Yes, although it does not appear related to the OP's post.
I've run one test so far to confirm the consistency issues in ftk 2. It does not look good after one test.
I created an 80GB image and processed it on two machines with different hardware.
Box 1
Dell Precision 690
2xquad core xeon's
8GB 667 ECC
Box 2
Custom built
quad core 2.4GHz
8GB PC8500
Results
Box 1 2164522 objects
Box 2 2164533 objects
*sigh*
More testing is required obviously….but I can at this point confirm after one test that this is still an issue in FTK 2.0.2 Build 333
I've run one test so far to confirm the consistency issues in ftk 2. It does not look good after one test.
I created an 80GB image and processed it on two machines with different hardware.
Box 1
Dell Precision 690
2xquad core xeon's
8GB 667 ECCBox 2
Custom built
quad core 2.4GHz
8GB PC8500Results
Box 1 2164522 objects
Box 2 2164533 objects*sigh*
More testing is required obviously….but I can at this point confirm after one test that this is still an issue in FTK 2.0.2 Build 333
Very intersting Hogfly, it's just one test but still. Is it possible to see where the 10 objects in question in Box 2 come from? I'm not too sure with FTK 2, but with 1.7 each object type was divided in to emails, graphics, unallocated, documents etc and viewing the numbers in each subset may help point to any discrepancies.
Have you done similar testing for any version of EnCase or with FTK 1.7?
Jonathan,
I clearly need to run more tests. I've started test #2. I didn't bother at this point to delve in to where the discrepancy is. I figure I'll run a number of tests and then see where the issue appears to be since it takes far more time to process the image than anything else )
Thanks for the work hogfly! I was meaning to do this very thing but the life a a student just leaves me with so little time (not that your time isn't valuable, which is really my point in thanking you ) ). Watching with interest;
-Sleepy
Given that this thread has gained some unforseen attention I feel the need to say the following regarding the testing I'm doing…
I have conducted one test. One test in any field is inconclusive. For the sake of responsibility to our field do not sensationalize the result I posted above. Since I can't tie up both of the machines I used for the previous test I am working on getting another box to use. The tests will start from scratch and will probably take a week or two to complete. I invite others to do the same. Do not take the single result I posted above as anything truly meaningful, other than it shows that more testing is required. In the words of Ronald Weiss I need to determine if it is the tool, or the tool operating the tool.
Forum Members,
Quick introduction I run development at AccessData. I have been meaning to get involved in this forum for some time to contribute and engage in discussions. Unfortunately, this topic is my first post. As everyone can imagine we take anything having to do with forensic integrity very seriously. We spend a great deal of our testing time ensuring that the file counts are correct on machines with the same hardware and with different hardware. At this time, we do not know of any count issues. If anybody has test data and steps showing a forensic integrity issue please contact me personally (bkarney@accessdata.com) or support (support@accessdata.com/ (801) 377-5410) ASAP.
Appreciate your consideration and continued support,
Brian
Brian, I'd like to extend a very warm welcome to you from both myself and (if they'll permit me!) from the membership here at Forensic Focus. I think we're all aware that the recent launch has generated some mixed reviews - perhaps even controversy - but engaging with the forum members here is, I think, a very positive step and something to be applauded. After all, it can't have been easy to step into the lions' den 😉
I'd like to encourage anyone who has experience of the issues mentioned to contact Brian or Access Data. Equally, I'd also like to encourage Brian to continue posting and keep us up to date with things as they progress. I think there's an opportunity here to establish a very constructive dialogue - let's make full use of it.
Access Data are offering FTK 1.x to FTK 2 'transition days' in the UK. It's advertised as "a must for FTK1.X users wishing to transition to the new FTK 2.0"
There is one in London in September which costs £525.00 + VAT (US$1215.00). That's a lot for a one day course. With all the recent bad publicity surrounding FTK 2 Access Data could have attempted some goodwill and offered this course as free for licensed users.