20190708 153430.040 I [ProcessorBase.cpp:105): System: 20190708 153430.040 I [(ProcessorBase.cpp:131): CPU: AMD64 12 processors 64bit RAM: 51537072128 Granularity: 65536 Pagesize: 4096 20190708 153430.040 I [(ProcessorBase.cpp:133): Environment: Variables: AFX43_DMC_TBLPATH=C: \Program Files\AccessData\Forensic Toolkit\4.0\bin\XSL-Formatter\base2;C:\ Program Files\AccessData\Forensic Toolkit\5.3\bin\xSL-Formatter\base2;C:\Program Files\AccessData\Fo rensic Toolkit\6.2\bin\XSL-Formatter\base2 AFX43_FONT_CONFIGFILE=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\xSL-Formatter\bin\f ont.config.xml;C:\Program Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin\font.config.xm 1;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\xXSL-Formatter\bin\font.config.xml AFX43_HOME=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\xXSL-Formatter\bin;C:\Program F iles\AccessData\Forensic Toolkit\5.3\bin\xSL-Formatter\bin;C:\Program Files\AccessData\Forensic Tool kit\6.2\bin\XSL-Formatter\bin AFX43_HYPDIC_PATH=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\XSL-Formatter\hyphenati on;C:\Program Files\AccessData\Forensic Toolkit\5.3\bin\xSL-Formatter\hyphenation;C:\Program Files\A ecessData\Forensic Toolkit\6.2\bin\XSL-Formatter\hyphenation AFX43_LIC_PATH=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\xSL-Formatter\bin;C:\Progr am Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin ALLUSERSPROFILE=C: \ProgramData APPDATA=C: \Users\aespivack \AppData\Roaming CommonProgramFiles=C:\Program Files\Common Files CommonProgramFiles (x86)=C:\Program Files (x86)\Common Files CommonProgramW6432=C:\Program Files\Common Files COMPUTERNAME=WORKSTATION-AES ComSpec=C: \Windows\system32\cmd.exe DEFAULT_CA_NR=CA100 FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Users\aespivack LOCALAPPDATA=C: \Users \aespivack\AppData\Local LOGONSERVER=\ \WORKSTATION-AES MOZ_PLUGIN_PATH=C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ NUMBER_OF_PROCESSORS=12 OPENSSL_CONF=C: \Users \AESPIV~1\AppData\Local\Temp\ {A48A84F7-BB48-4046-8BCE-40CD742C 9BB4}\\open ssl.cfg OS=Windows_NT Path=o: \oracle\product\10.2.0\client_1\bin;0: \Oracle\Product\10.2.0\AccessDataDB\bin;C: \Window s\system32; C:\Windows; C:\Windows \System32\Wbem; C: \Windows\System32\WindowsPowerShell\v1.0\;C:\Progra m Files\AccessData\Forensic Toolkit\4.0\bin\xSL-Formatter\bin;C:\Program Files\AccessData\Forensic T oolkit\5.3\bin\xSL-Formatter\bin;C:\Program Files (x86)\Common Files\Teleca Shared;C:\Program Files\ nodejs\;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin;C:\Program Files (x86 )\Common Files\Apple\Apple Application Support;C:\Program Files (x86)\Common Files\Apple\Mobile Devi ce Support;C:\Program Files\Common Files\Apple\Apple Application Support;C:\Program Files\Common Fil es\Apple\Mobile Device Support;C:\Program Files (x86)\Microsoft SDKs\TypeScript\1.0\;C:\Users\aespiv ack\AppData\Roaming\npm PATHEXT=.COM; .EXE; .BAT; .CMD; .VBS; .VBE; .JS; .JSE; .WSF; .WSH; .MSC PROCESSOR_ARCHITECTURE=AMD64 PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 44 Stepping 2, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=2c02 ProgramData=C: \ProgramData ProgramFiles=C:\Program Files ProgramFiles(x86)=C:\Program Files (x86) ProgramW6432=C:\Program Files PSModulePath=C: \Windows\system32\WindowsPowerShell\v1.0\Modules\ PUBLIC=C: \Users\Public SESSIONNAME=Console SystemDrive=C: SystemRoot=C: \Windows TEMP=D: \adtemp TMP=D: \adtemp USERDOMAIN=Workstation-AES USERNAME=aespivack USERPROFILE=C: \Users\aespivack VBOX_MSI_INSTALL_PATH=C: \Program Files\Oracle\VirtualBox\ windir=C: \Windows windows_tracing_flags=3 windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log ___COMPAT_LAYER=RunAsAdmin DisableUserCallbackException Modules: C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADIndexer.exe 7:12:20 PM Tue sday, April 18, 2017 10.16.1.9 C:\Windows\SYSTEM32\ntdll.dll 6:41:18 AM Thursday, November 17, 2011 6.1.7601.17725 C: \Windows\SYSTEM32\MSCOREE .DLL 3:23:48 AM Sunday, November 21, 2010 4.0.40305.0 C:\Windows\system32\KERNEL32.d11 5:37:12 AM Saturday, July 16, 2011 6.1.7601.17651 EFTA00281098

