Cannot See OS Volume

A place to ask the community for help with using Autopsy.

Moderator: carrier

Cannot See OS Volume

Postby jdittamo » Mon Jan 16, 2017 12:43 pm

I have processed 7 cases and on the first 5, Autopsy was able to see the OS volume. On 6 and 7, Autopsy sees the OS volume as unallocated. While experimenting with the situation, I saw the error "Cannot determine file system type (Sector offset: 2048 Partition Type: NTFS/exFAT (0x07)"

The images in all cases, were E01 images using FTK Imager.

The OS was Windows 7.

Any idea what the problem is and what the solution is?
jdittamo
 
Posts: 2
Joined: Mon Jan 16, 2017 12:30 pm

Re: Cannot See OS Volume

Postby CobyB » Tue Feb 14, 2017 7:50 am

jdittamo wrote:I have processed 7 cases and on the first 5, Autopsy was able to see the OS volume. On 6 and 7, Autopsy sees the OS volume as unallocated. While experimenting with the situation, I saw the error "Cannot determine file system type (Sector offset: 2048 Partition Type: NTFS/exFAT (0x07)"

The images in all cases, were E01 images using FTK Imager.

The OS was Windows 7.

Any idea what the problem is and what the solution is?


Hi JDittamo, did you fin out what the problem was?
CobyB
 
Posts: 1
Joined: Mon Feb 13, 2017 7:43 am


Return to Autopsy Troubleshooting

Who is online

Users browsing this forum: No registered users and 3 guests

cron