Hi
I am analyzing large image size. .001 image is 1.5 GB and there are 20 such image. When I add .001 image, it started analyzing and after 2-3 hours it is at only 5%. I think it will talk more time. Any way I can make it fast.?
Thanks
I will offer some suggestions and opinions on how you can reduce the time needed to analyze a device image with twenty 1.5 GB files (about 30 GB total).
- See Autopsy User Documentation: Optimizing Performance
- Close or temporarily disable all unnecessary application software on your PC so that Autopsy has full use of your PC.
- Store the image files on the fastest drive you have in your system. Usually this is, in order of speed, a .M2 NVME drive, a SATA solid state drive (SSD), an external USB3 SSD or your best spinning hard drive.
- Place the case files, and any hash databases on your system drive.
- Improve your PC by using a multi-core processor with at least a 4 GHz clock speed, add as much DRAM memory as your PC will take, use Windows 10 or a recent version of Linux.
- Be PATIENT! Don’t attempt to scroll around though the artifact results while ingest is still on-going. Trying to display photos, etc. during analysis will reduce the memory and CPU/GPU power for the analysis.
- ONLY enable those modules that you need. The extra time to run unnecessary modules is wasted.
- If you do keyword searches…start with only a few or a very short list. Once the ingest and analysis is complete you can do additional searching.
- Be SURE your PC doesn’t hibernate, go ‘to sleep’, do Windows Updates or antivirus scans while ingest & analysis is proceeding.
A ‘typical’ home or office PC will struggle for several days (1 to 3) to finish a 30GB image unless several of the above steps are completed.
DISCLAIMER: I’ve been using Autopsy for a couple of years and arrived at the above conclusions on my own. Anyone who see errors in my guidance above, PLEASE make corrections. I’ll wear my thick skin!
Bob