Overview
This article outlines how to install Cassandra and the KFF (Known File Filter), import the provided NSRL hash set, and configure it to work with our software.
Process
Install the KFF
- Download the desired version of the KFF from https://accessdata.com/product-download-page.
- Download and install the appropriate version of Java.
- Mount the KFF ISO and run Autorun.exe.
- Click Cassandra 64 bit.
- Follow the wizard to complete the Cassandra installation.
Note: In a multi-box setup, you must check Enable Remote Access checkbox in the Remote Access Settings dialog and enter the machine name in the Enter the IP Address or DNS Name of this machine on the network field. This will be the RPC Address for Cassandra.
- Back at the autorun menu, click Install KFF Import Utility 64 bit.
- Follow the wizard to complete the KFF Import Utility installation.
Import the NSRL Data
- Extract the contents of the nsrlsource_2.54.zip found on the root of the ISO.
- Launch the KFF Import Utility.
- In the Server Address field, enter the RPC Address for Cassandra.
- Next to the File to import field, browse to the NSRLFile.txt extracted in step 1.
- Click Import.
Note: The import process can take several hours, but progress can be seen in the progress bar in the lower-left, and it will give you a popup when the import is complete.
Configure FTK/Lab/Enterprise
- Log in to FTK/Lab/Enterprise and go to Tools > Preferences.
- Click Configure KFF.
- In the Server Address field, enter the RPC Address for Cassandra.
- Click Test Server to verify FTK/Lab/Enterprise can connect to Cassandra.
- Click Save.
Configure FTK Central
- Navigate to the Forensic Tools installation folder (typically "<drive>:\Program Files\AccessData\Forensic Tools\<version>\bin").
- Open ADG.WeblabSelfHost.exe.config in a text editor.
- Modify the KFFServerURL key's value to contain Cassandra's RPC Address, as shown below:
<add key="KFFServerURL" value="WIN-F4EEK4G22J6:9042" />
- Save the changes.
- Restart the AccessData Exterro Self Host Service.