Create Index error

[lewgoins]

Hi,

Using OSForensics I created an .e01 image of a 1TB drive but then when I tried to index it, it errored out after about 90 seconds with a message saying the number of files allowed for indexing had been exceeded. I looked for a configuration tab/area so that I could up the number of files allowed but didn't see one.

Thanks,

Lew

[Ray (PassMark)]

The pre-scan should determine the number of files to index. Did this run for longer than a few seconds (probably more than a few minutes given the size of your HDD), or did it skip by very quickly?

How many files did get indexed?

Can you also verify the version of OSF you are using?

We have recently found some bugs with indexing multiple partitions from a single image (but this has been fixed in the latest beta). So please let us know if you are indexing multiple devices or partitions (specified in Step 2 of the Create Index process). If this is the case, and you are using an older version, please update to the latest beta here and try again:
http://www.osforensics.com/download.html

[lewgoins]

I had loaded OSForensics 2.2 build 1000 (64-bit) so I removed that and installed the 2.3.2 beta. I created a second e01 image of a smaller drive (225 Gb) to test with but observed the same issue. I am using the free version to evaluate the software.

The time elapsed for the scan was 9 seconds, 1 file was indexed (the info file), there was 1 error (the actual e01 file), 444 total bytes, 200 unique words, 50 MB peak physical memory, 498 peak virtual memory, 15 max files and emails. Looking at the log it does say that the maximum file size has been exceeded.

I did an indexing test against a single folder with just data (not a forensic image) and the pre-scan ran until I received an error saying it had hit a 200k file limit. That prompted me to look and find your free version limitations so I will find a smaller e01 or other type of forensic image to test against.

[Ray (PassMark)]

Can you confirm if you are indexing more than one partition with these image files? If so, have you tried only indexing one partition at a time?


Can you also let us know what file types you have checked to be indexed. A screenshot of "Step 1 of 5" (under "Create Index") and "Step 2 of 5" (with your list of drives/folders/partitions to index) would help.


Also a screenshot of the devices under "Manage Case" and the Properties window of the relevant device, so we can check the partition number of the device in question.