analyzing huge image

I am analyzing large image size. .001 image is 1.5 GB and there are 20 such image. When I add .001 image, it started analyzing and after 2-3 hours it is at only 5%. I think it will talk more time. Any way I can make it fast.?


I will offer some suggestions and opinions on how you can reduce the time needed to analyze a device image with twenty 1.5 GB files (about 30 GB total).

  1. See Autopsy User Documentation: Optimizing Performance
  2. Close or temporarily disable all unnecessary application software on your PC so that Autopsy has full use of your PC.
  3. Store the image files on the fastest drive you have in your system. Usually this is, in order of speed, a .M2 NVME drive, a SATA solid state drive (SSD), an external USB3 SSD or your best spinning hard drive.
  4. Place the case files, and any hash databases on your system drive.
  5. Improve your PC by using a multi-core processor with at least a 4 GHz clock speed, add as much DRAM memory as your PC will take, use Windows 10 or a recent version of Linux.
  6. Be PATIENT! Don’t attempt to scroll around though the artifact results while ingest is still on-going. Trying to display photos, etc. during analysis will reduce the memory and CPU/GPU power for the analysis.
  7. ONLY enable those modules that you need. The extra time to run unnecessary modules is wasted.
  8. If you do keyword searches…start with only a few or a very short list. Once the ingest and analysis is complete you can do additional searching.
  9. Be SURE your PC doesn’t hibernate, go ‘to sleep’, do Windows Updates or antivirus scans while ingest & analysis is proceeding.

A ‘typical’ home or office PC will struggle for several days (1 to 3) to finish a 30GB image unless several of the above steps are completed.

DISCLAIMER: I’ve been using Autopsy for a couple of years and arrived at the above conclusions on my own. Anyone who see errors in my guidance above, PLEASE make corrections. I’ll wear my thick skin!