Configuration

IPED’s behavior is controlled through a comprehensive configuration system that allows fine-tuned control over processing, analysis, and export options.

Configuration Overview

IPED uses a hierarchical configuration system with multiple configuration files:

IPEDConfig.txt

Main configuration file controlling enabled features and processing options

LocalConfig.txt

Local system settings like CPU threads, memory, and temporary folders

Module Configs

Individual configuration files for specific processing modules

Profiles

Pre-configured sets of options for different investigation types

Configuration Locations

IPED looks for configuration files in this order:

Profile directory (if specified)

iped-app/resources/config/profiles/<profile_name>/

Default configuration directory

iped-app/resources/config/

Case directory (for existing cases)

/cases/case001/iped/config/

Profile settings override default settings. Case settings are stored but don’t override new processing.

Main Configuration (IPEDConfig.txt)

The primary configuration file controls which processing features are enabled.

File Location

iped-app/resources/config/IPEDConfig.txt

Or within a profile:

iped-app/resources/config/profiles/<profile>/IPEDConfig.txt

Configuration Format

Configuration files use a simple key-value format:

IPEDConfig.txt

# Comments start with #
enableSomeFeature = true
disableSomeFeature = false
numericOption = 100
stringOption = value

Core Processing Options

enableHash

boolean

default:"true"

Compute file hashes (MD5, SHA-1, SHA-256, SHA-512, edonkey)

enablePhotoDNA

boolean

default:"false"

Enable PhotoDNA hashing (law enforcement only)

enableHashDBLookup

boolean

default:"true"

Lookup hashes in configured databases (NSRL, CAID, ProjectVIC, etc.)

enablePhotoDNALookup

boolean

default:"false"

Lookup PhotoDNA hashes in configured databases

processFileSignatures

boolean

default:"true"

Verify file types using signature analysis (magic bytes)

enableFileParsing

boolean

default:"true"

Parse files to extract metadata and embedded content

expandContainers

boolean

default:"true"

Recursively expand archives, compressed files, and containers

processEmbeddedDisks

boolean

default:"true"

Process embedded disk images (E01, VMDK, VHD, etc. found within evidence)

Search and Indexing

indexFileContents

boolean

default:"true"

Index file contents for full-text search

enableRegexSearch

boolean

default:"true"

Search for patterns: credit cards, emails, URLs, phone numbers, etc.

enableLanguageDetect

boolean

default:"true"

Detect document languages (70+ languages supported)

enableNamedEntityRecogniton

boolean

default:"false"

Detect named entities (people, organizations, locations) - requires Stanford CoreNLP models

Image and Video Analysis

enableImageThumbs

boolean

default:"true"

Generate thumbnails for images (hundreds of formats)

Generate thumbnails for video files

enableDocThumbs

boolean

default:"true"

Generate thumbnails for documents (PDF, Office, etc.)

enableImageSimilarity

boolean

default:"true"

Enable similar image search functionality

enableFaceRecognition

boolean

default:"false"

Detect and recognize faces in images (CPU-optimized)

enableAgeEstimation

boolean

default:"false"

Estimate ages of individuals in images

enableYahooNSFWDetection

boolean

default:"false"

Use Yahoo open-nsfw deep learning model for nudity detection (requires Keras and TensorFlow)

Data Recovery

enableCarving

boolean

default:"true"

Carve deleted files from unallocated space (40+ file formats)

enableLedCarving

boolean

default:"false"

Enhanced carving for known exploitative content (CSAM investigations)

enableKnownMetCarving

boolean

default:"false"

Carve files matching known metadata signatures

Advanced Features

enableQRCode

boolean

default:"true"

Scan for and decode QR codes in images

enableGraphGeneration

boolean

default:"true"

Generate communication graphs (calls, emails, messages)

enableAudioTranscription

boolean

default:"false"

Transcribe audio files (local or cloud services: Azure, Google Cloud)

entropyTest

boolean

default:"true"

Detect encrypted files using entropy analysis

enableSearchHardwareWallets

boolean

default:"true"

Search for cryptocurrency hardware wallet files

Export and Reporting

exportFileProps

boolean

default:"true"

Export file properties to reports

enableAutomaticExportFiles

boolean

default:"false"

Automatically export files matching configured criteria

enableHTMLReport

boolean

default:"true"

Generate HTML reports of case data

ignoreDuplicates

boolean

default:"true"

Skip processing of duplicate files (based on hash)

Example Configuration

IPEDConfig.txt

########################################################################
# IPED Processing Configuration
########################################################################

# Hashing
enableHash = true
enablePhotoDNA = false
enableHashDBLookup = true

# File Processing
processFileSignatures = true
enableFileParsing = true
expandContainers = true
processEmbeddedDisks = true

# Indexing and Search
indexFileContents = true
enableRegexSearch = true
enableLanguageDetect = true
enableNamedEntityRecogniton = false

# Image/Video Analysis
enableImageThumbs = true
enableVideoThumbs = true
enableImageSimilarity = true
enableFaceRecognition = false

# Data Recovery
enableCarving = true
enableLedCarving = false

# Advanced
enableQRCode = true
enableGraphGeneration = true
entropyTest = true

# Export
exportFileProps = true
enableHTMLReport = true
ignoreDuplicates = true

Local Configuration (LocalConfig.txt)

Controls system-specific settings and resource allocation.

