sleuthkit/autopsy — Issue #3: Error extracting deleted file
Author: bcarrier
Created: 2012-01-31 14:22:04+00:00
State: open

I've tested it out running in a windows xp virtual machine (VirtualBox) at home and a windows xp workstation at work as well. When I try play a MPEG file using the "Open File in External Viewer" (context menu option), Autopsy.exe throws up the following error: "can't read the content of the file / Caused by: NewByteArray returned error while an array to copy buffer into". If I try to extract the file, then a new error pop up is showed: "Couldn't extract file/directory / Caused by: Error: can't read the contend of the file". The file is located in UNALLOCATED (this happens with another file of same file type located in ALLOCATED).

Is that a limitation of beta 2 version?

Anyway, keep up the good work with A3.
---
Danilo Caio Marcucci Marques
Computer Forensic Investigator - ICCE-DGPTC/PCERJ/Brazil
Linux user #419162