Issue: Backup/archive using Oracle fails with error about "un-representable DateTime" (FTK 4.2.x+)
Symptom: When backing up or archiving cases from FTK 4.2.x or later using Oracle, the process fails with the error "Year, Month, and Day parameters describe an un-representable DateTime." Ensure you've followed the steps here using DBControl to verify this is the error generated during the backup/archive process. Also, verify in the backup/archive folder that the last table backed up was FILTERRECENTATTRS.
Cause: When you create a filter in FTK, a record of the most recently used attributes/criteria used is stored in the table FILTERRECENTATTRS. However, sometime erroneous timestamps are recorded in this table, causing the backup/archive process to fail as it does not understand these timestamps. Since the contents of this table don't have any forensic value, the contents can simply be deleted, allowing backup/archive to work again.
- Determine the Case ID for the case you wish the manipulate
- Open the case you want to manipulate
- From the Tools menu, select Execute SQL...
- Enter the following commands:
DELETE FROM [schema]_[caseid].FTK_FILTERRECENTATTRS;
- Click Execute
- When the Status in the Execute SQL windows confirms it has completed (Status: OK), you can try backing up/archiving the case again
Refer to this KB for a list of database SIDs and schema names.
The [caseid] in the command in step 5 must be a four digit number, padded with zeros. For example, if the Case ID is 15 in 4.2.x, the [caseid] would be 0015, and the resulting command would be DELETE FROM ADG53_0015.FTK_FILTERRECENTATTRS;