search

markmckinnon / Autopsy-Plugins

Autopsy Python Plugins
332 stars 100 forks source link

Problem with Volume Shadow s #17

Closed arruw closed 2 years ago

arruw commented 5 years ago

I have 4 disks, 2x Ubuntu and 2x Windows 7. Even when ingesting Ubuntu datasource, I get VSS record in the Datasources section. Another problem is that every time I run ingest on datasource, new VSS record is created with the same parameters.

image

markmckinnon commented 5 years ago

My guess without looking at the code is that it writes the vss data to the same directory without a parent directory over the vss. You can verify this by going to the case module directory and expanding the vss directory and see what it gives you. I will take a look at this as soon as I have time.