Closed Baricanac closed 4 years ago
Autopsy does not support processing of memory image files yet.
http://sleuthkit.org/autopsy/docs/user-docs/4.15.0/volatility_dsp_page.html
Have you enabled the experimental module? http://sleuthkit.org/autopsy/docs/user-docs/4.15.0/experimental_page.html
Have you enabled the experimental module? http://sleuthkit.org/autopsy/docs/user-docs/4.15.0/experimental_page.html
I must have forgotten to enable the optional plugins after installing the latest Autopsy 4.15.0. I also forgot to tweak/optimize the settings in Autopsy. But thanks for clearing that up!
The "Data Source > Memory Image File (Volatility)" option is back after enabling the experimental module.
I wanted to add a ".mem" file type as a new data source to my existing case, but I then noticed the "Memory Image File" option is missing?
http://sleuthkit.org/autopsy/docs/user-docs/4.15.0/volatility_dsp_select.png