search

sleuthkit / autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
http://www.sleuthkit.org/autopsy/
2.37k stars 591 forks source link

The "media view" tab is inactive for deleted files #165

Closed kefir- closed 11 years ago

kefir- commented 11 years ago

When browsing an image with some deleted (but allocated) jpg files, the "media view" tab is inactive. If I am in hex view mode, I can see that the content is a jpg, but can't select "media view". If I was already in "media view", the picture is shown - even though the tab is now active, it is still greyed out.

adam-m commented 11 years ago

Is this with some, or all allocated deleted jpg files tried so far?

kefir- commented 11 years ago

This appears to be all the deleted jpg files I've seen, but I can't say for sure whether it really is all of them. I tried searching for all jpg, and then played around with ordering of Flags(Dir) and Flags(Meta) to find the pictures that were deleted but allocated, and all of them appeared to have a greyed out Media View tab.

adam-m commented 11 years ago

should be fixed in next release, thanks. The change activates the tab for deleted files. Some of deleted files cannot be fully read, but at least we will try to load and display them.

On Tue, Mar 12, 2013 at 11:05 AM, kefir- notifications@github.com wrote:

This appears to be all the deleted jpg files I've seen, but I can't say for sure whether it really is all of them. I tried searching for all jpg, and then played around with ordering of Flags(Dir) and Flags(Meta) to find the pictures that were deleted but allocated, and all of them appeared to have a greyed out Media View tab.

— Reply to this email directly or view it on GitHubhttps://github.com/sleuthkit/autopsy/issues/165#issuecomment-14780365 .