sleuthkit-users

[sleuthkit-users] Autopsy: delete image file from case

[<gim...@we...>]

Hi,

how can i delete an image file from case?
On the page "Select a volume to analyze or add a new image file.", i
only have option to analyze, add image file, close host but not any
option to delete image file.

How can this be done with Autopsy?

regards

Re: [sleuthkit-users] Autopsy: delete image file from case

[Barry J. G. <bg...@im...>]

On Tue, 2006-02-21 at 20:07 +0100, gim...@we... wrote:

> how can i delete an image file from case?
> On the page "Select a volume to analyze or add a new image file.", i
> only have option to analyze, add image file, close host but not any
> option to delete image file.

I'm not sure that there is an option within autopsy to "delete" an image
file.  Brian would have to comment on this, but I imagine it has
something to do with maintaining case integrity.  

If you are testing and playing with the software, you could "remove" the
image by deleting the link (or mv/cp'd) image
from ./CASENAME/HOSTNAME/images/ and then editing the host config
file ./CASENAME/HOSTNAME/images/host.aut (The above paths are within
your evidence locker).

-- 
/***************************************
Special Agent Barry J. Grundy
NASA Office of Inspector General
Computer Crimes Division 
Goddard Space Flight Center
Code 190
Greenbelt Rd.
Greenbelt, MD 20771
(301)286-3358
**************************************/

Re: [sleuthkit-users] Autopsy: delete image file from case

[Brian C. <ca...@sl...>]

On Feb 21, 2006, at 2:38 PM, Barry J. Grundy wrote:

> On Tue, 2006-02-21 at 20:07 +0100, gim...@we... wrote:
>
>> how can i delete an image file from case?
>> On the page "Select a volume to analyze or add a new image file.", i
>> only have option to analyze, add image file, close host but not any
>> option to delete image file.
>
> I'm not sure that there is an option within autopsy to "delete" an  
> image
> file.  Brian would have to comment on this, but I imagine it has
> something to do with maintaining case integrity.

There is not an option.  It is kind of messy and keep everything in  
sync (strings, unallocated space, timelines, body files etc.).  It's  
doable, but has not been a high priority (which I am in the process  
of enumerating as I write this).

brian