Problem
During evidence ingestion or "Add Evidence", processing of a certain PST or NSF file consistently fails while other evidence processes without error.
Resolution
If the AccessData application is unable to expand a PST/NSF, the structure of the PST/NSF may have issues that cause problems for the evidence processing engine (EP). The following are procedures to attempt to remedy this: PSTMust have a version of Outlook installed for this to work. Run Scan PST (scanPST.exe) Refer to these articles for more detail about running Scanpst. Supported for Outlook for Microsoft 365 Outlook 2021 Outlook 2019 Outlook 2016 Outlook 2013 Outlook 2010 Outlook 2007
NSFMust have a version of Lotus Notes installed for this to work Place nsf into C:\Program Files\lotus\notes\data\Fixed\ then do the following Start Menu RUN cmd cd C:\Program Files\lotus\notes nfixup Fixed\TEST.nsf -F Performing consistency check on log.nsf... Completed consistency check on log.nsf 07/13/2009 11:47:01 AM Database Fixup: Started 07/13/2009 11:47:02 AM Performing consistency check on TEST.nsf... 07/13/2009 11:47:27 AM Completed consistency check on TEST.nsf 07/13/2009 11:47:36 AM Database Fixup: Shutdown ncompact Fixed\TEST.nsf -c -D -i 07/13/2009 11:48:36 AM Compacting TEST.nsf (TEST) 07/13/2009 11:49:43 AM Compacted TEST.nsf, 116224K bytes recovered(16%) 07/13/2009 11:49:43 AM Database compactor process shutdown nupdall Fixed\TEST.nsf -R -X 07/13/2009 11:50:05 AM Index update process started 07/13/2009 11:50:06 AM Updating views in C:\Program Files\lotus\notes\data\Fixed\TEST.nsf 07/13/2009 11:50:06 AM Index update process shutdown For more information on the NSF repair utility, see the following link: http://www-12.lotus.com/ldd/doc/domino_notes/Rnext/help6_admin.nsf/f4b82fbb75e942a6852566ac0037f284/579be9269e2cb49585256c1d0039b81a?OpenDocument |
Cause
Corruption in email data records within the storage archive requires repair in order to process the archive properly.