--=PAGE_BREAK=--

C:\Windows\system32\KERNELBASE.d1l1 5:37:12 AM Saturday, July 16, 2011 6.1.7601.17651 C:\Windows\system32\apphelp.dll 3:24:03 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\AppPatch\AppPatch64\AcGenral.DLL 1:40:00 AM Tuesday, July 14, 2009 6.1.7600 16385 C:\Windows\system32\Sspicli.dll 6:35:26 AM Thursday, November 17, 2011 6.1.7601.17725 C:\Windows\system32\msvert.dll 8:46:06 AM Friday, December 16, 2011 7.0.7601.17744 C:\Windows\system32\RPCRT4.dll 3:24:02 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\SHLWAPI.d1ll 3:24:22 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\GDI32.dl1l 3:24:03 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\USER32.dl1 3:24:09 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\LPK.d1l1 1:41:19 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\USP10.dl1l 3:24:08 AM Sunday, November 21, 2010 1.626.7601.17514 C:\Windows\system32\ole32.dll 3:23:48 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\SHELL32.dll 5:43:10 AM Saturday, June 09, 2012 6.1.7601.17859 C:\Windows\system32\sfc.dll 1:33:06 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\sfc_os.DLL 1:41:54 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\USERENV.d1ll 3:24:03 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\profapi.dll 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\dwmapi.dll 1:40:34 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\ADVAPI32.dl1l 1:40:01 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\SYSTEM32\sechost .dll 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\MPR.d1l1 1:41:26 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\IMM32.DLL 1:41:09 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\MSCTF.dll 1:41:28 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\Microsoft .NET\Framework64\v4.0.30319\mscoreei.dll 12:34:06 AM Friday, November 06, 2015 4.6.1055.0 C:\Windows\system32\VERSION.d1ll 1:41:56 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\Microsoft .NET\Framework64\v4.0.30319\clr.dll 12:34:06 AM Friday, November 06, 2015 4.6.1055.0 C:\Windows\system32\MSVCR120_CLRO400.d11 2:09:00 PM Thursday, October 22, 2015 12.0.52 512.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ fa8eef6f6cb67c660d71lel5c5cad71b5\mscor lib.ni.dll 3:42:42 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\system32\CRYPTBASE.d1l 1:40:24 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\uxtheme.d1ll 1:41:56 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\CRYPTSP.d1ll 1:40:24 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\rsaenh.dll 1:43:15 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\RpcRtRemote.dll 3:24:01 AM Sunday, November 21, 2010 6.1.7601.1751 4 C:\Windows\Microsoft .NET\Framework64\v4.0.30319\clrjit.dll 12:34:06 AM Friday, November 0 6, 2015 4.6.1055.0 C:\Windows\system32\OLEAUT32.d11 5:37:49 AM Saturday, August 27, 2011 6.1.7601.17676 C:\Windows\assembly\NativeImages_v4.0.30319_64\System\5f£665a4076cb8d9479ca4d06e7827£b9F\System. ni.dll 3:42:49 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\1751687825177cb487cl080d7e37401£F \System.Drawing.ni.dll 4:09:48 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\a359814ff0333ca2c4ab29f30f 55dd20\System.Windows.Forms.ni.dll 4:09:57 PM Monday, July 02, 2018 4.6.1055.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADLogger.dll 7:10:38 PM Tues day, April 18, 2017 6.2.0.400 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ad_log.dll 7:10:36 PM Tuesda y, April 18, 2017 6.2.0.400 C:\Windows\system32\MSVCP140.d11 4:06:54 AM Friday, August 26, 2016 14.0.24215.1 C:\Windows\system32\VCRUNTIME140.d11 4:06:54 AM Friday, August 26, 2016 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-runtime-11-1-0.d1l1 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ucrtbase.DLL 4:45:24 PM Wedn esday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms—win-core-timezone-11-1-0.d ll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-file-12-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-localization-11-2 -O.