Notifications
Clear all

FTK 4

13 Posts
11 Users
0 Likes
790 Views
(@nea_icac)
Posts: 4
New Member
Topic starter
 

I recently completed a clean on a FRED SR with Windows 7X64 and FTK 4. I am having a lot of problems getting this software to run. I had the same problem with 3.4 until tech support suggested I quit using PostgreSQL and started using Oracle again. I tried FTK4 with Oracle and there was no apparent way to install KFF.

The problem is when I start a new case I add the evidence and everything seems to be running great then the importing stopps and the indexing begins. Then the machine slows to a standstill. I was trying to add 2 drives over the weekend to a new case and it was only about 50% finished Monday morning.

I am running a FRED SR with dual raid dual 3.xx quad core processors and 32GB of ram.

Any help and or suggestions would be greatly appreciated.

 
Posted : 21/02/2012 11:42 pm
(@steve91386)
Posts: 18
Active Member
 

AccessData is currently doing a "World Tour" for the launch of FTK4. A week ago I attended the seminar they had in Boston and needless to say FTK4 was real buggy - even in their demonstrations.

 
Posted : 22/02/2012 5:02 am
(@bithead)
Posts: 1206
Noble Member
 

And let me guess…when you called AccessData their support people had never heard of that problem before!

 
Posted : 22/02/2012 7:56 am
(@angrybadger)
Posts: 164
Estimable Member
 

Version 5 incoming !

twisted

 
Posted : 22/02/2012 3:17 pm
(@hydrocloricacid)
Posts: 37
Eminent Member
 

I have been using FTK4 and haven't had any issues although have been processing&indexing 60GB blocks of outlook PST's.

The first thing is to look to see if there are any resource bottlenecks slowing the process.
You have enough RAM so youcan'thave an issue there. hopefully you have ran the orajuster and allocated 40-60% of RAM to Oracle.

When I first started with FTK I had major issues because I didn't seperate the case files, database , temp folder and evidence to seperate HDD's. Processing would be very slow with the HDD light on solid. Getting a SSD and putting the DB and temp folder on that helped a lot. If you don't seperate the different files and have it all one one or two HDD's, the seek time for the HDD head's will be the bottleneck.

Have you had a look in the Resouce Monitor ? (can be found on the "performance" tab in task manager)
Is there any area in particular which seems to be slowing things down ?

I find when I process 200GB exchange EDB's that FTK's progress is quite slow with no apparent signs of what is slowing it down. CPU unilisation , RAM usage and HDD i/o are all minimal. Exporting to PST's seems to solve that. Instead of 4 weeks or more it takes about 4 days.

 
Posted : 23/02/2012 3:05 am
jmburns27
(@jmburns27)
Posts: 5
Active Member
 

You have to download kff separately for oracle from their download page

 
Posted : 27/02/2012 9:01 pm
(@nea_icac)
Posts: 4
New Member
Topic starter
 

Tanks for all the replies, since my original post I have downloaded and installed Oracle for FTK 4. I am now able to process cases again. There are still some problems with wait chains when the "Processing host" is running and and this slows everything down. When everything is running smooth the processor usage is high (Above 70%) then when the processor usage drops below 10% I find there are several (4 or more) wait chains underneath the processing host.

Oracle does a much better job for me than PostgresSql.

 
Posted : 27/02/2012 9:14 pm
mrpumba
(@mrpumba)
Posts: 114
Estimable Member
 

On another note, I to was having issues with FTK4 processing and PostSQL. I called support and they advised to install the recently released FTK 4.0.1, which is what I did. After doing so, it works well.

 
Posted : 29/04/2012 6:29 pm
(@kyrkos)
Posts: 9
Active Member
 

Maybe a stupid question… but, where did you download the Oracle from?

 
Posted : 30/04/2012 12:17 am
mrpumba
(@mrpumba)
Posts: 114
Estimable Member
 

I'm using it with PostgreSql. Also, I have (as stated on another post) separated my temp, program file and postgresql. On another machine, we have Oracle using 3.4 and have compared them. The system with the Postgresql is faster than the Oracle, not by much though. Both are stable (FTK with Oracle and PostgreSql), but I still have to do some more testing with further analysis in regards to the FTK 4.0.1 PostgreSql.

 
Posted : 30/04/2012 6:28 am
Page 1 / 2
Share:
Share to...