# Timeline Analysis - (re)enable **URL:** \ **Category:** Autopsy Help\ **Created:** [July 12, 2019, 1:00pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154 "2019-07-12T13:00:31Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![ML62](https://avatars.discourse-cdn.com/v4/letter/m/54ee81/32.png) [@ML62](https://sleuthkit.discourse.group/u/ML62)\ **Post date:** [July 12, 2019, 1:00pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/1 "2019-07-12T13:00:31Z")
Hi When I request a timeline, Autopsy displays “Too many files in DB … timeline will be disabled” message. Is it possible to force this analysis or even to give selective criteria to carry out this analysis ? Thanks Marc ---
**Author:** ![carrier](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/carrier/32/4_2.png) [@carrier](https://sleuthkit.discourse.group/u/carrier)\ **Post date:** [July 12, 2019, 4:15pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/2 "2019-07-12T16:15:57Z")
The timeline has three views: Counts, Details, and List. Is it giving you this message before you see the UI and can choose one of those views? Or, only after you pick a certain one? ---
**Author:** ![ML62](https://avatars.discourse-cdn.com/v4/letter/m/54ee81/32.png) [@ML62](https://sleuthkit.discourse.group/u/ML62)\ **Post date:** [July 12, 2019, 4:25pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/3 "2019-07-12T16:25:04Z")
This message appears very quickly without any options being presented ---
**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\ **Post date:** [July 15, 2019, 4:58pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/4 "2019-07-15T16:58:40Z")
@ML62 Is the error you’re seeing “There are too many files in the DB to ensure reasonable performance. Timeline will be disabled.” ? It looks like Timeline won’t open if the database has more than six million entries. Do you think that’s the case for your database? ---
**Author:** ![ML62](https://avatars.discourse-cdn.com/v4/letter/m/54ee81/32.png) [@ML62](https://sleuthkit.discourse.group/u/ML62)\ **Post date:** [July 17, 2019, 7:53am UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/5 "2019-07-17T07:53:08Z")
Yes, that’s exactly the message displayed. On the other hand, I only have 2,242 million files deleted and a maximum of 34 miles of “normal” files. I am therefore quite far from the 6 million mentioned. Do you have any ideas to unlock the situation? ---
**Author:** ![ML62](https://avatars.discourse-cdn.com/v4/letter/m/54ee81/32.png) [@ML62](https://sleuthkit.discourse.group/u/ML62)\ **Post date:** [July 29, 2019, 6:38am UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/6 "2019-07-29T06:38:22Z")
I haven’t read anything about it for several days. Your opinion is important because I have to start my analysis in a few days. If we can’t find a solution with Autopsy, can you recommend an alternative for a disk analysis? My primary goal is to understand the past activity of 2TB USB disks, especially with regard to deleted files. By the way, how to find a history of the USB connections of these disks (W2016 system)? ---
**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\ **Post date:** [July 29, 2019, 6:25pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/7 "2019-07-29T18:25:47Z")
There’s currently no way around the limit. If you’re building Autopsy yourself you could remove it but I’m not sure how well Timeline will work with 35+ million files. ---
**Author:** ![ML62](https://avatars.discourse-cdn.com/v4/letter/m/54ee81/32.png) [@ML62](https://sleuthkit.discourse.group/u/ML62)\ **Post date:** [July 30, 2019, 5:45am UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/8 "2019-07-30T05:45:29Z")
I have trouble expressing myself in one of my answers (16/07). To clarify… Disk size: 2TB Files deleted: 2.242.000 'files/ophan entries" Files : 34.000 And so, the announced limits are far from being reached! Thank you for your follow-up and advice ---
**Author:** ![ML62](https://avatars.discourse-cdn.com/v4/letter/m/54ee81/32.png) [@ML62](https://sleuthkit.discourse.group/u/ML62)\ **Post date:** [August 6, 2019, 1:28pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/9 "2019-08-06T13:28:57Z")
Hello, No reaction? I can’t believe I’m the only one with this (simple) problem! But maybe I made a wrong manipulation or configuration. Thank you for sharing your impressions and experiences. ---
**Author:** ![apriestman](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/apriestman/32/24_2.png) [@apriestman](https://sleuthkit.discourse.group/u/apriestman)\ **Post date:** [August 6, 2019, 4:04pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/10 "2019-08-06T16:04:54Z")
So the actual count is from a query of the tsk\_files table in autopsy.db. It ends up being: > SELECT COUNT(\*) AS count FROM tsk\_files WHERE (1 = 1) You could check the size of your tsk\_files table. It tends to be larger than the actual number of files in your case since there can be entries for slack space and the parent and current folders (“.” and “…”). We could change that error to allow the user to continue anyway. We’d need to do some testing first, though. It’s been a while but I seem to remember Timeline just being unusable with that number of files. ---
**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\ **Post date:** [August 7, 2019, 12:43am UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/11 "2019-08-07T00:43:18Z")
To add to what Ann has already stated: In the current timeline database there will more then likely be at least 3-4 entries for each file making the total number of entries it looks at be larger then what you think it should be based on file count. The reason for the 3-4 more entries is based on the timestamps that each file may have (crtime, mtime, atime and ctime). There may also be entries in there for extracted content as well. As an example I have an image that was loaded in Autopsy and it has 118 files in it. Each file has 4 timestamps associated with them. This will then turn in 472 files in the timeline database so you can see where the 6 million files will be easily met. ---
**Author:** ![igiuseppem](https://avatars.discourse-cdn.com/v4/letter/i/a183cd/32.png) [@igiuseppem](https://sleuthkit.discourse.group/u/igiuseppem)\ **Post date:** [January 18, 2024, 8:39pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/12 "2024-01-18T20:39:39Z")
Good morning. Several years later, same issue here. I run Autopsy on a disk image, activating only the “PhotoRec Carver”. I need to display the timeline on a specific date, but when I click the “Timeline” icon I get this message “There are too many files in the DB to ensure reasonable performance. Timeline will be disabled.”. The message appears immediately so it’s not possible in advance to set a specific date and avoid this error. Do you have any suggestion? ---
**Author:** ![baburaoz558](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@baburaoz558](https://sleuthkit.discourse.group/u/baburaoz558)\ **Post date:** [February 12, 2024, 1:25pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/13 "2024-02-12T13:25:11Z")
Thank you for share with us[9apps apk](https://9apps.ltd/dl/) ---
**Author:** ![igiuseppem](https://avatars.discourse-cdn.com/v4/letter/i/a183cd/32.png) [@igiuseppem](https://sleuthkit.discourse.group/u/igiuseppem)\ **Post date:** [March 6, 2024, 12:34am UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/14 "2024-03-06T00:34:02Z")
@system Any kind of suggestion about this issue? ---
**Author:** ![b2\_a](https://avatars.discourse-cdn.com/v4/letter/b/e47774/32.png) [@b2\_a](https://sleuthkit.discourse.group/u/b2_a)\ **Post date:** [October 6, 2025, 1:12pm UTC](https://sleuthkit.discourse.group/t/timeline-analysis-re-enable/154/15 "2025-10-06T13:12:49Z")
I have the same problem with version 4.22.1. I have added about 700GB (multiple images) as data and only switched on the Ingest modules “Recently Activity”. So no other modules. It is crazy and a pity that the Timeline no longer works. Is there no possibility to bypass? Or a possible fix?