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-synch-11-2-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-processthreads-11 -1-1.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms—win-core-file-11-2-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-string-1l1l-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-heap-11-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-stdio-1l1-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-convert-11-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-locale-11-1-0.dll EFTA00281099

--=PAGE_BREAK=--

4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms—-win-crt-math-11-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-multibyte-11-1-0.d 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-time-11-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-filesystem-11-1-0. dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-environment-11-1-0 .dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-utility-1l1-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_date_time-vc140-mt-1_59.dl1l 7:10:52 PM Tuesday, April 18, 2017 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_thread-vcel40-mt-1_59.dll 7:10:52 PM Tuesday, April 18, 2017 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_system-vcl40-mt-1_59.dll 7:10:52 PM Tuesday, April 18, 2017 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_chrono-vc140-mt-1_59.dll 7:10:48 PM Tuesday, April 18, 2017 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\PLIsupportManaged.dll 7:11:3 6 PM Tuesday, April 18, 2017 10.16.1.9 C:\Windows\Microsoft .NET\Framework64\v4.0.30319\nlssorting.dll 12:34:06 AM Friday, Novemb er 06, 2015 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\5034a88e58 £966dd7d69fe9b9875832c\Sy stem.Core.ni.dll 3:51:31 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\46ec60579b59cedec8c39cabca 6d1153\System.Configuration.ni.dll 3:51:33 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System. Xm1\c9576235d85a3db7 1la0bee45aa4155ba\Sys tem.Xml.ni.dll 3:51:23 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\system32\ws2_32.dll 3:24:28 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\NSI.d1l1 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\mswsock.dll 3:24:00 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\System32\wshtcpip.dll 1:41:58 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\System32\wship6.dll 1:41:58 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\NLAapi.dll 3:23:54 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\napinsp.dll 1:41:52 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\pnrpnsp.dll 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\DNSAPI.dll 6:24:15 AM Thursday, March 03, 2011 6.1.7601.17570 C:\Windows\System32\winrnr.dll 1:41:56 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\wshbth.dll 3:24:36 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\assembly\NativeImages_v4.0.30319_64\System. ServiceModel\ac14548e7a731da59e036d17baB e3c06\System.ServiceModel.ni.dll 4:11:13 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System. Servdidec626#\7a5Sb7af88001106023a3e276d8 fbe359\System. ServiceModel.Internals.ni.dll 4:10:39 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\SMDiagnostics\c329a07 fa3cb821400eb59734c1a04d8\ SMDiagnostics.ni.dll 4:10:02 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System. Runteb92aal2#\ec3ea73175791bd1e5d2031d28 31e641\System.Runtime.Serialization.ni.dll 4:10:38 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\system32\pcwum.DLL 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Program Files\AccessData\Evidence Processing Engine\10.16\PLIsupport.dll 7:11:34 PM Tu esday, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Altova.dll 7:10:44 PM Tuesda y, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\AltovaxML.dll 7:10:46 PM Tue sday, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\processing_options.dll Till: 36 PM Tuesday, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\epshared.dll 7:11:06 PM Tues day, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\dtengine64.dll 9:58:02 PM Th ursday, August 04, 2016 7.73.8140.