Page Comparison

...

1. "Error Reading DFXML File"
   1. Some disk images appear fine, but when analyzed in Disk Image Processor come back with the message "Error Reading DFXML File." If this is the case, mount the disk image in FTK Imager and/or Autopsy to verify whether the disk image successfully extracted the content. If the files are present on the disk image but analysis continues to give an error message, mount the disk image in FTK Imager (if not already). Go to Step 3 of Part II - Overwritten Content and follow the steps to extract and analyze the files.
2. Incomplete Disk Images
   1. If a disk image shows only program files but you believe there should be collection material present, mount the disk in FTK Imager. Expanding the Evidence Tree will reveal the disk's file structure and any files present.
   2. If this attempt is unsuccessful, mount the disk in Autopsy. Analyze the disk to see if any more files appear.
   3. If this does not work, it is likely that the disk has degraded and lost all/some of its content. Feel free to come back to the disk at a later date/if you learn any new information. If it is a floppy disk, it may need to be imaged in the Kryoflux. Read the Guide to Using the Kryoflux and reach out to the Harry Ransom Center for further assistance.

...

2. If the disk image has only generic filesprogram/company files as in the example above, you will need to extract the files directly from the CD. Load the CD using the external CD drive and open it in FTK Imager.

...

7. The program will create analysis files for the folder just like Disk Image Processor creates for a disk image. When the output is complete, analyze it for malware, PII, and generated metadata.

       i. The "date modified" field will now show the date you extracted the files. For a more accurate date range in the finding aid, you can amend this to show the most recent date in the file tree.

8. Once modifications have been made, if necessary, copy the _files folder to the AIP destination (i.e., TOSHIBA EXT>2017009_02>2017009_02_252) for the files to be bagged. Replace any documentation with the correct information.

...