Evidence File failing Discovery

book

Article ID: 100011895

calendar_today

Updated On:

Description

Error Message

LEF_outputlog.log message line:

INFO LEFLister 9932 - Scanning input file
INFO  LEFLister 9932 - Open evidence file success
WARN  LEFLister 9820 - ReadFile failed with error:109 .Terminating LEF as caller has exited 

 

server.####-##-##.log message line:

[#80089) ContainerException: [#80092) Error extracting container - Unable to extract contained file { 0} from { 1 }

Cause

Permissions or access limitation to either File Level or Source Directory.

The eDiscovery Platform(eDP) Service logon accounts must have "Modify" or "Full Control" rights to all source directories and files that needed to be discovered/processed into eDP.

Resolution

Test Source Directory permissions:

- Check the source folder permissions:

  1. Right click on source folder
  2. Select "Properties"
  3. Select "Security" tab
  4. Ensure eDP Service logon accounts have "Modify" or "Full Control" rights

Test Network folder access rights

-  Check evidence file from a local directory of the eDP server:

  1. Copy the files into the eDP appliance D-drive
  2. Run discovery

Note: If the discovery is successful in local server, but fails in the NAS/SAN/Network Source location, permissions are not correct and need to be adjusted.

Test File level issue:

Test if the Evidence file can be opened outside of eDP using Encase or some other third party software.

Gather a sample data and forward to eDP Technical Support. Support can run a manual command to extract/convert the evidence file as test.

The Evidence File data could be corrupt and need to be addressed by the data provider.

 

 

Issue/Introduction

Running discovery on evidence file:L01 fails in pre-processing