I’m having some trouble going through the labs as my Autopsy is taking a hard time running the ingest modules. I’m using VMWare Fusion on MacOS Mojave and started with a Window 10 guest with 16GB RAM and 2 CPU cores. I then switched to a Windows 7 guest, with 8GB RAM and 2 CPU cores and things improved a bit. However, I’m currently stuck in the Section 8 lab, running the Recent Activity ingest module, which is running for ages and still 0%. I got a few hits already on most of the extracted content, but for example still don’t have the USB activity. I tried to cancel, and even that, is taking ages.
I was wondering if, with my current VM guest settings, it normal to take a very very long time, or if the process is just stuck. Also, the E01 for this case is pretty small (3GB), so I how this would behave for images of 500GB, which is the minimum norm these days. Which machine specs are recommended?
I’m using Autopsy 4.14.0.
UPDATE:
After killing the javaw.exe process and closing Autopsy, I reopen it, launch the Recent Activity module again, and everything ran in a couple of minutes. Now I have all the extract content that was missing. This is not the first time, where I close things, open again and they run better. I guess the java runtime is just not too nice by consuming a lot of resources and not releasing them properly.