Greetings,
I'd like to hear about people's experiences with the relative stability of EnCase vs FTK. I left a large file carve job running in FTK 1.71 last night and, sometime in the middle of the run, FTK crashed. Earlier on the same project, FTK crashed when viewing a drawing file. I've had FTK crash before when it hit an anti-virus signature file.
AccessData's response is usually of the form "Instead of doing everything at once, break your work down into pieces, and if a certain piece causes a problem, exclude the file causing the problem." This approach greatly extends the time required to process a case, while hard disk sizes are doing the same thing.
Is EnCase any more stable, or is this sort of unstable application par for the course?
-David
David,
From my experience, neither product can be considered as stable as say a word processing program. I have had instances where FTK would load a case just fine several days in a row and then suddenly throw a hissy and corrupt the file and not be able to open the case without starting from scratch. Same with EnCase. Working along and suddenly frozen never to be revived. I have become quite religious about creating case snapshots before each processing step or search.
Greetings,
Thank you for the feedback. My case notes are filling up with "FTK crashed, restarting from snapshot" messages. As long as I'm not alone ….
-David
I have had several that will not restart from the snapshot and I have to go back to the previous hours backup.
On several occasions I have sent the crash logs to AD only to be told my system is out of resources. Most machines are Dual-Core with 2GB RAM, so that is a bit of a concern. Right now I am building a new test platform on Server 2003 Enterprise to run 2.0 with 16GB RAM.
FTK 2.0 only runs on 32-bit.
FTK 2.0 only runs on 32-bit.
??? And that means . . . ?
Server 2003 32 bit Enterprise R2 supports 32 Gig of RAM.
Actually Enterprise SP2 & R2 support up to 64GB of RAM. However I did not have that much RAM laying around when I started my little project, and ECC while less than in previous times is still none too cheap for the extra RAM.
Yes, you are right, I didn't read far enough down the table, sorry.