Support Portal

Problem

How should I "tweak" my operating system to get better performance from Forensic Tools?

Resolution

Windows Power Settings

Run the following command from the Windows Command Prompt with Admin rights to set the power plan to “High Performance” on Microsoft Windows Server 2008 R2 and Microsoft Windows Server 2012 R2:

C:\> powercfg /s scheme_min

Reference: https://technet.microsoft.com/en-us/library/cc748940(v=ws.10).aspx

Microsoft Indexing Service

Run the following commands from the Windows Command Prompt with Admin rights to disable the Windows Indexing Service on Microsoft Windows Server 2008 R2 and Microsoft Windows Server 2012 R2:

C:\> dism /online /Disable-Feature /FeatureName:Indexing-Service-Package

C:\> sc config WSearch start= disabled

Reference: https://technet.microsoft.com/en-us/library/hh824822.aspx

8.3 Filenames

Run the following command from the Windows Command Prompt with Admin rights to disable the creation 8.3 filenames on Microsoft Windows Server 2008 R2 and Microsoft Windows Server 2012 R2:

C:\> fsutil behavior set disable8dot3 1

Reference: https://technet.microsoft.com/en-us/library/ff633453(v=ws.10).aspx

Last Access

Run the following command from the Windows Command Prompt with Admin rights to disable updates to the Last Access timestamp on Microsoft Windows Server 2008 R2 and Microsoft Windows Server 2012 R2:

C:\> fsutil behavior set disablelastaccess 1

Note: This modification requires a reboot to take effect.

Reference: https://technet.microsoft.com/en-us/library/cc785435(v=ws.11).aspx

Cause

A number of Windows “tweaks” are available to improve the performance of the software and potentially prevent issues.