Move the ElasticSearch (KFF) data folder without reinstalling

Created by: Brendan Bone
Created date:
Last Updated date:


How can I move the ElasticSearch (KFF) data folder without reinstalling?



  1. Open the Services snap-in (services.msc)
  2. Stop the "AccessData ElasticSearch" service
  3. Move the entire ElasticSearch "data" folder (default: "C:\Program Files\AccessData\ElasticSearch\data") to the desired location
  4. Open the "elasticsearch.yml" (default: "C:\Program Files\AccessData\ElasticSearch\config\elasticsearch.yml") in a text editor
  5. Find the below line:
     # /path/to/data
  6. Uncomment that line (remove the #) and change it to the new data folder path (using the syntax drive:/folder)
  7. Save the altered file
  8. Restart the "AccessData ElasticSearch" service
  9. Go to Manage > KFF in FTK and verify the KFF data is seen correctly



This in only for moving the ElasticSearch data to a different folder/drive on the same PC.

Was this article helpful?
1 out of 1 found this helpful
Have more questions? Submit a request


Powered by Zendesk