Tweet
During the installation / upgrade of OSForensics over an existing instance of OSForensics it is possible to get the following error.
C:\Program Files\OSForensics\OSFMount64\x64\OSFMount.sys
An error occurred while trying to replace the existing file:
DeleteFile failed: Code 5
Access is denied.
Options are Abort, Retry & Ignore.
(Code 5, just means Access is denied)
Background:
This happens as a result of the device driver file OSFMount.sys being locked. So the file can't be replaced by the (potentially) new version of the same file. The OSFMount.sys file provides two bits of functionality. 1) It is used to mount hard drive images as disk volumes with a drive letter. 2) It is used to create RAM drives. RAM drives are used in OSF as temporary working folders during the file indexing process.
The file can be locked as a result of an instance of OSForensics still running. Or a drive not being dismounted correctly.
Solution:
Option 1: Rebooting the machine will unlock the file. Then you can redo the installation. It needs to be a full reboot (not just putting the machine to sleep).
Option 2: This file doesn't change very often. So for minor version upgrades is nearly always safe to click on the "ignore" button and let the installation proceed.