◦ At high data rates the capture file can roll over multiple times every second. For higher data rates, the File Size should be increased. This will decrease how often the capture file has to be rolled over, and indirectly increase the performance.

◦ Forensic Searches use the same partition as the capture files, so leave some disk space available for the Forensic Search. Typically, 10-20 GB is sufficient, but the right setting will depend on the size of the forensic searches, and how many there are.

◦ Packet File Indexing is used to potentially increase Forensic Search performance when relevant filters are used. However, packet file indexing also decreases capture performance and can take a considerable amount of disk space.

◦ The file size and file indexes are related in that the smaller the file size the more packet indexes there will be. When there are more addresses, this can lead to large index files. A larger file size will generate fewer indexes.