During evidence ingestion or "Add Evidence", processing of a certain PST or NSF file consistently fails while other evidence processes without error.
If the AccessData application is unable to expand a PST/NSF, the structure of the PST/NSF may have issues that cause problems for the evidence processing engine (EP). The following are procedures to attempt to remedy this:
Must have a version of Outlook installed for this to work.
Run Scan PST (scanPST.exe)
Refer to these articles for more detail about running Scanpst.
Must have a version of Lotus Notes installed for this to work
Place nsf into C:\Program Files\lotus\notes\data\Fixed\ then do the following
cd C:\Program Files\lotus\notes
nfixup Fixed\TEST.nsf -F
Performing consistency check on log.nsf...
Completed consistency check on log.nsf
07/13/2009 11:47:01 AM Database Fixup: Started
07/13/2009 11:47:02 AM Performing consistency check on TEST.nsf...
07/13/2009 11:47:27 AM Completed consistency check on TEST.nsf
07/13/2009 11:47:36 AM Database Fixup: Shutdown
ncompact Fixed\TEST.nsf -c -D -i
07/13/2009 11:48:36 AM Compacting TEST.nsf (TEST)
07/13/2009 11:49:43 AM Compacted TEST.nsf, 116224K bytes recovered(16%)
07/13/2009 11:49:43 AM Database compactor process shutdown
nupdall Fixed\TEST.nsf -R -X
07/13/2009 11:50:05 AM Index update process started
07/13/2009 11:50:06 AM Updating views in C:\Program Files\lotus\notes\data\Fixed\TEST.nsf
07/13/2009 11:50:06 AM Index update process shutdown
For more information on the NSF repair utility, see the following link:
Corruption in email data records within the storage archive requires repair in order to process the archive properly.