Running initial analysis of drive image. received message error while processing emailaddress.ost file. according to the provided inventory the user was running office Standard version 2019. Is there a known issue with office/outlook 2019 and Autopsy? Any recommendations for analyzing the ost files?
Can you supply the log file from the case to see if there are any messages to help debug the problem.
Kind regards.
Mark
WARNING: CDThorne@wyomingcat.com.ost-162792: Failed to create internal java-libpst PST file to parse:
Unable to find node: 97
com.pff.PSTException: Unable to find node: 97
com.pff.PSTFile.findBtreeItem(PSTFile.java:734)
com.pff.PSTFile.getDescriptorIndexNode(PSTFile.java:748)
com.pff.PSTFile.processNameToIdMap(PSTFile.java:200)
com.pff.PSTFile.(PSTFile.java:167)
org.sleuthkit.autopsy.thunderbirdparser.PstParser.open(PstParser.java:101)
org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.processPst(ThunderbirdMboxFileIngestModule.java:189)
org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule.process(ThunderbirdMboxFileIngestModule.java:141)
org.sleuthkit.autopsy.ingest.FileIngestPipeline$PipelineModule.process(FileIngestPipeline.java:230)
org.sleuthkit.autopsy.ingest.FileIngestPipeline.process(FileIngestPipeline.java:129)
org.sleuthkit.autopsy.ingest.DataSourceIngestJob.process(DataSourceIngestJob.java:806)
org.sleuthkit.autopsy.ingest.FileIngestTask.execute(FileIngestTask.java:44)
org.sleuthkit.autopsy.ingest.IngestManager$ExecuteIngestJobTasksTask.run(IngestManager.java:926)
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
2019-11-08 12:26:48.81 org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule processPst
INFO: PSTParser failed to parse CDThorne@wyomingcat.com.ost
2019-11-08 12:26:48.81 org.sleuthkit.autopsy.thunderbirdparser.ThunderbirdMboxFileIngestModule processPst
INFO: Failed to delete temp file: CDThorne@wyomingcat.com.ost-162792
Does anyone have some update on this?
I am having a similar issue, while trying to parse an OST file I receive the messages “Error while processing xxxxx.ost” and “Only files from Outlook 2003 and later are supported”, although it is a recent OST file.
I can’t seem to find any other logs. In the case folder, “autopsy.log.0” is empty.