Encase 6.19.7 - Rev...
 
Notifications
Clear all

Encase 6.19.7 - Reviewing Search Hits Crash

5 Posts
3 Users
0 Reactions
1,011 Views
(@username)
Active Member
Joined: 13 years ago
Posts: 6
Topic starter  

Hi,

I have a Forensic machine which is running Encase 6.19.7, now and then I use the software to run my Greps and then review the Grep results in the 'Search Hits' window.

Some hits whether there's 1 Hit or 1000 Hits seem to have an issue loading, which causes encase to crash.

Encase keeps jumping in and out of crashing, so sometimes may take me 15-20 minutes to find a window of opportunity to change my view in order for encase to stop crashing.

If i was to review my hits and scroll right so the columns 'name' and 'preview' are out of view then Encase will work normally and load all the hits, however if i scroll back to show 'name' and 'preview' encase will crash again.

Hiding 'name' and 'preview' is a OK solution when the hits are minimal and i can afford to look in each file individually. However its there are many results I need to see the 'Name' and 'preview' columns so i can quickly analyse the results and context.

anyone come across this before and have a solution?


   
Quote
minime2k9
(@minime2k9)
Honorable Member
Joined: 14 years ago
Posts: 481
 

Yeah seen that bug many many times, unfortunately have no solution for you.
Guidance know about it but use the line "This is fixed in Encase 7".
Hopefully someone else may have a workaround for you but to the best of my knowledge, I;ve never found anyone who had.


   
ReplyQuote
(@username)
Active Member
Joined: 13 years ago
Posts: 6
Topic starter  

Well I'm glad I'm not the only one, shame there is no solution. frustrating thing is it inst fixed in EnCase 7 as the feature is not there, to view all hits the same as you can in EnCase 6 is removed completely, I would have to look in each individual file which is time consuming where there 100+ files.

I know there an enscript for 7 which will parse out all searches into a Bookmark which replicates the feature in 6, however this is very slow from experience and not practical.

(


   
ReplyQuote
(@mrmoo28)
Active Member
Joined: 11 years ago
Posts: 16
 

I've had this sort of thing happen to me several times when you've mounted files, e.g. RARs and Zips, EnCase really seems to struggle with keyword hits for mounted files. My workaround has been to create an L01 of the mounted files and run the keywords over this instead


   
ReplyQuote
(@username)
Active Member
Joined: 13 years ago
Posts: 6
Topic starter  

Hi Mr Moo28,

That makes a lot of sense, I'll give it ago and we see what happens… fingers crossed!

Regards

Username


   
ReplyQuote
Share: