Symptom: When copying a case into FTK 3.1 it fails with a "Failed to copy" or  "Could not validate" error.

 

Cause:

  1. The identity of the Oracle database service does not have permission to read from the source case folder and/or write to the new case folder.

  2. FTK 3.1.0 has an issue copying cases if the case path is formatted as a UNC path.  Please install FTK 3.1.1.

  3. This also happens when the case has been archive and detached, then reattached in FTK 3.0.4 and then when trying to copy the case to FTK 3.1.0 it fails due to and issue with the DBControlLib.dll.

 

Resolution:


One or more of the following may help in resolving this issue:

  1. Permissions to Case Folder

    If the Oracle database is installed on a separate system from FTK, please ensure that you have configured your system for Two-Box backups (CLICK HERE for a copy of the guide).  Please note, if FTK does not show the path to the source case folder formatted as a UNC path (\\servername\sharename\[CaseFolder]), you will need to edit that path appropriately.

  2. FTK 3.1.0 UNC Path Issue

    FTK 3.1.0 has an issue copying cases if the case path is formatted as a UNC path.  Please install FTK 3.1.1.

  3. FTK 3.1.0 DBControlLib.dll Issue
    1. Install FTK 3.1.1.  This should fix the issue.
    2. If for some reason you cannot upgrade to FTK 3.1.1, download the patch file from http://support.accessdata.com/downloads/FTK3.1-BackupPatch.zip You will need to copy the DBControlLib.dll, into the FTK bin folder and replace the file currently in the folder.  These patch files only apply to FTK 3.1.0.  FTK 3.1.1 does not need this patch.
    3. Extract the contents of the ZIP archive to the folder of your choice.  Depending on whether your system is running 32 bit or 64 bit, copy the appropriate version of the DLL to C:\Program Files\AccessData\Forensic Toolkit\3.1\bin