Notifications
Clear all

FTK 4

13 Posts
11 Users
0 Reactions
1,863 Views
(@nea_icac)
New Member
Joined: 16 years ago
Posts: 4
Topic starter  

I recently completed a clean on a FRED SR with Windows 7X64 and FTK 4. I am having a lot of problems getting this software to run. I had the same problem with 3.4 until tech support suggested I quit using PostgreSQL and started using Oracle again. I tried FTK4 with Oracle and there was no apparent way to install KFF.

The problem is when I start a new case I add the evidence and everything seems to be running great then the importing stopps and the indexing begins. Then the machine slows to a standstill. I was trying to add 2 drives over the weekend to a new case and it was only about 50% finished Monday morning.

I am running a FRED SR with dual raid dual 3.xx quad core processors and 32GB of ram.

Any help and or suggestions would be greatly appreciated.


   
Quote
(@steve91386)
Active Member
Joined: 14 years ago
Posts: 18
 

AccessData is currently doing a "World Tour" for the launch of FTK4. A week ago I attended the seminar they had in Boston and needless to say FTK4 was real buggy - even in their demonstrations.


   
ReplyQuote
(@bithead)
Noble Member
Joined: 20 years ago
Posts: 1206
 

And let me guess…when you called AccessData their support people had never heard of that problem before!


   
ReplyQuote
(@angrybadger)
Estimable Member
Joined: 18 years ago
Posts: 164
 

Version 5 incoming !

twisted


   
ReplyQuote
(@hydrocloricacid)
Eminent Member
Joined: 16 years ago
Posts: 37
 

I have been using FTK4 and haven't had any issues although have been processing&indexing 60GB blocks of outlook PST's.

The first thing is to look to see if there are any resource bottlenecks slowing the process.
You have enough RAM so youcan'thave an issue there. hopefully you have ran the orajuster and allocated 40-60% of RAM to Oracle.

When I first started with FTK I had major issues because I didn't seperate the case files, database , temp folder and evidence to seperate HDD's. Processing would be very slow with the HDD light on solid. Getting a SSD and putting the DB and temp folder on that helped a lot. If you don't seperate the different files and have it all one one or two HDD's, the seek time for the HDD head's will be the bottleneck.

Have you had a look in the Resouce Monitor ? (can be found on the "performance" tab in task manager)
Is there any area in particular which seems to be slowing things down ?

I find when I process 200GB exchange EDB's that FTK's progress is quite slow with no apparent signs of what is slowing it down. CPU unilisation , RAM usage and HDD i/o are all minimal. Exporting to PST's seems to solve that. Instead of 4 weeks or more it takes about 4 days.


   
ReplyQuote
jmburns27
(@jmburns27)
Active Member
Joined: 14 years ago
Posts: 5
 

You have to download kff separately for oracle from their download page


   
ReplyQuote
(@nea_icac)
New Member
Joined: 16 years ago
Posts: 4
Topic starter  

Tanks for all the replies, since my original post I have downloaded and installed Oracle for FTK 4. I am now able to process cases again. There are still some problems with wait chains when the "Processing host" is running and and this slows everything down. When everything is running smooth the processor usage is high (Above 70%) then when the processor usage drops below 10% I find there are several (4 or more) wait chains underneath the processing host.

Oracle does a much better job for me than PostgresSql.


   
ReplyQuote
mrpumba
(@mrpumba)
Estimable Member
Joined: 15 years ago
Posts: 116
 

On another note, I to was having issues with FTK4 processing and PostSQL. I called support and they advised to install the recently released FTK 4.0.1, which is what I did. After doing so, it works well.


   
ReplyQuote
(@kyrkos)
Active Member
Joined: 15 years ago
Posts: 9
 

Maybe a stupid question… but, where did you download the Oracle from?


   
ReplyQuote
mrpumba
(@mrpumba)
Estimable Member
Joined: 15 years ago
Posts: 116
 

I'm using it with PostgreSql. Also, I have (as stated on another post) separated my temp, program file and postgresql. On another machine, we have Oracle using 3.4 and have compared them. The system with the Postgresql is faster than the Oracle, not by much though. Both are stable (FTK with Oracle and PostgreSql), but I still have to do some more testing with further analysis in regards to the FTK 4.0.1 PostgreSql.


   
ReplyQuote
Page 1 / 2
Share: