search

sleuthkit / autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
http://www.sleuthkit.org/autopsy/
2.41k stars 597 forks source link

[Autopsy 4.15.0] "Add Data Source > Memory Image File" option missing in GUI #5892

Closed Baricanac closed 4 years ago

Baricanac commented 4 years ago

I wanted to add a ".mem" file type as a new data source to my existing case, but I then noticed the "Memory Image File" option is missing?

01

http://sleuthkit.org/autopsy/docs/user-docs/4.15.0/volatility_dsp_select.png

Baricanac commented 4 years ago

Autopsy does not support processing of memory image files yet.

http://sleuthkit.org/autopsy/docs/user-docs/4.15.0/volatility_dsp_page.html

APriestman commented 4 years ago

Have you enabled the experimental module? http://sleuthkit.org/autopsy/docs/user-docs/4.15.0/experimental_page.html

Baricanac commented 4 years ago

Have you enabled the experimental module? http://sleuthkit.org/autopsy/docs/user-docs/4.15.0/experimental_page.html

I must have forgotten to enable the optional plugins after installing the latest Autopsy 4.15.0. I also forgot to tweak/optimize the settings in Autopsy. But thanks for clearing that up!

The "Data Source > Memory Image File (Volatility)" option is back after enabling the experimental module.