Has anyone had any issues using PA 3 (Version 3.2-3.6) with phones that have alot of data on them? I'm attempting to process an iPhone 3G (8GB), with over 10,000 photos and 30,000 SMS.

I confirmed it was not a hardware issue, as my CPU was using 5%, and my memory was at 40% max. I have the engine installed on its own HD, and the IOS data dump on a RAID 5.

The anaylzer is almost unusuable...it's like 56K dial up all over again. Any tips or tricks to speed this up?

I called Cellebrite Support and the employee stated it's a known software engine issue that they are working on. I hoping some of you have experienced this and may know a trick or two to assist me.

Thanks!

-Steven  

Steven,

UFED PA v3.5 that was released 3 months ago addressed both memory and performance improvements related to heavy extractions.

Still if the extracted device has 50,000 images and 200,000 other data elements (SMS, MMS, Emails ...) you might need to upgrade your computer to a 64bit Windows OS.

For over a year, we recommend using a 64bit Windows 7 with at least 8GB of memory.
A 32bit Windows OS limits the amount of memory UFED PA (or any other application can use)

If you have a lower computer configuration, I would suggest to upgrade.

I sent you more info in a PM

Ron  

sward,
As Ron says, maybe you need to go to 64 bit.
We are using PA for all our ios systems, some exams have returned well over 50,000 images, the record in our office is 197,666 images returned - 8.5 hr dump-
You should not be experiencing problems with PA with "just" 10,000 images  

Agreed - 10,000 images are nothing when you dump an iPhone or and iPad.. my shop also had had in access of 150,000 images, 70,000+ SMSs extracted from a device.

As was mentioned, ensure you have enough processing power and using 64-bit. We use an iMac that runs Win 7 Pro on it and it runs PA quite brilliantly.
_________________
Twitter: twitter.com/forensicranger 

- RonS

A 32bit Windows OS limits the amount of memory UFED PA (or any other application can use)

Just for the record, yes, but no .

The issue is the license, Server type of 32 bit OS will use 8 Gb and more happily:
www.geoffchappell.com/...memory.htm

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

The maximum available amount of RAM per process for a 32-bit OS is 2 GB.
Yes, you can use the /3GB switch to get 3GB, but other applications on your computer might not like it and we decided not to use this.

msdn.microsoft.com/en-...s.85).aspx

Ron  

Thanks for all the replies!

Originally, I had installed the analyzer on our laptop (Duo Core/4GB/Win7 32b) because I wanted to use it out in the field, if needed. However, due to the processing issues, I opted to install the analyzer on our examination machine -- which is due to be replaced soon, pending our new budget, but is still a very capable workstation. It's a FRED, 2x Xeon Quad Core/12GB RAm/Win 7 64b. Does this setup look adequate to run PA? It runs FTK 4.?? just fine.

While using the FRED, and to my surprise, I noticed the same processing issues. I noted while processing the data dump, the memory was at 40-percent of max and the proceesor was at 5-percent of max.

When attempting to view images, it's nearly impossible to do. Any time you scroll down, it's take 30-60 seconds for images to load, while the application freezes or states "not responding." It eventually starts to respond. SMS is faster, but still seems slower than it should be.

I have viewed several non-IOS data dumps on the laptop (not the FRED) and never had an issue with analyzing the data on earlier versions of PA. I have not yet tested non-IOS data dumps on the new version, which is something I ought to do.