Intella case size is huge compared to evidence

[UnknownIssue]

This seems to be an ongoing frustrating issue I am having. I am using Intella 250GB. I am finding that the case size for my intella case is 2 or 3 times the size of the evidence ingested. For example today I have a 70GB Logical evidence file. It took 10 hours to process, and the resulting case size was 230GB, that's over 3xs the size of the evidence. It's killing my storage space on my machine, as if I store the case on USB the processing time increases almost exponentially.

The other issue is the 250GB size limit is limited by case size not evidence size. So even processing 70GB of evidence is making my case his the license level on intella. This doesn't seem right.

Is anyone else having this issue? I am not Caching the evidence in the case and the evidence size is not included in that 230GB case size total. 

[jon.pearse]

Hi,

The 250 size limit for your license is calculated on the evidence size. The evidence size limit relates to the cumulative file size of the evidence files as reported by Windows Explorer. E.g., if explorer reports a PST file as 2GB, then the evidence size for the PST is 2GB when added to a case. Note that the case size may be different, e.g. shown as 3GB, when the PST is indexed.

Are you using the latest version version of Intella (2.4)? Are you indexing the source data from a local drive in the system (e.g. not a network or USB drive)? Also, any indexing tasks which have not completed properly can contribute to the evidence size in the case.