Run From USB Issue

[kojack_1706]

I am trying to image a live system with OSForensics from a USB. I ran the “Install to USB” successfully. However, when I try to run the application on a live system from the USB I receive the following error message…

“osf64.exe - Entry Point Not Found

The procedure entry point ucrtbase.abort could not be located in the dynamic link library api-ms-win-crt-runtime-i1-0.dll”

Any thoughts on the cause?

[lauzona]

Hi
If when you try to open a program on your Windows computer you receive an error message The program can’t start because api-ms-win-crt-runtime-l1-1-0.dll is missing from your computer,it either means that Universal CRT, which is part of the Visual C++ Redistributable has either failed to install properly or that the api-ms-win-crt-runtime-l1-1-0.dll file has gone missing or become corrupted.

Could it be that on your Forensic VM or Computer are Adobe Creative Cloud Apps are installed ?
Same Question for the Live Machine, if here yes than the dll is corrupted there but normally it must be the system where you created the Stick with.
Mostly that Apps change the default dll with their own.

You maybe must repair your Forensics VM/Computer

Before you begin, make sure that your Windows is updated. Run Windows Update and confirm. Also, run the System File Checker to replace potentially corrupted system files. Reinstalling the program that is throwing up this error may also help. If it does not, then check out the following options.

Repair installed Visual C++ 2015 Redistributable package

If you have already installed Visual C++ 2015 Redistributable package, but you receive the error, you might need to repair the program. To do this, open Control Panel and go to “Programs and Features” section. Find out Microsoft Visual C++ 2015 Redistributable (x64) [for 64-bit machine] > right-click on it > select Change button > click on the Repairbutton.

I hope that help

As a Tip from my own work, use a clean VM with OSF install only what you really need for that Work.
Before you run into a new Case take a Snapshot or make a Klon of that VM.
After Work is done go back with Snapshot or delete the Klone.
With a VM you loose some Performance but have every Time a clean OSF VM for working with.

If you use Hardware use that hardware for that Job only never Mix a Forensic Workstation with maybe a Private Workstation.

best

Andre

[David (PassMark)]

We think this Win7 patch will fix it. https://support.microsoft.com/en-us/...ime-in-windows

This patch should not be required if the system in question was an up to date version of Win7, as the patch should have been rolled out via Windows Update. (we'll look into this aspect a bit more to confirm this)