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\icuuc57.dll 7:11:18 PM Tuesd ay, April 18, 2017 57.1.0.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\icudt57.dll 7:11:22 PM Tuesd ay, April 18, 2017 57.1.0.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\icuin57.dll 7:11:16 PM Tuesd ay, April 18, 2017 57.1.0.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\adshattrdefs.dll 7:12:26 PM Tuesday, April 18, 2017 2.0.0.22 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_filesystem-vcl40-mt-1_59.dl 1 7:10:52 PM Tuesday, April 18, 2017 2.0.0.22 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Database.dll 7:11:00 PM Tues day, April 18, 2017 6.2.0.1026 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ad_globals.dll 7:10:34 PM Tu esday, April 18, 2017 6.2.0.479 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Database.Definition.Wrapper.dll 7:10:56 PM Tuesday, April 18, 2017 6.2.0.1026 EFTA00281100

--=PAGE_BREAK=--

C:\Program Files\AccessData\Evidence Processing Engine\10.16\DALWrapper.d1ll 7:10:52 PM Tu esday, April 18, 2017 6.2.0.1026 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Retrieval.dll 7:11:52 PM Tue sday, April 18, 2017 6.2.0.1026 C:\Windows\system32\WININET.d1ll 8:04:24 PM Wednesday, September 26, 2012 9.0.8112.1645 0 C:\Windows\system32\Normaliz.dll 1:31:40 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\iertutil.dll 8:04:24 PM Wednesday, September 26, 2012 9.0.8112.164 50 C:\Windows\system32\urlmon.dll 8:04:24 PM Wednesday, September 26, 2012 9.0.8112.16450 C:\Program Files\AccessData\Evidence Processing Engine\10.16\LIBEAY32.d1l1 7:13:00 PM Tues day, April 18, 2017 1.0.1.16 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-conio-11-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\v2client.dll 7:11:52 PM Tues day, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\socketcomm.dll 7:11:50 PM Tu esday, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\fipscomm.dll 7:11:10 PM Tues day, April 18, 2017 4.1.3.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\eshared.dll 7:11:06 PM Tuesd ay, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\SSLEAY32.d11 7:13:24 PM Tues day, April 18, 2017 1.0.1.16 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_regex-vel40-mt-1_59.dll 7:10:52 PM Tuesday, April 18, 2017 1.0.1.16 C:\Program Files\AccessData\Evidence Processing Engine\10.16\adtz_globals.dll 7:10:40 PM Tuesday, April 18, 2017 2016.4.0.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\adfs_globals.dll 7:10:40 PM Tuesday, April 18, 2017 6.2.0.479 C:\Program Files\AccessData\Evidence Processing Engine\10.16\agent_globals.dll 7:10:42 PM Tuesday, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\abstractclient.dll 7:10:40 P M Tuesday, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\agentfs.dll 7:10:42 PM Tuesd ay, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ProxyComm.dll 7:11:44 PM Tue sday, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\filtering_lib.dll 7:11:16 PM Tuesday, April 18, 2017 6.2.0.473 C:\Windows\system32\PSAPI.DLL 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADIsoDLL.dll 7:12:22 PM Tues day, April 18, 2017 6.2.0.479 C:\Program Files\AccessData\Evidence Processing Engine\10.16\FTKComm.dll 7:11:08 PM Tuesd ay, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\v2proxyclient.dll 7:11:52 PM Tuesday, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\eremote.dll 7:11:06 PM Tuesd ay, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\netfslib.dll 7:11:30 PM Tues day, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\libbfio.dll 7:11:22 PM Tuesd ay, April 18, 2017 1.0.0.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\libvshadow.d1ll 7:11:24 PM Tu esday, April 18, 2017 1.0.0.0 C:\Windows\system32\mfc140u.dll 4:02:10 AM Friday, July 22, 2016 14.0.24213.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\DataAccessWrapper.dll 7:10:5 2 PM Tuesday, April 18, 2017 6.2.0.1026 C:\Program Files\AccessData\Evidence Processing Engine\10.16\duplicate_text_analysis.dll 7:11:06 PM Tuesday, April 18, 2017 2.0.0.2 C:\Windows\system32\VCOMP140.DLL 4:06:54 AM Friday, August 26, 2016 14.0.24215.1 C:\Windows\system32\ESENT.dll 3:24:00 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Program Files\AccessData\Evidence Processing Engine\10.16\summary.dll 7:11:50 PM Tuesd ay, April 18, 2017 6.1.7601.17514 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Exporter.dll 7:11:12 PM Tues day, April 18, 2017 6.1.7601.17514 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Indexer.dll 7:11:20 PM Tuesd ay, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\LiveSearcher.dll 7:11:26 PM Tuesday, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Loader.d1ll 7:11:34 PM Tuesda y, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Processor.dll 7:11:52 PM Tue sday, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\libcurl.dll 7:11:22 PM Tuesd ay, April 18, 2017 7.45.0.0 C:\Windows\system32\WLDAP32.d11 3:24:07 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Program Files\AccessData\Evidence Processing Engine\10.16\libtextcat.dll 7:11:24 PM Tu esday, April 18, 2017 10.16.1.9 EFTA00281101

--=PAGE_BREAK=--

C:\Program Files\AccessData\Evidence Processing Engine\10.16\entity_extraction.dll 7:11:0 6 PM Tuesday, April 18, 2017 2.0.0.2 C:\Program Files\AccessData\Evidence Processing Engine\10.16\dna-decryption.dll 7:11:02 P M Tuesday, April 18, 2017 2.0.0.2 C:\Program Files\AccessData\Evidence Processing Engine\10.16\dna-id.dll 7:11:06 PM Tuesda y, April 18, 2017 2.0.0.2 C:\Program Files\AccessData\Evidence Processing Engine\10.16\PhotoDNA.dll 7:11:34 PM Tues day, April 18, 2017 4.3.1.2 C:\Windows\WinSxS\amd64_microsoft .windows.gdiplus_6595b64144ccfldf_1.1.7601.17825_none_2b253c8 271ec7765\gdiplus.dll 5:16:47 AM Saturday, April 21, 2012 6.1.7601.17825 C:\Windows\system32\CONCRT140.d11 4:06:54 AM Friday, August 26, 2016 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\leveldb.dll 7:11:20 PM Tuesd ay, April 18, 2017 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_iostreams-—vc140-mt-1_59.dll 7:10:52 PM Tuesday, April 18, 2017 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\topic_model.dll 7:11:52 PM T uesday, April 18, 2017 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADG.nKFFClient10.dll 7:10:40 PM Tuesday, April 18, 2017 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\AgentRightsMgt .dll 7:10:44 P M Tuesday, April 18, 2017 6.2.0.1026 C:\Windows\system32\ACTIVEDS.dll 1:40:00 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\adsldpe.dll 1:40:00 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\ATL.DLL 1:40:03 AM Tuesday, July 14, 2009 3.5.2284.0 20190708 153430.055 (ProcessorBase.cpp:391): [6592,} CaseID: 40 20190708 153430.055 (ProcessorBase.cpp:392): [6592,] JobID: 432£5009857c4ca0b21lef84f36£691c1 20190708 153430.055 (ProcessorBase.cpp:393): [6592,}) CasePath: Y¥:\Epstein\FTK\Epstein - DVDs 20190708 153430.055 (ProcessorBase.cpp:394]: [6592,) DB system: Postgres 20190708 153430.055 (ProcessorBase.cpp:395]: [6592,) DB username: ADG6x2 20190708 153430.055 (ProcessorBase.cpp:396]: [6592,) DB integrated security: 0 20190708 153430.055 (ProcessorBase.cpp:397]: [6592,] DB host: WORKSTATION-AES 20190708 153430.055 (ProcessorBase.cpp:398]: [6592,]) DB port: 5432 20190708 153430.055 (ProcessorBase.cpp:399]: [6592,]) DB sid: ADG 20190708 153430.055 (ProcessorBase.cpp:400]: [6592,) FTK username: aespivack 20190708 153430.055 (ProcessorBase.cpp:401]: [6592,) Size limit: 0 20190708 153430.055 (ProcessorBase.cpp:402]: [6592,] Count limit: 0 20190708 153430.055 (ProcessorBase.cpp:441): [6592,]) Working list path: D:\adtemp\432f£5009857c4ca0 b21lef84£36f691c1.0.Indexer.WORKSTATION-AES 20190708 153430.633 (index_args.cpp:163): [6592,] index_args: num_idx_threads == 20190708 153430.633 (index_args.cpp:235): [6592,] index_args: Mem Cap == 512 MB 20190708 153430.633 {index_args.cpp:250): [6592,] index_args: Set max memory to 128 MB per thread 20190708 153430.633 (index_args.cpp:275): [6592,] Setting auto commit interval == 256 20190708 153430.633 {index_args.cpp:292): [6592,] Setting approx_max_idx_size == 500 20190708 153430.679 {Indexer.cpp:106]: [6592,] Setting number of indexing threads to 4 20190708 153430.679 {IndexerImpl.cpp:318]: [4848] Indexing has started. 