Issue: Backup/archive using Oracle fails with error about "un-representable DateTime" (FTK 4.2.x+)

Symptom: When backing up or archiving cases from FTK 4.2.x or later using Oracle, the process fails with the error "Year, Month, and Day parameters describe an un-representable DateTime."  Ensure you've followed the steps here using DBControl to verify this is the error generated during the backup/archive process.  Also, verify in the backup/archive folder that the last table backed up was FILTERRECENTATTRS.

Cause: When you create a filter in FTK, a record of the most recently used attributes/criteria used is stored in the table FILTERRECENTATTRS.  However, sometime erroneous timestamps are recorded in this table, causing the backup/archive process to fail as it does not understand these timestamps.  Since the contents of this table don't have any forensic value, the contents can simply be deleted, allowing backup/archive to work again.

Solution:

  1. Determine the Case ID for the case you wish the manipulate
  2. Open the case you want to manipulate
  3. From the Tools menu, select Execute SQL...
  4. Enter the following commands:
    DELETE FROM [schema]_[caseid].FTK_FILTERRECENTATTRS;
    commit;
  5. Click Execute
  6. When the Status in the Execute SQL windows confirms it has completed (Status: OK), you can try backing up/archiving the case again

Notes:

Refer to this KB for a list of database SIDs and schema names.

The [caseid] in the command in step 5 must be a four digit number, padded with zeros.  For example, if the Case ID is 15 in 4.2.x, the [caseid] would be 0015, and the resulting command would be DELETE FROM ADG53_0015.FTK_FILTERRECENTATTRS;