Forensic Toolkit v3 Tips and Tricks – Re-indexing a case

by Brian K.Glass

This is the first in a series of articles that will cover topics concerning AccessData Forensic Toolkit (FTK) version 3.

So you’ve created a case in FTK 3.X / Oracle and added 20 forensic
images of seized computers and assorted media which previously had been
successfully processed and indexed. You’ve worked on this case for
weeks, painstakingly searching and bookmarking thousands of keywords
provided by Inspector R. Runner who has been investigating the Acme
Corporation.

Monday morning you come to work and fire up your FTK cluster, open
your case, go to Indexed Search, type in the keywords Wile E. Coyote and
Ka-Blam!! You get an error message saying a Search Request Error has
occurred (Figure 1.) What happened, it was working fine on Friday?

Read more

View full post on Forensic Focus Blog

. . . . . . . .