Follow

Change Evidence Path

Created by: Justin Johns
Created date:
Last Updated date:

Question

How do I change (or update) the path to my processed evidence?  

 

Answer

IMPORTANT: Changing the evidence path currently does not work for FTK/Lab/Enterprise cases that were processed using the Restore Points feature.  This is expected to be fixed in a future version.

This method requires FTK, Lab, or Enterprise to change the evidence path.  

1. Open FTK and login to the interface.

2. Open the desired case

3. Click Evidence on the menu bar and select Add/Remove...

4. Select the evidence item and update the Path.

Note: This requires that the same type of evidence item be used (e.g., forensic image, native file(s), folder, etc.)

5. Click OK.

 

Overview

Changing the evidence path may be necessary if the evidence was moved from one location to another.  

 

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

  • Avatar
    Yian Sun
    Hi, Has this been fixed yet or is there a workaround? Cheers, Yian
Powered by Zendesk