Follow

Move the ElasticSearch (KFF) data folder without reinstalling

Created by: Brendan Bone
Created date:
Last Updated date:

Question

How can I move the ElasticSearch (KFF) data folder without reinstalling?

 

Answer

  1. Open the Services snap-in (services.msc)
  2. Stop the "AccessData ElasticSearch" service
  3. Move the entire ElasticSearch "data" folder (default: "C:\Program Files\AccessData\ElasticSearch\data") to the desired location
  4. Open the "elasticsearch.yml" (default: "C:\Program Files\AccessData\ElasticSearch\config\elasticsearch.yml") in a text editor
  5. Find the below line:
     # path.data: /path/to/data
  6. Uncomment that line (remove the #) and change it to the new data folder path (using the syntax drive:/folder)
  7. Save the altered file
  8. Restart the "AccessData ElasticSearch" service
  9. Go to Manage > KFF in FTK and verify the KFF data is seen correctly

 

Note

This in only for moving the ElasticSearch data to a different folder/drive on the same PC.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

Comments

Powered by Zendesk