Question
How do I change (or update) the path to my processed evidence?
Answer
IMPORTANT: Changing the evidence path currently does not work for FTK/Lab/Enterprise cases that were processed using the Restore Points feature. This is expected to be fixed in a future version.
This method requires FTK, Lab, or Enterprise to change the evidence path.
1. Open FTK and login to the interface.
2. Open the desired case
3. Click Evidence on the menu bar and select Add/Remove...
4. Select the evidence item and update the Path.
Note: This requires that the same type of evidence item be used (e.g., forensic image, native file(s), folder, etc.)
5. Click OK.
Overview
Changing the evidence path may be necessary if the evidence was moved from one location to another.
Applies To
AD Enterprise
AD Lab
FTK