When pulling files for patron requests, you may occasionally come across corrupted or incomplete disk images. These are disk images with blank file trees, file trees containing only program files (see image below), or disk images that, when analyzed in Disk Image Processor, output error/"Cannot read DFXML" messages. Be especially aware of CDs from the company RitzPic or that say they have an extent of "12 digital files, 10 MB." If you come across these CDs, scroll down to Part II - Overwritten Content.
Part I - Corrupted or Erroneous Disk Images
These disks can have multiple things wrong with them. The following guide is not an exhaustive list, but rather steps that have previously successfully recovered missing information.
- "Error Reading DFXML File"
- Some disk images appear fine, but when analyzed in Disk Image Processor come back with the message "Error Reading DFXML File." If this is the case, mount the disk image in FTK Imager and/or Autopsy to verify whether the disk image successfully extracted the content. If the files are present on the disk image but analysis continues to give an error message, mount the disk image in FTK Imager (if not already). Go to Step 3 of Part II - Overwritten Content and follow the steps to extract and analyze the files.
Part II - Overwritten Content
...