Jump to content

Intella case size is huge compared to evidence


Recommended Posts

This seems to be an ongoing frustrating issue I am having. I am using Intella 250GB. I am finding that the case size for my intella case is 2 or 3 times the size of the evidence ingested. For example today I have a 70GB Logical evidence file. It took 10 hours to process, and the resulting case size was 230GB, that's over 3xs the size of the evidence. It's killing my storage space on my machine, as if I store the case on USB the processing time increases almost exponentially.

The other issue is the 250GB size limit is limited by case size not evidence size. So even processing 70GB of evidence is making my case his the license level on intella. This doesn't seem right.

Is anyone else having this issue? I am not Caching the evidence in the case and the evidence size is not included in that 230GB case size total. 

Link to post
Share on other sites

Hi,

The 250 size limit for your license is calculated on the evidence size. The evidence size limit relates to the cumulative file size of the evidence files as reported by Windows Explorer. E.g., if explorer reports a PST file as 2GB, then the evidence size for the PST is 2GB when added to a case. Note that the case size may be different, e.g. shown as 3GB, when the PST is indexed.

Are you using the latest version version of Intella (2.4)? Are you indexing the source data from a local drive in the system (e.g. not a network or USB drive)? Also, any indexing tasks which have not completed properly can contribute to the evidence size in the case. 

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...