OST and Zimbra issues

[AdamS]

I'm seeing a pattern that makes me think Intella and Zimbra don't play nice together.

 

My last 2 jobs have involved Zimbra email servers with Outlook clients connecting to them and Intella is having major issues with the OST and ZDB files I recover from the client machines.

 

Thus far simply changing the ZDB extension to PST seems to work fine, but the OST files are a different matter.

 

If I try to index the OST from one of these clients Intella crashes, every single time no exceptions, to the point where it's a full system lock up and a reboot is required (my Connect clients are suffering a bit).

 

I bought Systools OST recovery and convert the OST to PST and in most cases this has worked, but I have a 12GB OST from a Zimbra client which seems to be very corrupt even opening it in Systools is taking several hours, then several more to export to PST and the resulting PST is still crashing Intella and my computer.

 

I'm in my 3rd attempt so I'm just going to export out all the individual emails from the OST and import that into Intella and hopefully that will do the trick.

 

BTW this problem is what prompted my other wish about Intella having some sort of crash recovery or ability to resume failed indexing as this is a major client and major job and I've had him on hold for several days while I try and resolve the issues. Intella in general seems to regularly have problems with OST but not to the same degree that these Zimbra OST's are causing.

 

Is this a known issue or something that hasn't come up before?

[AdamS]

A bit more info about this one, during one of the attempts to index the converted OST file the crash actually appears to have deleted the tag results. I can still see the tags in the list, however they are all listed as 0.

 

When tags are applied are they linked to the hash value of the file? Is there any way I can dig through the log files to find these tags and maybe export a table to match tags to hash values so I can recreate them? Otherwise I will have lost 2 weeks worth of client work..

 

Happy to send any log files you want to assist as I have a feeling I am going to be seeing about another dozen computers from this client in the coming months and they are all Zimbra client computers..god help me.

[ŁukaszBachman]

Hi Adam!

 

Sadly, Zimbra file formats are not officially supported by Intella and we don't have much experience with it. As I quickly learned it seems that ZDB file format is very closely related to PST (can be identical), but this is not something that should be taken for granted (I believe Zimbra developers are leaving themselves some room for changing the format in future). However, there seems to be some tools available that can theoretically convert ZDB to PSTs so perhaps they take this into account.

 

Could you explain to us what are the tools that your clients were using and how did you extract evidence files from them? My current assumption is that your clients were using Zimbra Desktop (https://www.zimbra.com/products/zimbra-desktop/index.html) to handle their email accounts, and that product produces ZDBs and OSTs files. Then you simply renamed ZDB to PST and pushed it through Intella. Is that the case? 

 

Regardless, it looks like you can use scanpst.exe to try fixing not only PSTs and OSTs, but also ZDBs. Did you try that already? Did you try any official migration guides defining how to move from Zimbra to Outlook (if there are any)? Or perhaps other tools which specialize in that? (http://www.softspire.com/zimbra-converter/, disclaimer: DIDNT CHECK MYSELF SO USE AT YOUR OWN RISK)

 

As to the issue with broken taggings as a result of errors while processing problematic OSTs.

The best way would be to make use of Case Backup to recover to a stage where case was still working properly.

If that is not possible, you could try creating a copy of this case and reindexing evidence without those broken OSTs. Reindexing should preserve taggings, if successful.

There is also a "Restore annotations..." action available in Intella Desktop under the "File" menu. Please read instructions provided there carefully.

 

If all of those options fail then please let us know and we will try to figure out some other way of helping you.

[AdamS]

Sadly I can't even open this case without the desktop crashing so recovery looks like a no go for now.

 

I'm in the process of copying off another version of the case and it's data to a second machine, then hosting the Connect on that machine for my clients. Once that is up and running I can then play around with this case without fear of crashing and I'll explore those options.

 

I used Systools OST recovery to view the Zimbra OST files and convert to PST but it's possible they didn't work correctly and thus created a corrupt PST file, I have Zimbra desktop downloaded and after my machine is clear I'll look at installing that and see what export options I might have. The other link you have provided goes to a 404 error, not sure if that is a good sign or not for that software company but I will see if softspire still exists somewhere and look at that too.