Problem
Clicking Evidence > Add Remote Data in Enterprise throws the error "An error occurred while retrieving Volatile Data" rather than showing the Add Remote Data dialog.
Resolution
- On the main Enterprise screen, go to Tools > Preferences.
- Delete the contents in the Private Key, Public Key, and Agent Port fields.
- Enter "3999" in the Agent Port field.
- Browse to your Private Key and Public Key.
- Click OK.
Cause
These settings are stored in the database as well as the local machine's registry (under "HKLM\SOFTWARE\WOW6432Node\AccessData\Enterprise\Agent"). If you connect Enterprise to an existing database, these settings may already be filled out, but they won't be added to the registry until you follow the steps above.
Also if you attempt to update the certificates you may end up with these errors in the FTK_log.txt file located at %PROGRAMDATA%\AccessData\Products\Forensic Toolkit\<version>. Solution is the same.
20220519T131331.588 E [AgentPush.cpp:458]: AgentPush::InstallAgent(): Caught "The system cannot find the file specified. ", rv=0 20220519T131331.588 E [AgentPush.cpp:214]: AgentPush::InstallEnterpriseAgent(): Call to InstallAgent() Failed, rebooted=0