This article details considerations for ingesting large image and archive containers in the Reveal environment
Temp Space for Image Expansion
Temp space is required for decompressing and mounting forensic images and large archive containers. Processing agents have 1.7 TB free, which includes its temp space. If a forensic image/archive expands such that its size is larger than the allocated temp space, the import will fail.
Recommendations:
It’s important to understand the contents of your image or archive before processing. This allows you to make strategic pre-processing decisions.
Use a forensic or archiving tool to determine the data’s uncompressed size. We recommend keeping image sizes to 500 GB or less, with 1 TB as the upper limit, based on the total decompressed contents of the entire image.
Forensic images and archives are typically large files. In such cases, use the source software to split the image into smaller, self-contained images, each of which can be multipart.
Determine if your image/archive is a physical or logical image. Physical images often contain many unnecessary system files. We strongly suggest prefiltering to remove system files before processing. The filtered results can be exported into a logical image and processed.
Overly large import will take longer to process before review can begin, are more likely to introduce errors, and are generally not good practice.
Reference Reveal Processing Supported File Formats for a list of Archive container types supported by Reveal.
If in doubt, contact Reveal Support for advice about ingestion.