Index Stopped

[ha14]

Hi
I was trying to indexmy drive c containing windows ultimate 32 bits, and then indexing was interrupted

02|11/12/10 13:30:40|Config file loaded: C:\ProgramData\PassMark\OSForensics\zoom\zoom.zcfg
09|11/12/10 13:30:42|The max unique words expected is beyond the practical limitations of the hardware. We have truncated the limit to what is possible.
08|11/12/10 13:30:42|Depending on the sizes of the pages indexed, it is extremely likely that you will exceed the 32-bit address space limitations of your system, rendering the resultant index files incomplete. We would suggest lowering the limits specified or using the 64-bit version of Zoom on a 64-bit system. See the Help file for more information.
10|11/12/10 13:30:42|Start indexing (offline mode) at Fri Nov 12 13:30:42 2010
02|11/12/10 13:30:42|Maximum number of files: 2302623
02|11/12/10 13:30:42|Will scan files with extensions

02|11/12/10 13:30:42|Search root directory: C:
02|11/12/10 13:30:42|Web site URL: C:\
02|11/12/10 13:30:42|Estimated RAM required during index process: 5533448 KB
02|11/12/10 13:30:42|Total RAM: 2095608 KB
02|11/12/10 13:30:42|Available RAM: 1223784 KB
08|11/12/10 13:30:42|Not enough memory. Change the configuration to index fewer files or words.
07|11/12/10 13:30:42|Indexing failed
02|11/12/10 13:30:42|Cleaning up memory used for index data... please wait.
02|11/12/10 13:30:42|Finished cleaning up memory.


How to solve it.

[David (PassMark)]

You have run out of RAM.

The first and most important comment is that we are in the process of improving the interface to the indexing function, to turn it into a Wizard. This should be available in the next beta release (in a week or so from now). So it should be harder to get into this out of RAM state in the future.

You seem to have 2.3 million files on your hard drive? Do you really want to search the content of all of these files at the same time? Depending on the type of the files and the size of all the files, this might not be possible on your 32bit system with 1.2GB of free RAM.

So you need to either index less documents, or make more RAM available. Some ways to do this are,

1) From the create index configuration window select fewer file type to index. (e.g. just index .DOC and .PDF files, depending on what you are looking for).
2) Select a just a subset of your files to index. e.g. just one top level folder at a time.
3) Switch to a 64bit system (which support much larger amounts of RAM).
4) Skip folders that you know you don't want to search (e.g. c:\program files)
5) Turn on the "Max files to index" option and set the limit to a smaller number, e.g. 100,000 document, so the indexing will proceed just until this limit is hit.

[ha14]

Hi
The drive c is 50 go containing th windows 7 os and some installed applications, how can i have 2.3 millions files???? I used treesize http://www.jam-software.com/freeware/index.shtml to sort the files to match 2.3 million!! but there are nor there, are those residues of deleted files that Os Forensics detecting?

[David (PassMark)]

We are reporting, 2,302,623 files in the log. Let me see how we calculate this number and get back to you. A typical PC would, as you point out, have much less. Maybe 100,000 files would be more normal.

[David (PassMark)]

It seems the file count also includes an estimate of E-mails found. So the 2.3M figure is the total of files found and E-Mails found. But at the moment is the estimate for E-Mails found on the disk is pretty rough and often an over estimate of the true situation, but the counting is fast.

We have discussed it internally and decided it is worth doing a more accurate count, even if it means slowing down the process somewhat.

(You do have a bunch on files containing E-Mails on this hard drive, right?)

So the next beta should not have this problem.

In the meantime, just manualy set the max files to index to 100,000 files and it should be OK.

[ha14]

Hi
Thanks for the reply, I only use Gmail, so dont see how they are downloaded on my hard drive! I dont use outlook. As I said the drive C: contains my OS, also i have my ipad the sync via itunes so there should be like 60applications. I doubt that all that I have goes up to 2.3millions! May be OSForensics can help in this situation by deleting residual left over files to make the index more accurate.

[David (PassMark)]

In Windows explorer, can you multi-select all the folders on in the root folder on your C: drive, then right click and select properties. This should give you a file count.

[ha14]

Thanks for your reply, here is the result
69 795 files, 14 337 folders size on disk 28.9

[David (PassMark)]

For the moment just manually set the max files to index to 100,000 files and it should be OK.

There will be more accurate counting method in the next beta. Early next week we think for the release. If you still have a problem with that new release, we'll need to look into it deeper.

Thanks for the feedback.

[David (PassMark)]

The new beta release of OSForensics V0.84 is now available.
It should hopefully fix the problem above.