Race: "View File in Directory" from Timeline

A place to ask the community for help with using Autopsy.

Moderator: carrier

Race: "View File in Directory" from Timeline

Postby eric.baechle » Tue Dec 15, 2015 4:37 pm

Autopsy 4.0

Description of user activities:
Enter Timeline. Discovered an interesting image file that timeline identified through EXIF metadata. Selected "View File in Directory"

Reason:
This file is interesting because it contains an image that could be associated with precursors to another data product. It is interesting as to its file location on disk because it could be associated with other files that arrived on the disk at other times, but is in the same or nearby folder locations. The folder location of the image is not apparent from the EXIF data view. Selecting this option works some times. Other times the following error condition occurs:

What happens:
1) All CPU cores go to 85%;
2) Disk activity begins to stair-step down to 0 over the course of about 2-5 minutes;
3) The main Autopsy 4 window and Autopsy 4 Timeline window begin to close and reopen over the course of 5-10 minutes in an endless loop.

Possibly an undocumented feature?

Eric B.
eric.baechle
 
Posts: 4
Joined: Wed Dec 09, 2015 9:24 pm

Return to Autopsy Troubleshooting

Who is online

Users browsing this forum: No registered users and 1 guest