±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 4 Visitors: 188

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

FTK 3 Indexing files location?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

ecophobia
Senior Member
 

FTK 3 Indexing files location?

Post Posted: Apr 21, 10 22:31

Hi all,

just a quick question re: FTK 3

Where does FTK 3 stores Indexing Files. If I remember correctly 1.x used to store index.dat files with the case (same folder). Did that change in FTK 3 ?

Thanks.  
 
  

BitHead
Senior Member
 

Re: FTK 3 Indexing files location?

Post Posted: Apr 21, 10 23:24

Are you trying to determine which table in Oracle stores the indexing files?  
 
  

BitHead
Senior Member
 

Re: FTK 3 Indexing files location?

Post Posted: Apr 21, 10 23:38

To follow up -
I just looked in a case folder used by FTK 3.1, and in the case folder there is a dts_idx folder that contains folders named 0-9 and opts that contain dts index logs. The folders contain:
history.ix
index_a.ix
index_b.ix
that continues through index_v.ix
index_v.ix.log
indexlog.dat

The opts folder contains alphabet.txt and noise_words.txt  
 
  

ecophobia
Senior Member
 

Re: FTK 3 Indexing files location?

Post Posted: Apr 21, 10 23:40

Hi BitHead,

No, just how much storage to buy for Oracle and Indexing,
But from you reply I could guess that Oracle is used for storing case metadata and Indexing as well. I haven't used FTK beyond 1.8, so I am a bit rusty there Wink From reading AccessData recommended specs they mention 5gb for 1 million records and I think indexing takes about 30% of compressed image. The largest SSD with dissent performance is 500gb. I am trying to figure out if that would be enough. (I do get large cases).  
 
  

Patrick4n6
Senior Member
 

Re: FTK 3 Indexing files location?

Post Posted: Apr 22, 10 03:05

Since AccessData moved graphic files out of the oracle DB, it's been a really small amount of space for indexes. Remember also that you can reduce the size of the DB by not indexing KFF ignorable files. 500GB is going to last you a long while, although of course your mileage will vary. Remember also that you can back up your cases and remove them from the DB to free up space, so the more pertinent question is are you going to use up that space before you get a break to back up and purge cases, and the answer to that is probably "no".
_________________
Tony Patrick, B. Inf Tech, CFCE
www.patrickcomputerfor...s.com/blog
www.twitter.com/Patrick4n6 
 
  

ecophobia
Senior Member
 

Re: FTK 3 Indexing files location?

Post Posted: Apr 22, 10 08:36

Thanks for the useful info.

Regards,
e-phobia Smile  
 
  

Jonathan
Senior Member
 

Re: FTK 3 Indexing files location?

Post Posted: Apr 22, 10 16:09

My experience echoes Patrick4n6's.

I recently processed 1TB of data (not disk space, but actual data) that included an EDB file containing 70 PSTs and resultant size of this in Oracle was 47GB. I would have thought a 250GB SSD would be sufficient to put Oracle on, especially if you archive off old cases.
_________________
Forensic Control
twitter.com/ForensicControl
St Bride Foundation, 14 Bride Lane, London, EC4Y 8EQ 
 

Page 1 of 2
Page 1, 2  Next