20190708 153430.679 (DataProxy.cpp:272): (4848) DBThreadPool max threads: 12 20190708 153430.679 (DataProxy.cpp:275]): (4848) DBThreadCountBulkOperations max threads: 6 20190708 153430.695 (Indexer.cpp:80): Indexer::SetNumThreads: Setting # of threads to 4. Note thi s may not actually affect the # of indexer threads. 20190708 153431.210 I (6912) dtSearch index temporarily being put into ‘D:\adtemp\I_Workstation-AES_ 432£5009857c4ca0b2lef 84 £36£691c1-5696\dts\40\6912-20190708T193431" 20190708 153431.210 I (4916) dtSearch index temporarily being put into ’D:\adtemp\I_Workstation-AES_ 432£5009857c4ca0b21lef84£36£691c1-5696\dts\40\4916-20190708T193431" 20190708 153431.210 I (7136) dtSearch index temporarily being put into ’D:\adtemp\I_Workstation-AES_ 432£5009857c4ca0b21lef84£36£691c1-5696\dts\40\7136-20190708T193431" 20190708 153431.210 I (6892) dtSearch index temporarily being put into ’D:\adtemp\I_Workstation-AES_ 432£5009857c4ca0b21lef84£36£691c1-5696\dts\40\6892-20190708T193431" 20190708 153431.272 I [(ProcessorBase.cpp:787): [6896,ef7?6b7a7a4ee94 fefa76532cbaecbaa2300) _workerCou nt:1 _minQueueLen:4 _queueMultiplier:2 WorkQueueSize:0 20190708 153431.272 I [(ProcessorBase.cpp:787): [6896,ef7?6b7a7a4ee94 fefa76532cbaecbaa2300)] Handles: 5 78 Threads: 30 Read operations: 102 Read bytes: 1315066 Write operations: 360 Write bytes: 1224464 Other operations: 6944 Other bytes: 75141 Kernel time: 343 ms User time: 1513 ms Page fault count: 205606 Peak working set: 340860928 Working set: 300998656 Peak pagefile usage: 271065088 Pagefile usage: 222486528 Private bytes: 222486528 HHHHH HHH HHH HH HHHHHHHH HH 20190708 153432.224 I (4848) The thread names: 6248 is ‘logger processor’. EFTA00281102

--=PAGE_BREAK=--

20190708 20190708 ns: 0 20190708 4848 6352 4916 6912 7136 6892 is is is is is 153432. 153432. 153432. ‘IndexerImpl: rexecute()’. ’ IndexesMoveThread: :operator() ()’. ’ IndexingThread: :operator()()’. ’ IndexingThread: :operator()()’. *IndexingThread:: s ‘IndexingThread:: 302 302 395 I I I operator ()()’. operator()()’. (ProcObjectRetrieverImpl.cpp:112]: (ProcObjectRetrieverImpl.cpp:117]: (ProcObjectRetrieverImpl.cpp:152]: [5232] ProcObjectRetriever Read: 78,1 [5232] ProcObjectRetriever Read CustomColum [5232] ProcObjectretriever GetStream/Attrs: 94,1 20190708 20190708 20190708 153432.395 I [ObjectQueueThread.cpp: 56] 153432.395 I (ObjectQueueThread.cpp: 88] 153433.269 I (4848) The thread names: 6248 is ‘logger processor’. 4848 is ‘IndexerImpl::execute()’. 6352 is ‘IndexesMoveThread: :operator() ()'. 4916 is ‘IndexingThread::operator()()’. 6912 is ‘IndexingThread::operator()()’. 7136 is ‘IndexingThread::operator()()’. 6892 is ‘IndexingThread::operator()()’. 5232 is ‘ObjectQueueThread: :operator() ()’. 2972 is ‘ObjectQueueThread::operator() ()‘. 5868 is ‘ObjectQueueThread::operator() ()’. (5232) (5232) Index Get Proc Objects: 177ms Index Push Queue Mutex Lock: 177ms 20190708 20190708 ns: 0 20190708 47,17 20190708 20190708 20190708 20190708 ns: 0 20190708 0,4 20190708 20190708 20190708 20190708 ns: 0 20190708 0,1 20190708 20190708 20190708 20190708 ns: 0 20190708 0,4 20190708 20190708 20190708 20190708 ns: 0 20190708 0,4 20190708 20190708 20190708 20190708 ns: 0 20190708 0,1 20190708 20190708 20190708 20190708 ns: 0 20190708 0,1 20190708 20190708 20190708 20190708 ns: 0 20190708 0,1 20190708 153433. 153433. 153434. 153434. 153434. 153434. 153434. 153434. 153434. 153434. 153434. 153434. 153434. 153434. 153434. 273 273 153440 153440 153440 153440. 153440. 153440. 153440. 153440. 153440. 153440. 