Autopsy users,
I have modified the way that Autopsy imports partition images in the
next release (1.71). The current (1.70) method is that the images
directory is created and the user has to either symlink or copy the
image to the given location. That is a pain.
I want to have the image in the evidence locker so that everything is
self contained. So, the next version does more of the work for you.
You enter the full path of where the image currently resides and check
off if you want Autopsy to copy, symlink, or move the image to the
'images' directory. It does a file system type check and then imports
the image using the selected method.
My user questions:
- Is this better method?
- I am concerned about providing the 'move' option because what if
something happens and the images are lost. But, there may not be
enough disk space to always do a copy. I just don't want to have
people get mad at me because they lost an image somehow. Thoughts?
I could just provide a warning with the 'move'.
You can reply off list.
brian
|
