HI, If I have a multi user deployment with multiple clients configured to run ingest modules can the client run ingest modules on the same image at the same time? For example, client 1 could run recent activity against image 1 and client 2 could run plaso on image 1 at the same time.
You can do it, but it’ll be a manual process each time. The general steps would be:
- Client 1 creates a case
- Client 1 adds the data source and starts running recent activity
- Client 2 opens the case created by client 1
- After client 1 has added the data source, the user of client 2 can right-click on that data source to run Plaso
Note that frequently multi-user cases process more slowly than single-user cases since everything is going over a network, so doing this may not result in a speedup.
You could consider setting up auto ingest (Autopsy User Documentation: Automated Ingest) which lets you queue up images to be processed. This won’t make processing a single image faster, but you can let it run on several images overnight/unattended.
Thanks for your answer, that answers my question. The question behind the question is that I want ingest as quick as possible, I’m looking at everything from building and releasing a custom version of autopsy allowing for the use of greater than 8 ingest threads to also multi-user with the custom build. I don’ t think network speed will be an issue as the ingest machines I currently am using are C5.18XL instances with a 25Gbps NIC.