bin (which 
contains the needed dlls), but it didn't help.

brian


John Lehr wrote:
>> Why are you using TSK 2.05 with AFF 1.6.26? It was released with 1.6.28.  Are the images from DFTT?
> 
> I was following some instructions you posted for Cygwin... I thought that it might be version dependent.  I have since recompiled with v. 1.6.31 with the same results.
> 
>> Are the images from DFTT?
> 
> Yes, from http://dftt.sourceforge.net/.  I also tried Barry Grundy's practical.floppy.dd image from ftp://ftp.hq.nasa.gov/pub/ig/ccd/linuxintro/ and received the same error message (I'm looking to start out with TSK using some known images).
> 
>> Make sure you have the correct "volume" image versus "disk" image.
> 
> I know the difference, but tried both anyway: same error message.