Re: [sleuthkit-users] Slow Add Image Process Cause
Brought to you by:
carrier
From: Kalin K. <me....@gm...> - 2014-05-07 14:39:23
|
On Wed, May 7, 2014 at 10:53 PM, Brian Carrier <ca...@sl...> wrote: > The bigger question for me is why we are getting these cache misses and I need to spend some more time with some more images to find out. The lookup is to find the ID of the parent and we process from the root directory down. So, in theory, we have already processed the parent folder before the children and it should be in the cache. We need to figure out why the parent isn't in the cache... > Just a wild guess... NTFS "oddities" like reparse points, etc.? Kalin. |