±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34287
New Yesterday: 0 Visitors: 230

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

IEF v6.16.1.11667 VICS export broken

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

IEF v6.16.1.11667 VICS export broken

Post Posted: Fri Aug 10, 2018 10:48 am

This problem with IEF has reared its ugly head every so often and now it looks like its back.

When exporting VIC1.3 data, it extracts a certain number of Carved Videos then crashes. It also only happens with large numbers of Carved Videos, in this situation 442, which in the scheme of things isn't that many.

But every time I have tried it, it starts exporting and then crashes.

This has happened on several machines, odd thing, it doesn't leave a crash log on the root of C but it has crashed with exceptions.

VIC1.2 doesn't work either.

I have tried rolling back too but found the same problem which wasn't a problem before!

Anyone else having the same issue or maybe found a workaround which doesn't involve buying Axiom!  

zhaan
Senior Member
 
 
  

Re: IEF v6.16.1.11667 VICS export broken

Post Posted: Fri Aug 10, 2018 12:42 pm

Is it Windows crashing IEF? Check your event logs. Usually if there's no IEF crash log at the root c:\, it means windows did the crash and IEF doesn't see it, you should be able to find an event log crash for IEF around the same time. IEF might still be the cause but that's why you're not seeing the standard crash log.

Send that to support, they'll need it.

For the VICS export, I just tried a pretty big one yesterday without a problem, if you do a smaller subset of your case or a different case does it also crash? Trying to figure out if there's a particular image or type of image/video that it's not liking.

You'll likely need to send the event log crash event into support to track it down.

Jamie  

mcman
Senior Member
 
 
  

Re: IEF v6.16.1.11667 VICS export broken

Post Posted: Fri Aug 10, 2018 5:06 pm

I dont think so, there wasn't a problem until we upgraded to 11667, since then several of us are having issues in cases where the Carved Video numbers are relatively high. Smaller cases where Carved Videos are in double figures, dont usually have a problem.

I will check the Event Viewer though.

I have sent the case info and log text files already but have yet to receive any support.

This isn't ideal and isn't the first time its happened so i am wondering why it does keep happening with something as important as Project VIC exports.

One of my cases crashed while extracting 15 out of 442 Carved Videos while a colleagues crashed 154 into 244 Carved Videos.

We know this because we check the Attachments folder which is generated by the Project VIC export.  

zhaan
Senior Member
 
 
  

Re: IEF v6.16.1.11667 VICS export broken

Post Posted: Sat Aug 11, 2018 3:35 am

I rolled back 2 versions before I was able to generate a crashlog. It appears the latest version has caused older versions, which used to work, to crash too on VICS1.3 export.

The crashlog describes a missing SQLITE reference.

I have forwarded the log to Magnet this morning.  

zhaan
Senior Member
 
 
  

Re: IEF v6.16.1.11667 VICS export broken

Post Posted: Sat Aug 11, 2018 5:05 am

- mcman
Is it Windows crashing IEF? Check your event logs. Usually if there's no IEF crash log at the root c:\, it means windows did the crash and IEF doesn't see it, you should be able to find an event log crash for IEF around the same time. IEF might still be the cause but that's why you're not seeing the standard crash log.

Send that to support, they'll need it.

For the VICS export, I just tried a pretty big one yesterday without a problem, if you do a smaller subset of your case or a different case does it also crash? Trying to figure out if there's a particular image or type of image/video that it's not liking.

You'll likely need to send the event log crash event into support to track it down.

Jamie


Thanks for your reply Jamie,

Were you using v6.16 (latest) when you did your VIC1.3 export and did you have more than 400 carved videos?  

zhaan
Senior Member
 
 
  

Re: IEF v6.16.1.11667 VICS export broken

Post Posted: Sat Aug 11, 2018 9:43 pm

It would appear its something to do with the way 6.16 processes/extracts the data from the source.

I cannot extract the VICS data from a 6.16 extraction with any old version of IEF.

But if I run 6.15 through exactly the same data it extracts and exports the VICS data with no problem.  

zhaan
Senior Member
 
 
  

Re: IEF v6.16.1.11667 VICS export broken

Post Posted: Mon Aug 13, 2018 8:26 am

- zhaan
It would appear its something to do with the way 6.16 processes/extracts the data from the source.

I cannot extract the VICS data from a 6.16 extraction with any old version of IEF.

But if I run 6.15 through exactly the same data it extracts and exports the VICS data with no problem.


Ok good to know, I'll check with the support guys to see what we might have changed 6.16. I don't believe there was anything specific to VICS but maybe something related to the video exports.

400 carved videos isn't a lot and I know we test on much larger numbers. It will take some time to copy them but shouldn't be crashing.

I'll check with support and see what they see in the logs.

Jamie  

mcman
Senior Member
 
 

Page 1 of 1