How can I move the ElasticSearch (KFF) data folder without reinstalling?
- Open the Services snap-in (services.msc)
- Stop the "AccessData ElasticSearch" service
- Move the entire ElasticSearch "data" folder (default: "C:\Program Files\AccessData\ElasticSearch\data") to the desired location
- Open the "elasticsearch.yml" (default: "C:\Program Files\AccessData\ElasticSearch\config\elasticsearch.yml") in a text editor
- Find the below line:
# path.data: /path/to/data
- Uncomment that line (remove the #) and change it to the new data folder path (using the syntax drive:/folder)
- Save the altered file
- Restart the "AccessData ElasticSearch" service
- Go to Manage > KFF in FTK and verify the KFF data is seen correctly
This in only for moving the ElasticSearch data to a different folder/drive on the same PC.