000038508 - How to change the cache folder location in RSA NetWitness Investigator thick client

Document created by RSA Customer Support Employee on Mar 4, 2020
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000038508
Applies ToRSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: NetWitness Investigator Thick Client
RSA Version/Condition: 10.x, 11.x
Platform: Windows
IssueIn any version of Investigator thick client, the default collection/cache path for local collections can be changed from the UI as instructed below.
  1. Open Investigator Thick Client.
  2. Browse to Edit > Options > Default Collection Path and change from C:\Users\USERNAME\Documents\NetWitness\Investigations\Local to a new path.
Note: If you want to set the location for a specific collection, select the 'Override Default Location' option and add the new path while creating the collection.

However, this change does not apply to remote collections.

TasksChange the cache path for remote collections.
ResolutionFollow the steps below to change the default collection/cache path for remote collection.
  1. Close the Investigator program.
  2. Copy or move the current remote collection folder, C:\Users\USERNAME\Documents\NetWitness\Investigations\Remote\Cx, to a new path.
  3. Open C:\Users\USERNAME\AppData\Roaming\NetWitness\NwInvestigator9.settings in a text editor.
  4. Locate the line that starts with "<Collections" and modify the path for the remote collection from the current path to the new path.
  5. Save the change.
  6. Start the Investigator, connect to the remote collection, open a few sessions and confirm that the cached files are saved to the new path.