If exceptions occur during source processing, the details are recorded and are made available for review. On the Exceptions tab the Categories pane displays exceptions organized by severity, with specific exception types listed beneath. Exceptions exist for any exception type that has the number higher than (0) alongside it.
You can filter the displayed exceptions by all exceptions or by individual custodians, file types, import sets or sources using the Filter By and Having lists above the exception category list.
The following table provides the name and description of each exception type in CloudNine™ Explore.
Critical Issues |
|
|---|---|
Analysis Failures |
Unhandled analysis failure; logged after maximum attempts for the record is exceeded. |
Inventory Failures |
Unhandled inventory failure; logged after maximum attempts to inventory a source has been exceeded. |
Indexing Failures |
Unhandled indexing failure; logged after maximum attempts to index a file has been exceeded. |
OCR Failures |
Unhandled OCR failure; logged after maximum attempts to OCR a file has been exceeded. |
Analytics Failures |
Unhandled analytics failures; logged after maximum attempts to perform analytics have been exceeded. |
Errors |
|
Inaccessible/Corrupted Mail-stores |
Logged for failures that occur while attempting to open a mail store. Examples of mail-store files: *.pst, *.nsf, *.dbx, *.mbox |
Message Parsing Errors |
Logged when an attempt to parse a file or buffer that appears to be an email fails (item is instead treated as a Document). |
Archive Parsing Errors |
Logged when an attempt to parse an archive file fails due to corruption, encryption, or misidentification. |
Inventory Errors |
Unexpected exceptions that occur during the inventory phase, usually permission related exceptions while accessing a file or folder. |
Hashing Errors |
Unexpected exceptions for file and email hash operations that are usually thrown by the hashing engine itself. |
File Identification Errors |
Logged when the file engine reports a failure resulting in a file type that is unable to be determined. |
Language Recognition Errors |
Logged when language identification encounters an unexpected exception. See the error details for further information. |
Container Listing Errors |
Unexpected error listing the contents of a container or sub-container. This type of error will almost always prevent the entire contents of the container from being expanded. |
Metadata Extraction Errors |
Unexpected failure extracting metadata from file or buffer, possibly caused by a malformed document or email item. |
Content Extraction Errors |
Unexpected failure extracting content from file or buffer. Extracted text only, not related to OCR. |
Indexing Errors |
Unexpected indexing failure, or may be caused by document content exceeding the maximum index-able document size. Maximum index-able document size: 2,147,483,647 bytes (2GB) |
Analysis Filtering Errors |
Unexpected failure evaluating a processing filter (duplicate/nist). |
OCR Errors |
Errors that occurred while performing OCR on a document could be caused by the detection of an encrypted file, the source file not being found, an OCR output not found, or the OCR output being empty. |
Inaccessible Forensic Image |
Logged when a forensic image is inaccessible. Usually due to an unknown file system existing on the image, or an unexpected error. |
Near Duplicate Detection Errors |
Unexpected exceptions that occur during near-duplicate detection. |
Email Thread Detection Errors |
Unexpected exceptions that occur during email thread detection. |
Near Duplicate Grouping Errors |
Unexpected exceptions that occur during near-duplicate grouping detection. |
Informational |
|
Unidentified File Types |
Logged when a file type is successfully processed, but remains unidentified. |
Empty Files |
Logged when the file size is zero bytes. |
Empty Content |
Logged when a file contains no content, or when the content cannot be accessed due to encryption. |
Encrypted Files |
Logged when a file fails to open due to encryption. Usually caused by password protection. |
Decrypted Files |
Logged when a file is successfully decrypted. The password used to decrypt the file will be provided in the details, if it exists. |
Executable Files |
Logged when a file appears to be an executable or library file. |
Date Range Filter |
Logged when a file contains timestamps outside of the acceptable range for the date range filter. Minimum valid date: 1/1/1970 |
Cannot OCR |
Logged when OCR was attempted for a document, but no content was retrieved. Logged when a file is encrypted or protected, or when no OCR content was recognized for a document. |
Viewing and Saving Individual Exception Details
After reviewing exceptions, you can save the exception details for exception files, and you can re-analyze any of the exception files individually or by exception category. When you re-analyze a file, the file is removed from the exceptions list and added back into the analysis queue. Once the file is added to the analysis queue, it is automatically re-analyzed and re-indexed. If the file has attachments, or is part of a document family, the family relationships are retained.
1.Click the Case Manager tab.
2.Double-click a case to open it.
3.Click the Exceptions tab. In the leftmost panel, a listing of exception types organized by severity is visible. Exceptions are shown for any type that has more than 1 exception.
4.To filter the exception list, click one of the following in the Filter By list:
•All - All exceptions will be displayed, and the Having list is disabled.
•Custodian - The Having list is populated with the case's custodians.
•File Type - The Having list is populated with all of the file types in the case.
•ImportSet - The Having list is populated with all import sets in the case.
•Source - The Having list is populated with the case's sources.
5.In the Having list, select the applicable custodian, file type, import set, or source. The Categories list on the left updates to show exceptions associated with the selections in the Filter By and Having lists.
6.In the Categories list, click an exception type.
i.In the center panel, the list of exceptions for the selected exception type is displayed. In the rightmost panel, details related to the currently selected exception are visible. If you want to view and open the source document associated with the exception in its native viewer, click Launch Source Document in the right-most panel. To open the folder containing the source document, click the Launch Source Folder. When the folder opens, the source document is selected in the folder. If the source document is located within a container file (such as a .pst file), clicking the Launch Source Folder link opens that folder with the container file selected.
7.Click the save file button to save a text file that contains the error log entry for the selected exception.
By default, the file is saved as a text file to the ..\cases\[current case name] folder. It provides the following details:
•Activity - The activity attempted.
•Category - The category of the error.
•Type - The type of error.
•Created - The data and time when the error occurred.
•Inventory Id - The inventory identification number.
•Source - The source name.
•Source Id - The unique identifier within the case for the source.
•Session Id - The CloudNine™ Explore session number.
•File Ref - A path to the file, listing a relative folder structure.
•Message - A general description of the error.
Viewing and Saving All Exception Details
1.Click the Case Manager tab.
2.Double-click a case.
3.Go to the Exceptions tab.
4.In the Categories list, click All.
5.At the bottom of the Categories list, click the Save As... button. The Save exception view (All) .csv dialog displays.
6.Browse to where you want to save the exception details .csv file, and in the File name field enter an exception file name. By default, the file is saved to the ..\cases\[current case name] folder as All Exceptions.csv.
7.Click the Save button.