EnCase not loading ...
 
Notifications
Clear all

EnCase not loading Case File  

twjolson
(@twjolson)
Active Member

Hello,

I am opening a case file in Encase that I hadn't touched in a while. When I try to open it, EnCase gives the white screen of wait. It's been going for a few hours now, and still nothing. No errors, not indication of any progress (Task Manager shows no CPU usage for the Encase process). I can open up other case files no problem, but not this one.

Has anyone seen this before? Is there a way I can determine what is wrong with it (for instance, corruption)?

Terry

Quote
Topic starter Posted : 02/07/2014 9:21 pm
PaulSanderson
(@paulsanderson)
Senior Member

Try verifying the files individually.

ReplyQuote
Posted : 02/07/2014 9:41 pm
athulin
(@athulin)
Community Legend

I am opening a case file in Encase that I hadn't touched in a while. When I try to open it, EnCase gives the white screen of wait. It's been going for a few hours now, and still nothing. No errors, not indication of any progress (Task Manager shows no CPU usage for the Encase process). I can open up other case files no problem, but not this one.

What version EnCase is involved here? What version created the case, what version is used for opening it?

I seem to remember that prior to some 6.x version, cases with certain types of Internet searches had problems reopening cases. Not sure if there was a walkaround or not. I was never hit by this, so it hasn't stuck in my mind.

Not creating logical evidence files from archive files, and adding them in that form (i.e. processed), but instead mounting them recursively directly in the case was another problem, as they have to be remounted on opening. This I've seen myself, but not sure if it was to the same extent you mention – I added it to my SOP, and it never was a problem again

If the process is not consuming CPU, what *is* it doing? Page thrashing, basic IO, memory allocation and deallocation, or what? If it is page thrashing, check if you can add more memory, or kill any useless processes. Also check if the page file needs to be defragmented …

You are probably better off asking Guidance, or searching their support database.

ReplyQuote
Posted : 03/07/2014 2:31 am
twjolson
(@twjolson)
Active Member

Thank you kindly for the replies.

So, shortly after posting, the case loaded after loading for just under two hours or so. It gave a "Invalid Hex Character" error.

EnCase version is 6.19. No internet searches were conducted (I had that problem before).

I did create a LEF from a zip file, however, I don't think that is the issue. I've done that many times before.

I posted to the IACIS listserv, and someone had encountered this before. They mentioned imaging with Paladin gave the same error message as I got. This seems the likely culprite, as this is one of the only cases in which I have used Paladin to image a Mac.

Terry

ReplyQuote
Topic starter Posted : 03/07/2014 4:48 am
Chris_Ed
(@chris_ed)
Active Member

EnCase v6 regularly complains about an "Invlaid Hex Character" if you use other products to image your media. As long as it re-verifies OK I wouldn't be overly concerned about it.

ReplyQuote
Posted : 03/07/2014 12:47 pm
mansiu
(@mansiu)
Member

I would recommend you to contact guidance's technical support rather than raising it here.

ReplyQuote
Posted : 03/07/2014 7:40 pm
Share: