FTK Central 7.5.2 (March Release) has been updated to support configurable Index Merging with the use of configuration keys and registry keys (on Local EP/DPE's).
- StartIndexMergeProcessAt – This key allows users to configure the time in which Index Merges start.
- DisableAutoIndexMerge – This key allows users to toggle Automatic Merged Indexing.
How to configure these keys?
The keys required for configuration are available from FTK/C 7.5.2+. They are located in the ADGWeblabSelfHost.exe.config file located in C:\Program Files\AccessData\Forensic Tools\7.5\bin.
Ensure the Exterro Service is restarted after making any changes.
A value has to be configured as a 12-hour clock value.
E.g. 12:00PM E.g. 12:00AM
<add key=”StartIndexMergeProcessAt” value=”5:10PM” />
If the DisableAutoIndexMerge configuration key is set as false, index merges will only occur at the configured time.
If the DisableAutoIndexMerge configuration key is set as true, index merges will occur automatically after a re-indexing job.
The DisableAutoIndexMerge configuration key must be set as false with the associated registry key below set as true for configured Index Merging to operate.
|DisableAutoIndexMerge||true = Index merges will occur automatically.|
false = Index merges will not occur automatically and only at a configured time.
<add key=”DisableAutoIndexMerge ” value=”false” />
Additionally, on all DPE's one must configure the registry key as shown below.
How to configure registry keys on Local EP/DPE's?
To ensure index merge configurations work as they should, Local EP/DPE's, registry keys must be edited.
- Open Regedit.
- Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Products\Evidence Processing Engine\10.2*.
- Modify the string value Disable Auto Index Merge.
- Enter a value:
- True if the DisableAutoIndexMerge key is set as false. Allows index merge to occur at a set time.
- False if the DisableAutoIndexMerge key is set as true. Does not allow index merge to occur at a set time, instead it will occur automatically after a re-indexing job.