Problem

After moving the evidence or case folder for a case with expanded Volume Shadow Copies (Restore Points), and then trying to correct the Evidence Path, FTK still reports it can't find the evidence. The error is "unable to open evidence".

 

Resolution

  1. Open the ADX file(s) for the case (stored in /images/VSC) in a text editor and make sure the evidence/image path is correct
  2. Open FTK
  3. In the Add/Remove Evidence dialog, make sure it's pointing to the ADX file
  4. Restart FTK and check your evidence
  5. (Optional)Using the database manager of your choice, find the cmn_evidence table for your case and make sure it points to the ADX file(s) instead of the image

 

Cause

When using evidence with expanded Volume Shadow Copies, we create an ADX file to keep track of the expanded restore points, and the database points to those ADX files rather than the evidence itself.

 

Applies To

AD Enterprise

AD Lab

FTK