General information

Maltego Evidence creates backups of the entire database at regular intervals and backs them up locally on the user's computer. There are two types of backups in total:

How often and when are backups created?

By default, simple backups are created every 20 minutes. Advanced backups are not created automatically.

By default, the last 20 backups are kept. So, if a 21st backup is created, the first backup is deleted.

Also, a backup is automatically created before some updates, because in some cases the database structure is changed. To ensure security and consistency, a backup is created in advance.

Can I create a backup manually?

Yes, it is possible to create a backup via the support menu. To do this, click on the settings icon at the top right next to the minimize button. Then go to the "Support" item in the left menu.

There you will find the possibility to initiate a simple or an advanced backup in the category "Troubleshooting".

After you click on one of the buttons, a status indicator appears at the top, indicating that the backup creation is in progress. After the backup is completed, the indicator disappears.

Where can I find my backups?

You can find all your backups under the following folder in your Appdata directory:

%APPDATA%/Maltego Evidence/backups

Each backup is stored there as a separate .tgz file.

How do I restore an old backup?

Importing a backup should only be considered in an emergency, as incorrectly doing so could risk data loss. If you are unsure, please contact our support.

1. Make sure that Maltego Evidence has been completely terminated. If you are unsure, consider rebooting the system.
2. First, unzip the desired backup so that you obtain a normal folder with the following structure:

   We recommend a provider like 7zip for this.
   Should it be an advanced backup, you will also find a ".files" folder.

3. Now open Windows Explorer and navigate to the following folder:
   %APPDATA%/Maltego Evidence/
   There you should find the following folder structure:
   
4. Now replace the conf.yaml file with the conf.yaml file from the unpacked backup.
   (We recommend to backup the current conf.yaml file in advance as well, or just rename it to conf_old.yaml)
5. Now replace the datadir folder with the datadir folder from the unpacked backup
   (Again, we recommend either renaming the previous datadir folder to datadir_old, or manually backing up the folder to a different location temporarily)
6. If it is an advanced backup, please also replace the .files folder with the .files folder from the backup.
   (Again, please backup the existing .files folder first)
7. Restart Maltego Evidence.

Can I adjust the backup frequency and the number of backups kept?

Yes, you can adjust both parameters as you wish. To do this, please make sure that Maltego Evidence has been completely terminated.

Then open the following file in a text editor of your choice (please do not use Word).

%APPDATA%\Maltego Evidence\conf.yaml

Further down in the file you will find both parameters under the following paths:

environment -> backup_interval
environment -> max_number_of_backups

Both values have been initialized with a 20. For the backup interval, this is the number of minutes to wait before creating the next backup. The minimum value here is 1. Values less than 10 minutes are not recommended because creating backups reduces performance during the creation period.

Save your changes to the file and restart Maltego Evidence Desktop.