...
If you open a disk and see that the files appear to be program files (see image below), refer to the Problematic Media Processing guide for further instructions. If they're not program files - just files you can't view - keep reading.
...
- Open Autopsy and select “New Case.”
- In the Case Name field, type “[disk number](AIP number)_autopsy” (i.e., 2017009_02_069)
- Fill out optional information, if desired.
- Select “Finish.” This creates the card database.
- A box should appear reading Add Data Source. If it does not, click the Add Data Source button in the top left corner of the screen.
- Select the data source type. For disk images, select “Disk Image or VM File.” For extracted files, select “Logical Files.”
- Select your data source. You can add multiple data sources to the same case. When you click “Finish,” the file(s) will begin loading into Autopsy.
- Once the files is finished loading, browse through the output on the left hand side of the screen. To view the disk image/file structure, click under the filename under Data Sources. This allows you to view every available file.
NOTE: If you click on a file and only the hex string is rendering, make sure the files are 100% finished loading into Autopsy (indicated in the bottom right hand corner). This can take a while!
- Clicking on files renders them in the bottom screen. This way, you can view files like .wpd and .jpg directly from the disk image or extracted file.
...