Hi all,
just a quick question re FTK 3
Where does FTK 3 stores Indexing Files. If I remember correctly 1.x used to store index.dat files with the case (same folder). Did that change in FTK 3 ?
Thanks.
Are you trying to determine which table in Oracle stores the indexing files?
To follow up -
I just looked in a case folder used by FTK 3.1, and in the case folder there is a dts_idx folder that contains folders named 0-9 and opts that contain dts index logs. The folders contain
history.ix
index_a.ix
index_b.ix
that continues through index_v.ix
index_v.ix.log
indexlog.dat
The opts folder contains alphabet.txt and noise_words.txt
Hi BitHead,
No, just how much storage to buy for Oracle and Indexing,
But from you reply I could guess that Oracle is used for storing case metadata and Indexing as well. I haven't used FTK beyond 1.8, so I am a bit rusty there 😉 From reading AccessData recommended specs they mention 5gb for 1 million records and I think indexing takes about 30% of compressed image. The largest SSD with dissent performance is 500gb. I am trying to figure out if that would be enough. (I do get large cases).
Since AccessData moved graphic files out of the oracle DB, it's been a really small amount of space for indexes. Remember also that you can reduce the size of the DB by not indexing KFF ignorable files. 500GB is going to last you a long while, although of course your mileage will vary. Remember also that you can back up your cases and remove them from the DB to free up space, so the more pertinent question is are you going to use up that space before you get a break to back up and purge cases, and the answer to that is probably "no".
Thanks for the useful info.
Regards,
e-phobia -)
My experience echoes Patrick4n6's.
I recently processed 1TB of data (not disk space, but actual data) that included an EDB file containing 70 PSTs and resultant size of this in Oracle was 47GB. I would have thought a 250GB SSD would be sufficient to put Oracle on, especially if you archive off old cases.
My experience echoes Patrick4n6's.
I recently processed 1TB of data (not disk space, but actual data) that included an EDB file containing 70 PSTs and resultant size of this in Oracle was 47GB. I would have thought a 250GB SSD would be sufficient to put Oracle on, especially if you archive off old cases.
Yeah,
cleaning up after the case is finished is always a good idea. 😉
thanks Jonathan. I am looking at processing 2-3Tb with FTK, and SSD 512gb is slightly faster then 256GB.
Thanks again.