Trouble Indexing

[David (PassMark)]

Horst,

Can you E-Mail us the entire log file(s). We'll keep them private. I think the more interesting bit of the log was before the snippet you posted.

If you had reached the file limit then there should have been a message in the log further up.

You can select the access mode in the "Select device to add" window. See below.



The items circled in blue result in direct access mode being used (by passing the file system). In this case the sectors on the disk (or disk image) are read and the NTFS structures are directly parsed by OSF. Hidden files can be seen and file permissions are ignored.

The red items result in the file system being used. In this case the disk is accessed via the standard operating system API calls, like ReadFile(), and NTFS permissions are enforced by the operating system.

[Forensik]

Hi David

Thank you for answering so fast.

The PST-Files were about 345 MB.

I restricted the indexing (EMails) to the folder containing the PST-Files.

Snippet of the indexing logfile----

03|07/26/12 18:32:49|Writing index data for CGI/Win32 search... (Please wait)
03|07/26/12 18:32:49|Created pagedata data file (zoom_pagedata.zdat)
03|07/26/12 18:32:49|Created pagetext data file (zoom_pagetext.zdat)
03|07/26/12 18:32:49|Created pageinfo data file (zoom_pageinfo.zdat)
03|07/26/12 18:32:49|Created dictionary data file (zoom_dictionary.zdat)
03|07/26/12 18:32:49|Created wordmap data file (zoom_wordmap.zdat)
03|07/26/12 18:32:49|Created script settings file (settings.zdat)
09|07/26/12 18:32:49|No files found to index in bm01-1:\Users\xxx\Outlook privat\Outlook
09|07/26/12 18:32:49|Check that the path exists and that files satisfies configuration settings
10|07/26/12 18:32:49|Indexing completed at Thu Jul 26 18:32:49 201212|07/26/12 18
---

the path exists. I can access it via the file system browser.

Don´t think i reached the 200000 limit.

best regards.
Horst

<Quote> Using the direct access method in OSF by passes all the NTFS permissions, so this is another solution. </Quote>

How can I directly access the EnCase Image Files a I am facing permission problems too and do not want for forensic reasons alter the permission rights.
thx Horst

[Forensik]

Hi David

Thank you for answering so fast.

The PST-Files were about 345 MB.

I restricted the indexing (EMails) to the folder containing the PST-Files.

Snippet of the indexing logfile----

03|07/26/12 18:32:49|Writing index data for CGI/Win32 search... (Please wait)
03|07/26/12 18:32:49|Created pagedata data file (zoom_pagedata.zdat)
03|07/26/12 18:32:49|Created pagetext data file (zoom_pagetext.zdat)
03|07/26/12 18:32:49|Created pageinfo data file (zoom_pageinfo.zdat)
03|07/26/12 18:32:49|Created dictionary data file (zoom_dictionary.zdat)
03|07/26/12 18:32:49|Created wordmap data file (zoom_wordmap.zdat)
03|07/26/12 18:32:49|Created script settings file (settings.zdat)
09|07/26/12 18:32:49|No files found to index in bm01-1:\Users\xxx\Outlook privat\Outlook
09|07/26/12 18:32:49|Check that the path exists and that files satisfies configuration settings
10|07/26/12 18:32:49|Indexing completed at Thu Jul 26 18:32:49 201212|07/26/12 18
---

the path exists. I can access it via the file system browser.

Don´t think i reached the 200000 limit.

best regards.
Horst

[David (PassMark)]

In the indexing options did you turn on the indexing of E-mails (there is a check box).

How large were the PST files?

Can you send us the log from the indexing session? See the post above for where the logs can be found.

Can you restrict the indexing to just the folder where the PST files are and only index EMails. Then see what happens.

The free version of OSF is limited to indexing 200,000 files or EMails. So maybe you hit this limit before the PST files were encountered on the hard drive if you were indexing a full hard drive?