File Location

iped-app/resources/config/LocalConfig.txt

Performance Settings

numThreads

integer

default:"auto"

Number of processing threads. Set to number of CPU cores or leave blank for auto-detection.

indexerThreads

integer

default:"1"

Number of threads for text indexing. Usually 1 is optimal.

queueSize

integer

default:"10000"

Size of processing queue. Increase for systems with more RAM.

Storage Settings

indexTemp

path

Temporary folder for index creation. Use fast SSD storage.

outputOnSSD

boolean

default:"true"

Optimize for SSD output storage

embutidos

path

Temporary folder for extracted embedded files

Example Configuration

LocalConfig.txt

########################################################################
# Local System Configuration
########################################################################

# Processing threads (leave empty for auto-detection)
numThreads = 16
indexerThreads = 1

# Queue size (higher = more RAM usage)
queueSize = 10000

# Temporary folders (use fast storage)
indexTemp = /tmp/iped-index
embutidos = /tmp/iped-extracted

# Storage optimization
outputOnSSD = true

Module Configuration

Individual modules have dedicated configuration files in the conf/ subdirectory.

Common Module Configs

Controls text indexing and search behavior.

conf/IndexTaskConfig.txt

# Index configuration
convertCharsToLowerCase = true
convertCharsToAscii = false
filterNonLatinChars = false

# Minimum index fragment size
minWordSize = 3

# Store term vectors for highlighting
storeTermVectors = true

# Content types to skip
skipKnownFiles = true

Configure hash computation algorithms.

conf/HashTaskConfig.txt

# Hash algorithms to compute
enableMD5 = true
enableSHA1 = true
enableSHA256 = true
enableSHA512 = false
enableEdonkey = true

Configure hash database lookups.

conf/HashDBLookupConfig.txt

# Hash databases to use
enableNSRL = true
enableCAID = true
enableProjectVIC = false

# Database paths
nsrlPath = /hashsets/NSRL/
caidPath = /hashsets/CAID/

Configure data carving options.

conf/CarvedTaskConfig.txt

# Enable carving by category
carveImages = true
carveVideos = true
carveDocuments = true
carveArchives = false

# Minimum file size to carve (bytes)
minFileSize = 1024

# Carving sensitivity
maxFragmentation = 3

Configure video thumbnail generation.

conf/VideoThumbsConfig.txt

# Number of frames to extract per video
numFrames = 10

# Thumbnail dimensions
thumbWidth = 200
thumbHeight = 200

# Gallery layout
galleryColumns = 5

# Skip known videos
skipKnownVideos = true

Configure file parsing options.

conf/ParsingTaskConfig.txt

# Parse embedded metadata
parseMetadata = true

# Extract embedded files
extractEmbedded = true

# OCR images in PDFs
pdfOCR = false

# Parse corrupted files
parseCorrupted = true

# Timeout per file (seconds)
parsingTimeout = 60

Category Configuration

Configure which file categories to process, expand, or export.

CategoriesToExpand.txt

Specify which container types to automatically expand:

conf/CategoriesToExpand.txt

# Expand these categories
Archives
Compressed
Email
Instant Messengers
Databases

CategoriesToExport.txt

Define which categories to automatically export (blind profile):

conf/CategoriesToExport.txt

# Automatically export these categories
Documents
Spreadsheets
Presentations
Images

FileSystemConfig.txt

Configure file system processing options:

conf/FileSystemConfig.txt

# Process deleted files
processDeleted = true

# Process unallocated space
processUnallocated = true

# Process file slack
processSlack = false

# Minimum file size to process
minFileSize = 0

Advanced Configuration

Regular Expression Searches

Configure pattern searches in conf/RegexConfig.txt:

conf/RegexConfig.txt

# Built-in patterns (enabled by default)
enableCreditCards = true
enableEmails = true
enableURLs = true
enablePhoneNumbers = true
enableIPAddresses = true
enableBitcoinWallets = true
enableEthereumWallets = true

# Validation scripts
validateCards = true
validateIBANs = true

# Custom patterns
customPattern1 = CASE-\d{4}-\d{6}
customPattern2 = EVIDENCE-[A-Z]{3}-\d{8}

Named Entity Recognition

Configure NER in conf/NERConfig.txt:

conf/NERConfig.txt

# Requires Stanford CoreNLP models
enablePersonNames = true
enableOrganizations = true
enableLocations = true
enableDates = true

# Model path
modelPath = /models/stanford-corenlp/

# Languages
languages = en,es,fr,de

Audio Transcription

Configure transcription in conf/AudioTranscriptionConfig.txt:

conf/AudioTranscriptionConfig.txt

# Service provider
provider = azure  # Options: azure, google, local

# Azure settings
azureKey = YOUR_API_KEY
azureRegion = eastus

# Languages to detect
languages = en-US,es-ES,pt-BR

# Skip known audio
skipKnownAudio = true

Configuration Best Practices

Start with a profile

Don’t configure from scratch. Start with the profile closest to your needs and modify it:

Terminal

cd iped-app/resources/config/profiles
cp -r forensic my_custom_profile
# Edit my_custom_profile/IPEDConfig.txt

Test configuration changes

Test configuration changes on sample data before processing critical evidence:

Terminal

java -jar iped.jar -d /test/sample.E01 -profile my_custom_profile -o /test/output

Document custom configurations

Keep notes on why specific options were enabled/disabled for court testimony and peer review.

