Rich,
> Howdy,
>
> I am a new user to the Sleuthkit and Autopsy (love 'em
> BTW) and have a question. Whne veiwing the case,
> under file analysis I see the files represented, cool,
> and when I click on them I get a frame at the bottom
> with some info about them. But how do I view the
> files, especially jpg/gif types (or any type for that
> matter). When I click 'export' it wants to export a
> raw file but it won't show me the pic after I export
> it.
If the 'File Type' value has the string 'image data', 'HTML document', or 'bitmap data'
in it, then Autopsy will provide a 'View' link next to the 'export' button. Click on that
and it will show the actual image or HTML page. If the file type is not one of the
above, then it may not really be a graphic image. The 'File Type' is identified using
the 'file' command.
>
> What am I doing wrong?? I accidentally got a word
> file to open, BUT it was called image.dls in the
> export folder nothiong like its file name from the
> file analysis.
The 'image.dls' file is likely the file that was created when you told Autopsy to
extract the unallocated data. The '.dls' extension is used to identify the files created
by 'dls', which is done from the keyword search mode.
brian
|
