Change Evidence Path

Created by: Justin Johns
Created date:
Last Updated date:


How do I change (or update) the path to my processed evidence?  



IMPORTANT: Changing the evidence path currently does not work for FTK/Lab/Enterprise cases that were processed using the Restore Points feature.  This is expected to be fixed in a future version.

This method requires FTK, Lab, or Enterprise to change the evidence path.  

1. Open FTK and login to the interface.

2. Open the desired case

3. Click Evidence on the menu bar and select Add/Remove...

4. Select the evidence item and update the Path.

Note: This requires that the same type of evidence item be used (e.g., forensic image, native file(s), folder, etc.)

5. Click OK.



Changing the evidence path may be necessary if the evidence was moved from one location to another.  


Applies To

AD Enterprise

AD Lab


Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request


  • Avatar
    Yian Sun
    Hi, Has this been fixed yet or is there a workaround? Cheers, Yian
Powered by Zendesk