Symptom
When attempting to create a new case in FTK/AD Lab/AD Enterprise, you receive the error "An error occurred while attempting to create the case".
Possible Causes
Below are common causes for the error. Please examine FTK_Log.txt found at this location, for error messages that may help pinpoint the exact cause of the problem:
"%ProgramData%\AccessData\Products\Forensic Toolkit\".
1) The correct version of the Evidence Processing Engine is not installed (check FTK and Processing Engine version numbers).
2) The account used to launch FTK/AD Lab/AD Enterprise does not have full permissions to the case directory.
3) The database and/or case directory disk has run out of space.
4) You have a 32-bit version of MS-SQL.
5) The PostgreSQL service has stopped.
6) You specified a network path for the Database Directory.
7) You have multiple versions of FTK installed, and processing in one didn't close down completely before opening the second version.
8) The computer name has changed.
Resolutions
1) Ensure the correct version of the Evidence Processing Engine is installed, and that it is not installed as a Distributed Engine on the FTK machine.
2) Ensure your Windows account has full permissions to the case directory.
3) Ensure you have sufficient free space for your database and case directory on your disk(s).
4) If you are using MS-SQL with FTK, make sure you have the 64-bit version installed. The query below should yield a result that says "64-bit".
SELECT SERVERPROPERTY('Edition')
5) If you are using PostgreSQL with FTK, make sure that the "Postgresql" service is started.
6) Leave "Database Directory" blank and "In the case folder" unchecked (see this article for more information).
7) Close out all versions of FTK. Open Task Manager and find "ProcessingHost.exe" and end the process. Then open the version of FTK you want to create the case in and try again.
8) Change the computer name back. If you are unable to do this, please contact AccessData technical support.
Applies to
FTK
AD Enterprise
AD Lab