How do I change (or update) the path to my processed evidence?  



IMPORTANT: Changing the evidence path currently does not work for FTK/Lab/Enterprise cases that were processed using the Restore Points feature.  This is expected to be fixed in a future version.

This method requires FTK, Lab, or Enterprise to change the evidence path.  

1. Open FTK and login to the interface.

2. Open the desired case

3. Click Evidence on the menu bar and select Add/Remove...

4. Select the evidence item and update the Path.

Note: This requires that the same type of evidence item be used (e.g., forensic image, native file(s), folder, etc.)

5. Click OK.



Changing the evidence path may be necessary if the evidence was moved from one location to another.  


Applies To

AD Enterprise

AD Lab