[Forensik]

Hi there,

I am using OSF 1.1.1002 and it seems I am facing indexing problems too. What I did. I treid to index E-Mails. I mounted an Encas-Image Partition under I:\ and started indexing. The indexer did not find the PST-files on the partition and therefore did not index any e-Mails.

Searching for PST-files in the file browser allocates 2 PST-fikes, named output and archive.

Any ideas how I can fix this problem.

best regards from Austria
Horst

[David (PassMark)]

I get permission errors when accessing the primary user account folders on the boot partition.

This is normal when a drive from another machine is added via the mounting method, or by directly connecting a foreign physical drive. It is trivial (via right click on folder) to change the folder permissions if you have write access to the drive. Using the direct access method in OSF by passes all the NTFS permissions, so this is another solution.

The logs should hopefully shed some light on the other issue.

[d8a4n6]

I have 1.1.1001 installed.

I'll download 1.1.1002 an install that.

[d8a4n6]

The case is back at the office. I'll answer what I can now and more tomorrow:

If you use the File System Browser in OSF can you browse the folders on the drive (both when accessed via a drive letter and when doing direct access)?

When using the File System Browser I can navigate through both partitions and all the folders on the image of the drive.

When mounting the image using Mount Drive Image and getting a drive letter assignment I can navigate through most of the folders. I get permission errors when accessing the primary user account folders on the boot partition.

[quote]Was this a single partition NTFS drive? Was the image of a full disk or just a partition?/[quote]

It's a full disk .dd image with two partitions. The recovery partition might be FAT. The boot partition is NTFS / Win7 Home Premium.

At what step did it freeze up? Did you leave it for a couple of minutes to see if anything happened? Maybe it was just indexing a large file, or opening a large Zip file, etc..

[quote]Are you using V1.1.1002 of OSF ?/[quote]

Don't know for sure .. I'll check in the AM. Probably as I just installed it a few days ago. If not 1.1.1002 then 1.1.

Win7PRO X64

What indexing options did you select? Maybe 57 is correct if for example example there are only 57 Office documents on the disk and you only selected office documents to be indexed.

I checked all the options except unallocated and I would like to manually ..... I didn't tinker with the advanced options.

You should have a look at the log.

You can find logs of the indexing process here for failed sessions,
C:\Users\David\Documents\PassMark\OSForensics\last failedindexlog.txt

Or here for index sessions that ended normally.
"C:\Users\<User name>\Documents\PassMark\OSForensics\Cases\<Case name>\Index\<Index Name>\indexlog.txt"

Ok, I'll look in the AM.

When I pointed the file indexer to the mounted partition (the drive letter) it cooked right along. I'd say I was there for about an hour before I left and the indexer indicated it was about 1/4 of the way through. When I went to check today, it was stuck and "Not Responding". It appeard to have finished the index, but no index appears in the case manager.

[David (PassMark)]

If you use the File System Browser in OSF can you browse the folders on the drive (both when accessed via a drive letter and when doing direct access)?

Was this a single partition NTFS drive? Was the image of a full disk or just a partition?

At what step did it freeze up? Did you leave it for a couple of minutes to see if anything happened? Maybe it was just indexing a large file, or opening a large Zip file, etc..

Are you using V1.1.1002 of OSF ?

What indexing options did you select? Maybe 57 is correct if for example example there are only 57 Office documents on the disk and you only selected office documents to be indexed.

You should have a look at the log.

You can find logs of the indexing process here for failed sessions,
C:\Users\David\Documents\PassMark\OSForensics\last failedindexlog.txt

Or here for index sessions that ended normally.
"C:\Users\<User name>\Documents\PassMark\OSForensics\Cases\<Case name>\Index\<Index Name>\indexlog.txt"

[d8a4n6]

I have created a case and added a 1TB .dd image to the case as a device. The "Create Index" function provides me the opportunity to index the image. However, when doing so only 57 files were indexed.

If I mount the drive and index the drive letter it seems to run properly; although my first attempt caused OSF to freeze up (I'm trying again).