# Section 6 Lab: Ingestion Fails for Read Error **URL:** \ **Category:** Autopsy Online Training\ **Created:** [April 22, 2020, 2:48pm UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141 "2020-04-22T14:48:12Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![forensicator](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/forensicator/32/614_2.png) [@forensicator](https://sleuthkit.discourse.group/u/forensicator)\ **Post date:** [April 22, 2020, 2:48pm UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141/1 "2020-04-22T14:48:12Z")
Hi, I’ve tried running the ingest plugins twice but it fails after 15% giving the following error `Error encountered while calculating the hash value for /Windows/servicing/Sessions/30774123_1296942165.back.xml (Deleted File).` ![image](https://global.discourse-cdn.com/free1/uploads/sleuthkit/original/1X/cc30a6aaebd58692485a952868658e079ba1c367.png) ---
**Author:** ![forensicator](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/forensicator/32/614_2.png) [@forensicator](https://sleuthkit.discourse.group/u/forensicator)\ **Post date:** [April 22, 2020, 2:50pm UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141/2 "2020-04-22T14:50:26Z")
Is there any hash for the **device1\_laptop.e01** file that I can compare with my downloaded file? ---
**Author:** ![BrianMoran](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/brianmoran/32/453_2.png) [@BrianMoran](https://sleuthkit.discourse.group/u/BrianMoran)\ **Post date:** [April 22, 2020, 5:47pm UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141/3 "2020-04-22T17:47:09Z")
Yes, The hashes are listed in Section 1. For your convenience, here they are as well: MD5 (device1\_laptop.e01) = dc176d653c5613e305e831525e874090 MD5 (device2\_mediacard.e01) = c8343d3976eec2985e7580a2b6321591 ---
**Author:** ![forensicator](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/forensicator/32/614_2.png) [@forensicator](https://sleuthkit.discourse.group/u/forensicator)\ **Post date:** [April 24, 2020, 4:52pm UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141/4 "2020-04-24T16:52:26Z")
it’s weird. The hashes do match. 🤷‍♂️ ---
**Author:** ![BrianMoran](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/brianmoran/32/453_2.png) [@BrianMoran](https://sleuthkit.discourse.group/u/BrianMoran)\ **Post date:** [April 25, 2020, 3:17am UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141/5 "2020-04-25T03:17:21Z")
It looks like you have some of the hits that are required, and for some reason you are getting errors on a file. As long as you are able to get the data that is required (you have Correlation Engine hits, and Hash Lookup results, it looks like its actually running properly, it just cannot read one single file) ---
**Author:** ![remon](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@remon](https://sleuthkit.discourse.group/u/remon)\ **Post date:** [May 3, 2020, 11:07am UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141/6 "2020-05-03T11:07:50Z")
I seem to have the same or similar error when trying to run the Ingest Module “Hash Lookup”. _Error encountered while calculating the hash value for /Windows/servicing/Sessions/30774123\_1296942165.back.xml (Deleted File)._ It would be great if anyone has a solutions, since I cannot continue the course. I’ve verified MD5 checksum, recreated the case, re-run ingest modules…no luck. Thanks guys! ---
**Author:** ![BrianMoran](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/brianmoran/32/453_2.png) [@BrianMoran](https://sleuthkit.discourse.group/u/BrianMoran)\ **Post date:** [May 3, 2020, 1:53pm UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141/7 "2020-05-03T13:53:08Z")
> [@BrianMoran](#): > > It looks like you have some of the hits that are required, and for some reason you are getting errors on a file. As long as you are able to get the data that is required (you have Correlation Engine hits, and Hash Lookup results, it looks like its actually running properly, it just cannot read one single file) For some reason you are getting errors on Autopsy reading a file. That does not mean that it is not working properly, or anything like that, you are just getting a notification that a file cannot be read. That alone should not prevent you from doing anything else. Thank you ---
**Author:** ![remon](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@remon](https://sleuthkit.discourse.group/u/remon)\ **Post date:** [May 3, 2020, 5:40pm UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141/9 "2020-05-03T17:40:25Z")
@BrianMoran, issue solved thanks! 🙈 ---
**Author:** ![Ozi\_Malik](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/ozi_malik/32/883_2.png) [@Ozi\_Malik](https://sleuthkit.discourse.group/u/Ozi_Malik)\ **Post date:** [May 13, 2020, 3:08pm UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141/10 "2020-05-13T15:08:05Z")
> [@remon](#): > > I seem to have the same or similar error when trying to run the Ingest Module “Hash Lookup”. > > _Error encountered while calculating the hash value for /Windows/servicing/Sessions/30774123\_1296942165.back.xml (Deleted File)._ > > It would be great if anyone has a solutions, since I cannot continue the course. I’ve verified MD5 checksum, recreated the case, re-run ingest modules…no luck. Thanks guys! i am facing the same since two days kindly let me know how i can fix this ---
**Author:** ![4n6h4X0r](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/4n6h4x0r/32/1347_2.png) [@4n6h4X0r](https://sleuthkit.discourse.group/u/4n6h4X0r)\ **Post date:** [April 6, 2021, 10:38pm UTC](https://sleuthkit.discourse.group/t/section-6-lab-ingestion-fails-for-read-error/1141/11 "2021-04-06T22:38:24Z")
Chances are, these .back.xml files (as well as .wer files, while we’re at it) have been deleted and the data blocks they’ve been using are no longer associated with them, which of course means they cannot be read. You can check the error messages marked these files as “Deleted File”, and if you check them out in the “Data Sources” file tree, you can verify that these files no longer have associated data.