Move the ElasticSearch (KFF) data folder without reinstalling

Question

How can I move the ElasticSearch (KFF) data folder without reinstalling?

Answer

1. Open the Services snap-in (services.msc)
2. Stop the "AccessData ElasticSearch" service
3. Move the entire ElasticSearch "data" folder (default: "C:\Program Files\AccessData\ElasticSearch\data") to the desired location
4. Open the "elasticsearch.yml" (default: "C:\Program Files\AccessData\ElasticSearch\config\elasticsearch.yml") in a text editor
5. Find the below line:
    # path.data: /path/to/data
6. Uncomment that line (remove the #) and change it to the new data folder path (using the syntax drive:/folder)
7. Save the altered file
8. Restart the "AccessData ElasticSearch" service
9. Go to Manage > KFF in FTK and verify the KFF data is seen correctly

Note

This in only for moving the ElasticSearch data to a different folder/drive on the same PC.