The TL;DR- Does anyone have tuning advice for significantly improving indexing and keyword search performance?
Long version- For a while I’ve wanted to switch over primarily to Autopsy as my primary forensic suite for searching and reviewing images, because I think it has the most sensible and useful UI of any of the commercial products I have access to (EnCase, Axiom, X-Ways).
I have not been able to completely make the switch due to the indexing and searching performance, which has been much slower that other tools in my testing ([Autopsy Disk Read metrics are a fraction of other forensics/non-forensics tools]).
I’ve done some fairly extensive testing on the new Autopsy 4.18, where I added the e01 image from last years Autopsy training, device1_laptop.e01 (≈3.5 GB), and would change the JVM Memory, Solr JVM memory, and periodic update frequency settings in order to improve processing times. All these tests were run on the same system, The server was not doing any other significant workload at the time and made sure to restart Autopsy whenever changing the memory settings.
Here are the conditions of my testing:
-The data source for each test was the device1_laptop.e01 (≈3.5 GB) image from last year’s free COVID-19 Autopsy training
-All tests were run on the same system
-The system was not doing any other significant workload during any of the tests
-The configurations changedto see how they affected performance were: JVM Memory, Solr JVM memory, and periodic update frequency settings
-Autopsy was restarted whenever memory settings were changed
- Start time and end time for the ingest jobs were determined using the timestamps associated with the “org.sleuthkit.autopsy.ingest.IngestManager startIngestJob” and “org.sleuthkit.autopsy.ingest.IngestManager FinishIngestJob” records in the autopsy.log.0 log file.
Here are my results:
My major takeaways:
-Autopsy4.18 completed an ingest in ≈half the time as it took 4.17 to do the same thing. This is excellent!
-Changing the memory settings and the periodic update settings did not make a impact.
-Autopsy 4.18 took nearly 3 times longer to do the same task as Axiom 4.11. That is not a big deal for a 3.5GB image but it might be a deal breaker for 1TB image.
Does anyone have tuning advice for significantly improving indexing and keyword search performance?