Section 9 - Keyword Search Issue

Online Training
1

I have added “reznik” as a keyword under my list “case” and proceeded to run the keyword search ingest module.

I have received a message in the ingest messages saying there has been a hit.

When looking through the Keyword Hits it isn’t showing any of the identified items.

keyword hits
keyword hits1411×328 22.7 KB

Any advice?

2

Update

Waited for any processing to finish and restarted Autopsy.

All artifacts including the keyword hits that weren’t showing up earlier are present now.

This may assist with other similar issues such as mine. Try restarting autopsy and see if the problem is solved :grinning:

2 Likes
3

Thanks! I really appreciate your follow-up that included the solution that worked for you.
The first time I ran the keyword search, it returned only 155 results, and I got the question wrong (3 times). The second time through, after a reboot, on your advice, it returned 253.
(Version 4.1.4.0 on an old Dell i3 laptop w/ 8GB RAM. It takes quite a while to complete an ingest module - CPU and memory are running at 96%!)

4

It took about a day for me on my dual core 8GB VM. :frowning:

5

How many hits are there for “Renzik” in NTUSER.DAT? trying to figure out this I only saw for in the “renzik”