Autopsy Disk Read metrics are a fraction of other forensics/non-forensics tools

Hello Everyone,

Ever since I started using Autopsy again this year, every version from 4.14 through the current 4.17, I’ve noticed that the ingest modules seem fairly slow compared to other tools on my system. This is most noticeable when I’m building indexes for searching.

I pulled up the Windows Resource monitor and took a look at the Disk Activity for the autopsy64 process and noticed that the read rates are always very slow compared to any other tool. The rates for my Autopsy process are always in the range of 200,000 - 1,500,000 B/Sec and I cannot ever recall seeing it go over 2 MB/sec.

This is weird because any other tool/process I run against that same disk (Powershell script, FTK Imager, etc), reads MUCH faster, like 10 or 20 times faster. I also have plenty of processer resources and memory to spare.

Does anyone know if there are options for improving the disk read speed for Autopsy?

Just today I ran Axiom against the same image and Axiom was reading at 10 MB/sec, compared to numbers like 200 KB/sec for Autopsy.

Both Axiom and Autopsy are configured so they read images from the same evidence drive and write case data to the same cache drive.

NVM. Axiom is currently reading at 84 MB/sec, lol.