All "Add Remote Data" jobs fail because FTK is not pushing the necessary modules. This can be verified by the "C:\Program Files\AccessData\Agent\modules" folder being empty on the Agent target machine.
- Verify that the Examiner machine is able to communicate with the Agent target over port 3999
- Verify that SSL traffic is allowed over port 3999
- In FTK, go to Tools > Configure Agent Push
- Ensure the following paths are set correctly:
Path to UNC share: \\ADMIN$\temp
Local path to shared folder: %systemroot%\temp
Path to trusted modules certificate: [Forensic Tools Install Folder]\bin\Agent\modules\adata.p7b
Path to agent modules: [Forensic Tools Install Folder] \bin\Agent\modules
- Restart FTK
- Uninstall the Agent from the target machine
- Re-install the Agent to the target machine
For software or Agent versions prior to 6.0, this may also be caused by the old adata certificate expiring.
FTK may not be able to properly push or communicate with the modules because the paths in "Configure Agent Push" are incorrect, or the wrong module certificate is being used.