Help with [ERROR] [engine.core.Statistics] #2250
-
|
I extracted a NVMe using Encase, then tried to process the E01 with IPED and I am receiving the error of the image below:
I have no idea what it means, I tried again and the numbers changed as you can see. Can someone clarify it to me? [EDIT: Removed Azure Key] |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
|
Hello @oduvaldo-vick! This message means that there were a lot of I/O (reading) errors while processing the evidence. Possible causes I can think of are hardware failure in the device in which the E01 is stored, network errors (in case the evidence in a network mapped volume), or possibly a corrupted E01 (not sure about this last one). I would also try to open the E01 file in another tool (e.g. FTK Imager) and access some files, just to check if the image is not corrupted. |
Beta Was this translation helpful? Give feedback.
-
|
Another possible cause is a corrupted File System in the E01 image, it happens when the suspect computer is shutdown abruptly and the file system is not repaired. But, in this situation, the number of IO read errors should repeat between different IPED runs. Another cause might be your anti-virus blocking the reads from the E01 image or writes to the temp folder, but in this case usually the number of IO read errors is just a few, not that much. There is a built-in filter on the UI top left corner which you can enable to see all those files with IO read errors, maybe that could help, if they don't open in the Hex viewer, the corrupted File System issue would be a stronger hypothesis. |
Beta Was this translation helpful? Give feedback.
-
|
PS: you can try to open the same files listed in the "Read Error" filter I pointed above in FTKImager as @wladimirleite suggested. |
Beta Was this translation helpful? Give feedback.
-
|
Just a suggestion based on @wladimirleite tip.
|
Beta Was this translation helpful? Give feedback.
Another possible cause is a corrupted File System in the E01 image, it happens when the suspect computer is shutdown abruptly and the file system is not repaired. But, in this situation, the number of IO read errors should repeat between different IPED runs.
Another cause might be your anti-virus blocking the reads from the E01 image or writes to the temp folder, but in this case usually the number of IO read errors is just a few, not that much.
There is a built-in filter on the UI top left corner which you can enable to see all those files with IO read errors, maybe that could help, if they don't open in the Hex viewer, the corrupted File System issue would be a stronger hypothesis.