FTK 3 Indexing file...
 
Notifications
Clear all

FTK 3 Indexing files location?  

  RSS
ecophobia
(@ecophobia)
Active Member

Hi all,

just a quick question re FTK 3

Where does FTK 3 stores Indexing Files. If I remember correctly 1.x used to store index.dat files with the case (same folder). Did that change in FTK 3 ?

Thanks.

Quote
Posted : 21/04/2010 11:31 pm
BitHead
(@bithead)
Community Legend

Are you trying to determine which table in Oracle stores the indexing files?

ReplyQuote
Posted : 22/04/2010 12:24 am
BitHead
(@bithead)
Community Legend

To follow up -
I just looked in a case folder used by FTK 3.1, and in the case folder there is a dts_idx folder that contains folders named 0-9 and opts that contain dts index logs. The folders contain
history.ix
index_a.ix
index_b.ix
that continues through index_v.ix
index_v.ix.log
indexlog.dat

The opts folder contains alphabet.txt and noise_words.txt

ReplyQuote
Posted : 22/04/2010 12:38 am
ecophobia
(@ecophobia)
Active Member

Hi BitHead,

No, just how much storage to buy for Oracle and Indexing,
But from you reply I could guess that Oracle is used for storing case metadata and Indexing as well. I haven't used FTK beyond 1.8, so I am a bit rusty there 😉 From reading AccessData recommended specs they mention 5gb for 1 million records and I think indexing takes about 30% of compressed image. The largest SSD with dissent performance is 500gb. I am trying to figure out if that would be enough. (I do get large cases).

ReplyQuote
Posted : 22/04/2010 12:40 am
Patrick4n6
(@patrick4n6)
Senior Member

Since AccessData moved graphic files out of the oracle DB, it's been a really small amount of space for indexes. Remember also that you can reduce the size of the DB by not indexing KFF ignorable files. 500GB is going to last you a long while, although of course your mileage will vary. Remember also that you can back up your cases and remove them from the DB to free up space, so the more pertinent question is are you going to use up that space before you get a break to back up and purge cases, and the answer to that is probably "no".

ReplyQuote
Posted : 22/04/2010 4:05 am
ecophobia
(@ecophobia)
Active Member

Thanks for the useful info.

Regards,
e-phobia -)

ReplyQuote
Posted : 22/04/2010 9:36 am
Jonathan
(@jonathan)
Senior Member

My experience echoes Patrick4n6's.

I recently processed 1TB of data (not disk space, but actual data) that included an EDB file containing 70 PSTs and resultant size of this in Oracle was 47GB. I would have thought a 250GB SSD would be sufficient to put Oracle on, especially if you archive off old cases.

ReplyQuote
Posted : 22/04/2010 5:09 pm
ecophobia
(@ecophobia)
Active Member

My experience echoes Patrick4n6's.

I recently processed 1TB of data (not disk space, but actual data) that included an EDB file containing 70 PSTs and resultant size of this in Oracle was 47GB. I would have thought a 250GB SSD would be sufficient to put Oracle on, especially if you archive off old cases.

Yeah,
cleaning up after the case is finished is always a good idea. 😉
thanks Jonathan. I am looking at processing 2-3Tb with FTK, and SSD 512gb is slightly faster then 256GB.

Thanks again.

ReplyQuote
Posted : 22/04/2010 6:41 pm
Share: