I have recently started using Autopsy on Windows Server 2019 VM. I have taken an image of another VMs hard disk (75GB) using FTK Imager and then with default settings, I created a case, added the image as a data source. The image was initially on a shared drive on the network.
The Analyze process took many hours. However, I think it did eventually complete.
Initially I had 8GB Memory and 2 CPUs on the scanning VM. I then got the memory increased to 16GB and the CPUs to 4. Reran, however, still extremely slow…took like 11 hours to get to 30%.
I thought it was the network traffic causing an issue, so I added another drive on the scanning VM and copied the Image to it. Re-added the data source and the analyze…still super slow.
I played around with the memory options in Options->Applications and the threads in the Options->Ingest Section. Increased them based on the increase in RAM and CPU on the VM. Re-ran the Analyze…still…seems to be crawling.
I even unchecked all the Ingest modules besides the keyword search and particularly the search items i am interested in.
I even got the memory to be increased to 32GB and CPU to 8…Re-ran, still seems to be as slow.
Is there something I am missing or doing wrong?
Could you please assist?