Raw Single (For example: *.img, *.dd, *.raw, *.bin).You cannot remove a data source from a case.Īutopsy supports disk images in the following formats: Regardless of the type of data source, there are some common steps in the process:ġ) You will select the type of data source.Ħ) After the ingest modules have been configured and the basic examination of the data source is complete, the ingest modules will begin to analyze the file contents. It does not copy the data source into the case folder. The data source must remain accessible for the duration of the analysis because the case contains a reference to the data source. The "Case", "Add Data Source" menu item when a case is open.There is a toolbar item to add a Data Source when a case is open.After you create a case, it automatically prompts you to add a data source.You can add a data source in several ways: Unallocated Space Image Files: Any type of file that does not contain a file system but you want to run through ingest (see Adding an Unallocated Space Image File).Logical Files: Local files or folders.Local Disk: Local storage device (local drive, USB-attached drive, etc.).Disk Image or VM File: A file (or set of files) that is a byte-for-byte copy of a hard drive or media card, or a virtual machine image.You must open a case prior to adding a data source to Autopsy.Īutopsy supports four types of data sources: It can be a disk image, some logical files, a local disk, etc. A data source is the thing you want to analyze.