How to resume FTK i...
 
Notifications
Clear all

How to resume FTK interrupted analysis?

2 Posts
1 Users
0 Reactions
1,010 Views
 Peo
(@peo)
Posts: 2
New Member
Topic starter
 

I would like to resume the analysis of "Case1" of an Image1.DD file that I was running with FTK (ver.7.3.0.536) which I interrupted.

I go to "Tools"
- click on "select image"
- active flag (selection) of "Case1"
- click on "restart"
- click on "continue processing"

Then I open "Case1" and the "Data Processing Status" pop up appears
The problem is that I see the situation at the exact point of interruption (I see the count of Discovered, Processed and Indexed files) but the parsing does not continue, everything remains still.
In fact the "Process State" has the value "Queued".

How should I change the "Process State" from the current "Queued" to the desired "Processing"?
I don't understand... it seems like the parsing never starts again
Anyone help me?

 
Posted : 29/09/2023 7:16 am
 Peo
(@peo)
Posts: 2
New Member
Topic starter
 

I'm back to ask for help to solve my problem with FTK reported 3 weeks ago.
If I "Pause" the analysis of a "Case" and then try to restart it, it does not restart and remains (it would seem forever) in the "Queued" state.

Occasionally I need to interrupt the analysis of ".dd" images (sometimes very long) because I am forced to turn off the PC I work on for business needs.
Since I don't want to start the zero analysis every time, I'm wondering what the correct procedure is since the one I know (and I think is correct, but obviously I'm wrong) doesn't work.

I proceed in this way:

1) while examining the clone with FTK I interrupt the parsing by clicking on the "Pause" button (which after the click turns into "Resume"), then on the "Close" button, then I exit "FTK" and turn off the PC.

2) after turning the PC back on, I return to FTK and from the "Tools" menu select the "Recover Processing Jobs" item which opens the "Recover Processing Jobs" pop-up mask in which the jobs started but not finished by the Evidence Processing Engine appear (screenshot #1).

3) I select my paused job and click on the "Restart" button.

4) a second "Recovery Type" pop-up mask appears in which I choose to resume the process by selecting "Continue processing" (screenshot #2).

5) finally I enter the "Case" and the "Data Processing Status" pop-up mask immediately appears showing me the Discovered, Processed and Indexed values ​​present at the moment the process was paused.

Now everything seems to be working, the situation is the same as when I paused the process and told it to continue with the exam, but in reality there is a huge problem: the "Process State" remains "Queued" and for days and days (forever?) nothing happens (screenshot #3)!

How do I restart this process (from Queued to Processing) and complete the clone exam?

Has anyone really ever had this problem?
Can anyone really help me?
Thanks in advance and regards.

 
Posted : 23/10/2023 9:36 am
Share: