Symptom: When trying to add evidence or start additional analysis processing does not get past preprocessing or queued.

Resolution:

  1. Cancel any current jobs.
  2. Close FTK
  3. Open Task Manager
  4. Under the Processes Tab verify ADLoader, ADprocessor, or ADIndexer are no longer open.  If they are, wait for them to close.
  5. Find processinghost.exe and end the process.
  6. Open the following path "C:\ProgramData\AccessData\PM" and delete the contents.
  7. Open FTK and sign in.
  8. Create a new case and add evidence to verify processing does start.
  9. If processing has started properly, then, you can either cancel the job for the new case and rerun the earlier job that caused the issue, or let this new job run to completion.

Cause:

An instance of processinghost.exe is still running from a previous action that did not close out properly.