Use version control

Store custom profiles in version control (git) to track changes over time:

Terminal

cd iped-app/resources/config/profiles
git init
git add my_custom_profile/
git commit -m "Custom profile for corporate investigations"

Balance features and performance

More features = slower processing. Enable only what you need for each investigation.

Configuration Troubleshooting

Check configuration syntax

Ensure proper format: key = value with no extra spaces:

enableHash = true  # Correct
enableHash=true    # Also correct
enableHash = true; # WRONG - no semicolons

Verify file locations

IPED must be able to find configuration files. Check the log for:

Loading configuration from: /path/to/config

Check profile override

Profile settings override defaults. If changes aren’t applied, check if you’re using a profile:

Terminal

# This uses forensic profile settings, NOT default config
java -jar iped.jar -profile forensic -d /evidence/disk.E01 -o /cases/case001

Review log file

Check the log for configuration errors:

Terminal

tail -f /cases/case001/iped/log/IPED_YYYYMMDD.log

Environment Variables

Some settings can be controlled via environment variables:

export IPED_TEMP=/fast/ssd/temp
export JAVA_TOOL_OPTIONS="-Xmx32G"
java -jar iped.jar -d /evidence/disk.E01 -o /cases/case001

Configuration Examples

Fast Corporate Investigation

custom_corporate/IPEDConfig.txt

# Fast processing for corporate investigations
enableHash = true
enableHashDBLookup = true
processFileSignatures = true
enableFileParsing = true
expandContainers = true
indexFileContents = true
enableRegexSearch = true

# Skip time-consuming features
enableCarving = false
enableImageSimilarity = false
enableFaceRecognition = false
enableVideoThumbs = false

# Email and communication focus
enableGraphGeneration = true

Comprehensive Malware Analysis

custom_malware/IPEDConfig.txt

# Detailed analysis for malware investigations
enableHash = true
processFileSignatures = true
enableFileParsing = true
expandContainers = true
entropyTest = true

# Don't skip potential malware
ignoreDuplicates = false
skipKnownFiles = false

# Minimal image/video processing
enableImageThumbs = false
enableVideoThumbs = false
enableCarving = false

Next Steps

Command-Line Options

Learn command-line parameters that work with configuration

Processing Profiles

Explore pre-configured profiles for different scenarios

Data Sources

Understand supported evidence formats and sources

Troubleshooting

Solve common configuration issues

Getting Started

Processing Evidence

Analysis Interface

Core Features

Parsers & Artifacts

Advanced Usage

Reference

Documentation Index

​Configuration Overview

IPEDConfig.txt

LocalConfig.txt

Module Configs

Profiles

​Configuration Locations

​Main Configuration (IPEDConfig.txt)

​File Location

​Configuration Format

​Core Processing Options

​Search and Indexing

​Image and Video Analysis

​Data Recovery

​Advanced Features

​Export and Reporting

​Example Configuration

​Local Configuration (LocalConfig.txt)

​File Location

​Performance Settings

​Storage Settings

​Example Configuration

​Module Configuration

​Common Module Configs

​Category Configuration

​CategoriesToExpand.txt

​CategoriesToExport.txt

​FileSystemConfig.txt

​Advanced Configuration

​Regular Expression Searches

​Named Entity Recognition

​Audio Transcription

​Configuration Best Practices

​Configuration Troubleshooting

​Environment Variables

​Configuration Examples

​Fast Corporate Investigation

​Comprehensive Malware Analysis

​Next Steps

Command-Line Options

Processing Profiles

Data Sources

Troubleshooting

Build docs developers (and LLMs) love

Configuration Overview

Configuration Locations

Main Configuration (IPEDConfig.txt)

File Location

Configuration Format

Core Processing Options

Search and Indexing

Image and Video Analysis

Data Recovery

Advanced Features

Export and Reporting

Example Configuration

Local Configuration (LocalConfig.txt)

File Location

Performance Settings

Storage Settings

Example Configuration

Module Configuration

Common Module Configs

Category Configuration

CategoriesToExpand.txt

CategoriesToExport.txt

FileSystemConfig.txt

Advanced Configuration

Regular Expression Searches

Named Entity Recognition

Audio Transcription

Configuration Best Practices

Configuration Troubleshooting

Environment Variables

Configuration Examples

Fast Corporate Investigation

Comprehensive Malware Analysis

Next Steps