Filter to exclude files not working


Something is not working properly with the filter to exclude files from analysis, either I am doing something wrong, or the filter was designed for something else.

Documentation says that “File filters allow ingest modules to be run on only a subset of the files”.

This is the filter I created to exclude all files from a specific folder, so the recent activity module doesn’t process that folder.


The problem is that the activity module ignores the filter and starts parsing 557M entries of that folder, which could take Autopsy weeks or months to finish, which is absurd.


Can you help me? Thank you very much!

The filter only works on modules that run on each file (like hash, file type, etc). Modules like Recent Activity do a search for files they want to parse and don’t use the filter.

1 Like