Problem

In Forensic Tools 7.6.0.618, Disk Preview fails with either "Could not get device list", or appears to work but discovers 0 items, when collecting against Windows Agent versions before 7.6.0.239.


Note

This solution only works for Agents deployed from Forensic Tools 7.5.1 and newer (Agent 7.6.0.24 and newer).

 

Resolution

On all machines running Forensic Tools 7.6.0.618 

  1. Download an updated diskpreview.pkg from https://ad-misc.s3.amazonaws.com/FCR-10447/diskpreview.pkg
  2. Copy the new diskpreview.pkg into the Windows modules folder (typically "[drive]:\Program Files\AccessData\Forensic Tools\7.6\bin\Agent\modules\Windows\x64"), overwriting the existing diskpreview.pkg.
  3. Open Enterprise and log in.
  4. Create a new case or open an existing one.
  5. Go to Tools > Configure Agent Push.
  6. Make sure the Path to trusted modules certificate is correct (typically "[drive]:\Program Files\AccessData\Forensic Tools\7.6\bin\Agent\modules\adata.p7b").
  7. Make sure the Path to agent modules is correct (typically "[drive]:\Program Files\AccessData\Forensic Tools\7.6\bin\Agent\modules").
  8. Click OK.

When performing a Disk Preview, in the Add Remote Data dialog, make sure to check Install or Update Agent Modules and Modules only so the new disk preview modules is pushed to the selected Agent(s).


On all machines running Site Server 7.6.0.216 

  1. Download an updated diskpreview.pkg from https://ad-misc.s3.amazonaws.com/FCR-10447/diskpreview.pkg
  2. Copy the new diskpreview.pkg into the Windows modules folder (typically "[drive]:\Program Files\AccessData\SiteServer\Agent\Modules\Windows\x64"), overwriting the existing diskpreview.pkg.
  3. Delete the existing Site Server Results folder.
  4. Open Site Server Configuration.
  5. Change the Site Server Results folder path, by either appending or removing a trailing slash.
  6. Click Apply and allow it to rebuild the Results folder and restart the service.
  7. Click Close.