Crash/Reboot

[thegman]

I recently had a power outage while analyzing a drive. Autopsy was about half way through the ingest modules. When I started the computer back up and started to run the ingest modules again, my expectation was that autopsy would start where it left off. To my surprise autopsy seemingly had to start running the ingest modules from the beginning. Is this expected behavior?

[carrier]

Unfortunately, yes. We do not have check-pointing yet to restart from the same place and most modules do not have any logic to not create duplicate blackboard artifacts (for performance reasons). Sorry.

[thegman]

Thank you so much for the reply. Out of curiosity do you have any plans on implementing check-point functionality, and or updating the logic to the ingest modules?