...
- "Error Reading DFXML File"
- Some disk images appear fine, but when analyzed in Disk Image Processor come back with the message "Error Reading DFXML File." If this is the case, mount the disk image in FTK Imager and/or Autopsy to verify whether the disk image successfully extracted the content. If the files are present on the disk image but analysis continues to give an error message, mount the disk image in FTK Imager (if not already). Go to Step 3 of Part II - Overwritten Content and follow the steps to extract and analyze the files.
- Incomplete Disk Images
- If a disk image shows only program files but you believe there should be collection material present, mount the disk in FTK Imager. Expanding the Evidence Tree will reveal the disk's file structure and any files present.
- If this attempt is unsuccessful, mount the disk in Autopsy. Analyze the disk to see if any more files appear.
- If this does not work, it is likely that the disk has degraded and lost all/some of its content. Feel free to come back to the disk at a later date/if you learn any new information. If it is a floppy disk, it may need to be imaged in the Kryoflux. Read
Part II - Overwritten Content
...