±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35989
New Yesterday: 2 Visitors: 99

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

EnCase unable to process image

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

JCForensics
Newbie
 

EnCase unable to process image

Post Posted: Jun 18, 19 16:21

I am using EnCase 8.09 to try and process an image. Processor Manager reports that processing is complete, but if you look in the evidence view, the processing status still states "unprocessed." No errors appear.

I enabled logging, and the logs do present an error during processing. The error is "Failed to index (this IndexWriter is closed). It appears countless times in the log.

Does anyone have any thoughts on what may be causing this or how to resolve it?

Thank you.  
 
  

keydet89
Senior Member
 

Re: EnCase unable to process image

Post Posted: Jun 18, 19 16:47

What can you share about the image? How was it required, using what tool/process? Of what type of device was the image taken?  
 
  

JCForensics
Newbie
 

Re: EnCase unable to process image

Post Posted: Jun 18, 19 20:45

Thanks for your reply.

The image is publicly available and used for educational training purposes

downloads.digitalcorpo...-redacted/

Image name: terry-2009-12-11-002.E01

On rare occasion, the image actually does process successfully. I have not been able to determine why this behavior occurs.

I do not know precisely what drive they used to acquire their images or the tool used.

Thanks.  
 
  

UnallocatedClusters
Senior Member
 

Re: EnCase unable to process image

Post Posted: Jun 19, 19 15:23

Does the forensic image contain an encrypted partition perhaps?

Apologies if you have already done so, but open the image using FTK Imager and browse all of the partitions.

If the largest partition says "unrecognizable format" then it is encrypted.

Also, I recommend using multiple tools on the same evidence and comparing results. Try Autopsy on the image and compare results.

www.sleuthkit.org/auto...wnload.php  
 
  

JCForensics
Newbie
 

Re: EnCase unable to process image

Post Posted: Jun 20, 19 21:45

Thank you for your reply.

Everything views fine in FTK.

I have also used Autopsy, and have not experienced any issues. It seems to be an EnCase issue.  
 

Page 1 of 1