Processing Unallocated space/Orphan files

A place to ask the community for help with using Autopsy.

Moderator: carrier

Processing Unallocated space/Orphan files

Postby mattj7 » Wed Jul 05, 2017 2:31 pm

Hi, I am trying to process/index a disk image, for the purposes of searching for key words. When loading the data in, I noticed that it was taking a LONG time (days) to add Orphan files. I thought this was because Autopsy was processing unallocated space, so I restarted the adding of source data, and this time I unchecked "process unallocated space"

Despite this, it still says "Status: Adding: $OprhanFiles/..."

I am not interested in adding the Orphan files, and this process has taken a week now. How can I stop it from adding these Orphan Files to the case data?
mattj7
 
Posts: 3
Joined: Wed Jun 21, 2017 4:06 pm

Re: Processing Unallocated space/Orphan files

Postby Hoyt » Thu Jul 20, 2017 2:38 pm

I'm sure you've gotten past this point by now. I'm still curious about it if you'd care to share some information:

What was the size of the disk image? Was it compressed?
How was I/O handled? i.e. USB, eSATA, Firewire, etc. What are the destination specs? i.e. disk(s) size/type, processor, RAM
How many ingest modules did you run actually at ingest? What were they?
How long did it finally take or how long did it run before you abandoned it?
Hoyt
 
Posts: 60
Joined: Thu Dec 11, 2014 4:02 am
Location: Little Rock, AR


Return to Autopsy Troubleshooting

Who is online

Users browsing this forum: No registered users and 1 guest

cron