Support Forums

Last night while trying to investigate email using IR 503, it just closed.  I clicked to read a message, and I was looking at my desktop.  There was no error, and I have found no logging to indicate an issue.

I restarted and had to redo my search and began working again.  This time I was careful to save often as a precaution.  But, the second time it vanished, it corrupted the case file and won't reopen it, so I have to start over again anyway.

I am running on a Dell Latitude E6500 with 4GB RAM and Windows XP SP3.

Has anyone had a similar issue?  Is there something I need to check on my laptop?

Thanks,
Carl

Carl,

Thanks for taking the time to post to the forums. Are you working with an image or on a live machine? If you are working with an image was it captured with ProDiscover? Either live or image what file system are you working with?

Also, what type of email are you working with? PST/OST/DBX?

I do apologize for all of the questions but I'll need this information to begin troubleshooting and attempting to recreate the issue.

The files I am working with were restored to my local drive, not in an image.  I started a new project, added my local hard drive, and then did the search within the directory the restore was done in.

NTFS file system on my laptop.  Files are PST/OST.

Carl,

From your description above it sounds as though you:

1. loaded a live disk into a ProDiscover project

2. extracted an PST to your local disk

3. then loaded the local disk (c: drive) into a project

4. then loaded the PST into the PD email viewer conducted a search which caused PD to crash.

Is that correct? If so, can you try to extract the PST to an external drive and then load the external drive into your project and try your search again. I will attempt to recreate the crash in our labs and update you as soon as i know more.

Alex,

1. No
2. No, it was restored from backup to my system in c:\ir2\
3. Yes
4. Sort of.  I did go to c:\ir2 and chose to search for mail.  This worked fine, and I started going through the mail.  As I was going through the messages and looking for ones related to my case, PD just closed.  I had read several messages, and when I clicked to read the next one, I was suddenly looking at my desktop.

Carl,

Thanks for the amplifying information and for working so closely with me. As we've discussed I have elevated the issue and the dev team is reviewing the log files. I'll update you once I hear from them.

I am having the same issue - running on WIN XP SP/3 - images were taken from seized machines while using the PD 5.0.3 product.  It shuts down while running a content search on both images.  The content search is constructed as:

North American
NAV
Integrated Solutions
Cynthia
Ron
Brendan
Glenn
Kurt
Chad
Halifax
NOT *.dll OR *.exe OR *.dat OR *.reg OR *.inf OR *.lnk OR *.msi OR *.ini OR *.dtd OR *.xsd OR *.x3d OR *.js OR *.h OR *.c OR *.cpp OR *.ttf OR *.jsa OR *.jar OR *.xml OR *.sys OR *.aspx OR   *.asp OR *.php OR *.cs OR *.mof OR *.mui

There is no error thrown it just disappears.

Noc,

I've contacted you via PM. Please review.