During evidence ingestion or "Add Evidence", processing of a certain PST or NSF file consistently fails while other evidence processes without error.
If the AccessData application is unable to expand a PST/NSF, the structure of the PST/NSF may have issues that cause problems for the evidence processing engine (EP). The following are procedures to attempt to remedy this:
Must have a version of Outlook installed for this to work.
Run Scan PST (scanPST.exe)
Refer to these articles for more detail about running Scanpst.
Supported for Outlook for Microsoft 365 Outlook 2021 Outlook 2019 Outlook 2016 Outlook 2013 Outlook 2010 Outlook 2007
Must have a version of Lotus Notes installed for this to work
Place nsf into C:\Program Files\lotus\notes\data\Fixed\ then do the following
cd C:\Program Files\lotus\notes
nfixup Fixed\TEST.nsf -F
Performing consistency check on log.nsf...
Completed consistency check on log.nsf
07/13/2009 11:47:01 AM Database Fixup: Started
07/13/2009 11:47:02 AM Performing consistency check on TEST.nsf...
07/13/2009 11:47:27 AM Completed consistency check on TEST.nsf
07/13/2009 11:47:36 AM Database Fixup: Shutdown
ncompact Fixed\TEST.nsf -c -D -i
07/13/2009 11:48:36 AM Compacting TEST.nsf (TEST)
07/13/2009 11:49:43 AM Compacted TEST.nsf, 116224K bytes recovered(16%)
07/13/2009 11:49:43 AM Database compactor process shutdown
nupdall Fixed\TEST.nsf -R -X
07/13/2009 11:50:05 AM Index update process started
07/13/2009 11:50:06 AM Updating views in C:\Program Files\lotus\notes\data\Fixed\TEST.nsf
07/13/2009 11:50:06 AM Index update process shutdown
For more information on the NSF repair utility, see the following link:
Corruption in email data records within the storage archive requires repair in order to process the archive properly.