Crash/Reboot

A place for general discussion of sleuthkit.org projects or other open source forensics software.

Moderator: carrier

Crash/Reboot

Postby thegman » Wed Jul 08, 2015 8:49 pm

I recently had a power outage while analyzing a drive. Autopsy was about half way through the ingest modules. When I started the computer back up and started to run the ingest modules again, my expectation was that autopsy would start where it left off. To my surprise autopsy seemingly had to start running the ingest modules from the beginning. Is this expected behavior?
thegman
 
Posts: 2
Joined: Wed Jul 08, 2015 8:45 pm

Re: Crash/Reboot

Postby carrier » Fri Jul 10, 2015 1:06 pm

Unfortunately, yes. We do not have check-pointing yet to restart from the same place and most modules do not have any logic to not create duplicate blackboard artifacts (for performance reasons). Sorry.
carrier
 
Posts: 45
Joined: Thu May 15, 2014 3:31 pm

Re: Crash/Reboot

Postby thegman » Wed Jul 22, 2015 3:29 am

Thank you so much for the reply. Out of curiosity do you have any plans on implementing check-point functionality, and or updating the logic to the ingest modules?
thegman
 
Posts: 2
Joined: Wed Jul 08, 2015 8:45 pm


Return to General

Who is online

Users browsing this forum: No registered users and 2 guests