Follow

"Element 'EVTX' cannot appear more than once if content model type is 'all'" when processing

Created by: Brendan Bone
Created date:
Last Updated date:

Problem

You get the error "Element 'EVTX' cannot appear more than once if content model type is 'all'" in the System Log when processing in Summation/eDiscovery, and processing fails immediately.

You may also get an error similar to the following:

"Processing error: System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]: Element 'EVTX' cannot appear more than once if content model type is 'all'. (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is:
System.Xml.Schema.XmlSchemaValidationException: Element 'EVTX' cannot appear more than once if content model type is 'all'."

 

Resolution

In the project's Processing Options, do not use the "Forensic" profile with the option "Expand Additional Timeline Events".  Either use the "Standard" profile with "Expand Additional Timeline Events" enabled, or use the "Forensic" profile with "Expand Additional Timeline Events" disabled.

 

Cause

The option "Expand Additional Timeline Events" performs processing tasks which are already included in the "Forensic" processing profile, so enabling it when using the "Forensic" profile causes an issue as it tells the Processing Engine to perform the same task twice.

Was this article helpful?
1 out of 1 found this helpful
Have more questions? Submit a request

Comments

Powered by Zendesk