|Applies To||RSA Product Set: RSA NetWitness Platform|
RSA Product/Service Type: NetWitness Investigator Thick Client
RSA Version/Condition: 10.x, 11.x
|Issue||In any version of Investigator thick client, the default collection/cache path for local collections can be changed from the UI as instructed below.|
Note: If you want to set the location for a specific collection, select the 'Override Default Location' option and add the new path while creating the collection.
- Open Investigator Thick Client.
- Browse to Edit > Options > Default Collection Path and change from C:\Users\USERNAME\Documents\NetWitness\Investigations\Local to a new path.
However, this change does not apply to remote collections.
|Tasks||Change the cache path for remote collections.|
|Resolution||Follow the steps below to change the default collection/cache path for remote collection.|
- Close the Investigator program.
- Copy or move the current remote collection folder, C:\Users\USERNAME\Documents\NetWitness\Investigations\Remote\Cx, to a new path.
- Open C:\Users\USERNAME\AppData\Roaming\NetWitness\NwInvestigator9.settings in a text editor.
- Locate the line that starts with "<Collections" and modify the path for the remote collection from the current path to the new path.
- Save the change.
- Start the Investigator, connect to the remote collection, open a few sessions and confirm that the cached files are saved to the new path.