EnCase unable to process image
I am using EnCase 8.09 to try and process an image. Processor Manager reports that processing is complete, but if you look in the evidence view, the processing status still states "unprocessed." No errors appear.
I enabled logging, and the logs do present an error during processing. The error is "Failed to index (this IndexWriter is closed). It appears countless times in the log.
Does anyone have any thoughts on what may be causing this or how to resolve it?
What can you share about the image? How was it required, using what tool/process? Of what type of device was the image taken?
Thanks for your reply.
The image is publicly available and used for educational training purposes
Image name terry-2009-12-11-002.E01
On rare occasion, the image actually does process successfully. I have not been able to determine why this behavior occurs.
I do not know precisely what drive they used to acquire their images or the tool used.
Does the forensic image contain an encrypted partition perhaps?
Apologies if you have already done so, but open the image using FTK Imager and browse all of the partitions.
If the largest partition says "unrecognizable format" then it is encrypted.
Also, I recommend using multiple tools on the same evidence and comparing results. Try Autopsy on the image and compare results.
Thank you for your reply.
Everything views fine in FTK.
I have also used Autopsy, and have not experienced any issues. It seems to be an EnCase issue.