Crawler Error - Can you identify what wasn't processed?

[Jacques B]

When you get a crawler error, is it possible to identify what wasn't processed? I've been tweaking memory settings for a case (an image of a hard drive) and so far, it always produces a crawler error. Is there anywhere in the log where you can see what wasn't processed (or not processed completely)? If I keep getting the error, I'd like to assess the impact of the crawler error and whether I can proceed despite that.

[igor_r]

Hello Jacques,

Yes, it is definitely possible to do that. All items that Intella couldn't process should always be marked as Exception items, including the ones where crawler crashed. Normally, you would need to go to the Exception Items facet and look at these three categories: Time-out, Out of Memory and Crawler Crash.

Sometimes Intella might be crashing on an inner item. For example, we've seen cases where Intella crashed when indexing a small disk image that was located inside the main disk image. That was an installation disk image. So in that case, you could safely ignore the crash as long as you don't care about that small image.

If you are indexing a single disk image and the whole image is marked as an Exception item, it might be tricky to find out which file exactly triggered the crash. You might take a look at the logs and see which item was processed last just before the crash. You are welcome to submit a support ticket if you want us to take a closer look at your specific case.

[Jacques B]

Excellent, thank you. That will allow me to assess whether there is value in re-processing the evidence with different memory allocation settings, or if what was missed is inconsequential.

[Jacques B]

Further to the earlier message, I checked and unfortunately, the error is on the .E01 image file. So Intella Connect is not seeing all of the partitions. I'm now using Arsenal Image Mounter to mount the encrypted partition and use the BL Recovery key to create a decrypted version, and will ingest that into the case instead. That should work, providing a work around. Tweaking the memory settings doesn't seem to work on the BL encrypted image file (with the BL Recovery key provided).