Problem

During evidence ingestion or "Add Evidence", processing of a certain PST or NSF file consistently fails while other evidence processes without error.

 

Resolution

If the AccessData application is unable to expand a PST/NSF, the structure of the PST/NSF may have issues that cause problems for the evidence processing engine (EP). The following are procedures to attempt to remedy this:

PST

Must have a version of Outlook installed for this to work.
Run Scan PST (scanPST.exe)
 
Refer to these articles for more detail about running Scanpst.
 
 

NSF

Must have a version of Lotus Notes installed for this to work
Place nsf into C:\Program Files\lotus\notes\data\Fixed\ then do the following
 
Start Menu
RUN
cmd
cd C:\Program Files\lotus\notes
nfixup Fixed\TEST.nsf -F
 
Performing consistency check on log.nsf...
Completed consistency check on log.nsf
 
07/13/2009 11:47:01 AM  Database Fixup: Started
07/13/2009 11:47:02 AM  Performing consistency check on TEST.nsf...
07/13/2009 11:47:27 AM  Completed consistency check on TEST.nsf
07/13/2009 11:47:36 AM  Database Fixup: Shutdown
 
 
ncompact Fixed\TEST.nsf -c -D -i
 
07/13/2009 11:48:36 AM  Compacting TEST.nsf (TEST)
07/13/2009 11:49:43 AM  Compacted  TEST.nsf, 116224K bytes recovered(16%)
07/13/2009 11:49:43 AM  Database compactor process shutdown
 
 
nupdall Fixed\TEST.nsf -R -X
 
07/13/2009 11:50:05 AM  Index update process started
07/13/2009 11:50:06 AM  Updating views in C:\Program Files\lotus\notes\data\Fixed\TEST.nsf
07/13/2009 11:50:06 AM  Index update process shutdown
 

 

Cause

Corruption in email data records within the storage archive requires repair in order to process the archive properly.