Re: [sleuthkit-users] Autopsy re-ingesting

[Richard C. <rco...@ba...>]

It is not currently possible to stop an ingest job (i.e., a data source
[e.g., an image], a set of ingest modules, and the settings for those
modules) or an individual ingest module and later start again where you
left off. Instead, you will have an incomplete set of results (artifacts,
carved files, etc.). On a related note, if you run the same ingest modules
on the same inputs, duplicate results (artifacts, carved files, etc.) will
be generated. However, we have recently implemented an ingest history
feature, which among other things, warns users if a particular module is
about to be used to analyze the same input data source. This feature uses
case database tables that relate ingest modules by version to data sources,
and is a first step towards more comprehensive tracking of what has been
executed by Autopsy.

Richard Cordovano
Autopsy and Autopsy Customization Teams Lead
Basis Technology

On Sun, Dec 4, 2016 at 7:22 AM, Nanni Bassetti <dig...@gm...> wrote:

> Hi all,
> it seems that if you stop some ingesting engines, when you restart them,
> they start again from the beginning...why?
> Is it possible to restart them from the breaking point?
> Thanks
>
> --
> Dott. Nanni Bassetti
> http://www.nannibassetti.com
> CAINE project manager - http://www.caine-live.net
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>