Hi.
I have an ~300GB encase image of a 1TB drive.
Photorec carver took 18 hours to complete; but Keyword search is taking ages and in the end failing to complete.
Is it possible to run Ingest Modules, specifically keyword search, only on selected files or directories of a Data Source.
Regards,
Cachique
I have an ~300GB encase image of a 1TB drive.
Photorec carver took 18 hours to complete; but Keyword search is taking ages and in the end failing to complete.
@cachique What kind of hardware resources do you have on your machine? You may need to increase the amount of RAM/heap allocated to Autopsy and Solr (keyword search server).
Also make sure that you have 4-6 Autopsy ingest threads running:
Is it possible to run Ingest Modules, specifically keyword search, only on selected files or directories of a Data Source.
Yes it is possible to limit which files will be ingested. When you are adding a data source, there is an option to create “ingest filters”. There you can specify name and path rules for which files will be ingested:
