While I was creating my first case with brand-new FTK 2.0, the program suddenly ceased to work. But much to my surprise not all of the previous effort was lost.
I couldn't await to create my first case after installation of FTK 2.0 finished. The case coinsisted of a few images of hard disks and USB thumb drives. There were roundabout 200 GB of data and 2.4 million file system objects. The object count was then increased significantly by carving deleted files and processing local mailboxes in PST format.
Eventually I noticed that the computer came to a standstill. The progress indicators were blinking as usual, but FTK's main window didn't react to any input. At that time virtual memory had grown to about 3 GiB, while the system was equipped with 2 GiB of physical memory only. Therefore I decided to kill the hanging application and to restart the computer.
Afterwards I restarted FTK. To my surprise the previous work was not lost in its entirety. FTK seemingly reverted to a previous checkpoint and eventually completed preprocessing of the case.
But what was the root cause? Most likely the system was overloaded. As I wrote earlier the computer barely satisfies the minimum hardware requirements. Apparently FTK was unable to access the dongle at some time and ceased to work.
But the good news is, that the new version - unlike its predecessor - can recover from a crash. You may still lose some minutes or hours of computing time, but not days!