153440. .273 153440 153440 153440 153440 153456. 153456. 153456. 153542. 153542. 153542. 153542. 971 971 018 018 018 018 018 018 018 018 018 018 018 018 018 273 273 273 273 273 273 273 273 273 .273 ~273 273 153456. 153456. 794 794 794 794 794 954 954 954 954 I I I (ProcObjectRetrieverImpl.cpp:112)]: (ProcObjectRetrieverImpl.cpp:117): (ProcObjectRetrieverImpl.cpp:152]: (Object QueueThread.cpp:56): [5232] (Object QueueThread.cpp:88): [5232] (ProcObjectRetrieverImpl.cpp:112): (ProcObjectRetrieverImpl.cpp:117]: (ProcObjectRetrieverImpl.cpp:152]: (Object QueueThread.cpp:56]: [5232] (Object QueueThread.cpp:88)]: [5232] (ProcObjectRetrieverImpl.cpp:112)]: (ProcObjectRetrieverImpl.cpp:117): (ProcObjectRetrieverImpl.cpp:152): (Object QueuveThread.cpp:56): [5232] (Object QueveThread.cpp:88): [5232] (ProcObjectRetrieverImpl.cpp:112): (ProcObjectRetrieverImpl.cpp:117): (ProcObjectRetrieverImpl.cpp:152): (Object QueuvueThread.cpp:56): [5232] (Object QueueThread.cpp:88): [5232] (ProcObjectRetrieverImpl.cpp:112): (ProcObjectRetrieverImpl.cpp:117]: (ProcObjectRetrieverImpl.cpp:152]: (Object QueueThread.cpp:56): [5232] (Object QueueThread.cpp:88): [5232] (ProcObjectRetrieverImpl.cpp:112]: (ProcObjectRetrieverImpl.cpp:117): (ProcObjectRetrieverImpl.cpp:152): (Object QueueThread.cpp:56]: [5232] (Object QueueThread.cpp:88): [5232] (ProcObjectRetrieverImpl.cpp:112): (ProcObjectRetrieverImpl.cpp:117): (ProcObjectRetrieverImpl.cpp:152): (Object QueveThread.cpp:56): [2972] (Object QueuveThread.cpp:88): [2972] (ProcObjectRetrieverImpl.cpp:112]: (ProcObjectRetrieverImpl.cpp:117): (ProcObjectRetrieverImpl.cpp:152): (Object QueueThread.cpp:56): [5232] (5232] (5232] ProcObjectRetriever Read: 0,17 ProcObjectRetriever Read CustomColum [5232] ProcObjectretriever GetStream/Attrs: Index Get Proc Objects: 5ims Index Push Queue Mutex Lock: 51lms [5232] ProcObjectRetriever Read: 0,4 [5232] ProcObjectRetriever Read CustomColum [5232] ProcObjectretriever GetStream/Attrs: Index Get Proc Objects: 6ms Index Push Queue Mutex Lock: 6ms [5232] ProcObjectRetriever Read: 0,1 [5232] ProcObjectRetriever Read CustomColum (5232] ProcObjectretriever GetStream/Attrs: Index Get Proc Objects: 3ms Index Push Queue Mutex Lock: 3ms [5232] ProcObjectRetriever Read: 0,4 [5232] ProcObjectRetriever Read CustomColum [5232] ProcObjectretriever GetStream/Attrs: Index Get Proc Objects: 5ms Index Push Queue Mutex Lock: 5ms [5232] ProcObjectRetriever Read: 0,4 [5232] ProcObjectRetriever Read CustomColum [5232] ProcObjectretriever GetStream/Attrs: Index Get Proc Objects: 4ms Index Push Queue Mutex Lock: 4ms [5232] ProcObjectRetriever Read: 0,1 [5232] ProcObjectRetriever Read CustomColum [5232] ProcObjectretriever GetStream/Attrs: Index Get Proc Objects: 3ms Index Push Queue Mutex Lock: 3ms [2972] ProcObjectRetriever Read: 15,1 [2972] ProcObjectRetriever Read CustomColum [2972] ProcObjectretriever GetStream/Attrs: Index Get Proc Objects: 27ms Index Push Queue Mutex Lock: 27ms [5232] ProcObjectRetriever Read: 16,1 [5232] ProcObjectRetriever Read CustomColum [5232] ProcObjectretriever GetStream/Attrs: 23ms Index Get Proc Objects: EFTA00281103

--=PAGE_BREAK=--

20190708 153542.954 (ObjectQueuveThread.cpp:88): [5232] Index Push Queue Mutex Lock: 23ms 20190708 153546.074 (ProcObjectRetrieverImpl.cpp:112]: [5232] ProcObjectRetriever Read: 0,1 20190708 153546.074 (ProcObjectRetrieverImpl.cpp:117]): [5232] ProcObjectRetriever Read CustomColum ns: 0 20190708 153546.074 (ProcObjectRetrieverImpl.cpp:152): [5232] ProcObjectretriever GetStream/Attrs: 0,1 20190708 153546.074 (Object QueueThread.cpp:56)]: [5232] Index Get Proc Objects: 4ms 20190708 153546.074 (Object QueueThread.cpp:88]: [5232] Index Push Queue Mutex Lock: 4ms 20190708 153551.331 (ProcObjectRetrieverImpl.cpp:112]: [5232] ProcObjectRetriever Read: 0,1 20190708 153551.331 (ProcObjectRetrieverImpl.cpp:117]: [5232] ProcObjectRetriever Read CustomColum ns: 0 20190708 153551.331 (ProcObjectRetrieverImpl.cpp:152]: [5232] ProcObjectretriever GetStream/Attrs: 0,1 20190708 153551.331 I [(ObjectQueueThread.cpp:56]: [5232] Index Get Proc Objects: 4ms 20190708 153551.331 I (ObjectQueueThread.cpp:88): [5232] Index Push Queue Mutex Lock: 4ms 20190708 153757.177 I (ProcObjectRetrieverImpl.cpp:288]: [6352] ProcObjectretriever UpdateIndexedSta tus: 109,1 20190708 153757.286 I [ProcObjectRetrieverImpl.cpp:303): [6352] ProcObjectretriever BulkInsertOrUpda teDtSearchDocIDs: 16,27 20190708 153757.286 I (6352) The temporary index ’D:\adtemp\I_Workstation-AES_432£5009857c4ca0b21lef8s 4£36£691c1-5696\dts\40\6892-20190708T193431' was successfully moved to ’Y¥:\Epstein\FTK\Epstein - DVD s\dts_idx\1’ as part of the final case index. 20190708 153802.808 I [(ProcObjectRetrieverImpl.cpp:288]: [6352] ProcObjectretriever UpdateIndexedSta tus: 0,23 20190708 153802.918 I [ProcObjectRetrieverImpl.cpp:303]: [6352] ProcObjectretriever BulkInsertOrUpda teDtSearchDocIDs: 15,49 20190708 153802.918 I (6352) The temporary index ‘’D:\adtemp\I_Workstation-AES_432f£5009857c4ca0b21lef8 4£36£691c1-5696\dts\40\6912-20190708T193431' was successfully moved to ’¥:\Epstein\FTK\Epstein - DVD s\dts_idx\2’ as part of the final case index. 20190708 153817.597 I [ProcObjectRetrieverImpl.cpp:288]: [6352] ProcObjectretriever UpdateIndexedSta tus: 31,5 20190708 153817.691 I [ProcObjectRetrieverImpl.cpp:303]: [6352] ProcObjectretriever BulkInsertOrUpda teDtSearchDocIDs: 15,31 20190708 153817.691 I (6352) The temporary index ‘’D:\adtemp\I_Workstation-AES_432£5009857c4ca0b21lef8 4£36£691c1-5696\dts\40\7136-20190708T193431' was successfully moved to ’Y¥:\Epstein\FTK\Epstein - DVD s\dts_idx\3’ as part of the final case index. 20190708 154003.521 I [(ProcObjectRetrieverImpl.cpp:288]: [6352] ProcObjectretriever UpdateIndexedSta tus: 32,7 20190708 154003.693 I [(ProcObjectRetrieverImpl.cpp:303]: [6352] ProcObjectretriever BulkInsertOrUpda teDtSearchDocIDs: 15,59 20190708 154003.693 I (6352) The temporary index ‘’D:\adtemp\I_Workstation-AES_432£5009857c4ca0b21lef8& 4£36£691c1-5696\dts\40\4916-20190708T193431' was successfully moved to ’¥:\Epstein\FTK\Epstein - DVD s\dts_idx\4’ as part of the final case index. 20190708 154003.709 I [IndexerImpl.cpp:607)]: [4848] Indexing has finished. 20190708 154003.709 I logger processor (6248) thread cpu accrued time: 0:00:00.015600 (15600 microse es). Wall clock transpired time: 0:05:34.012186 (334012186 microsecs). 20190708 154003.709 I IndexerImpl::execute() (4848) thread cpu accrued time: 0:00:00.000000 (0 micro secs). Wall clock transpired time: 0:05:33.029385 (333029385 microsecs). 20190708 154003.709 I IndexesMoveThread::operator()() (6352) thread cpu accrued time: 0:00:00.686404 (686404 microsecs). Wall clock transpired time: 0:05:32.498984 (332498984 microsecs). 20190708 154003.709 I IndexingThread::operator()() (4916) thread cpu accrued time: 0:01:18.031700 (7 8031700 microsecs). Wall clock transpired time: 0:05:29.566178 (329566178 microsecs). 20190708 154003.709 I IndexingThread::operator()() (6912) thread cpu accrued time: 0:00:40.170257 (4 0170257 microsecs). Wall clock transpired time: 0:03:30.116769 (210116769 microsecs). 20190708 154003.709 I IndexingThread::operator()() (7136) thread cpu accrued time: 0:00:39.312252 (3 9312252 microsecs). Wall clock transpired time: 0:03:45.014795 (225014795 microsecs). 20190708 154003.709 I IndexingThread::operator()() (6892) thread cpu accrued time: 0:00:38.438646 (3 8438646 microsecs). Wall clock transpired time: 0:03:24.344759 (204344759 microsecs). 20190708 154003.709 I ObjectQueueThread::operator()() (5232) thread cpu accrued time: 0:00:00.031200 (31200 microsecs). Wall clock transpired time: 0:02:07.655024 (127655024 microsecs). 20190708 154003.709 I ObjectQueueThread::operator()() (2972) thread cpu accrued time: 0:00:00.000000 (OQ microsecs). Wall clock transpired time: 0:02:07.499024 (127499024 microsecs). 20190708 154003.709 I ObjectQueueThread::operator()() (5868) thread cpu accrued time: 0:00:00.000000 (0 microsecs). Wall clock transpired time: 0:02:07.998224 (127998224 microsecs). 20190708 154003.709 I total of above threads’ cpu accrued times: 0:03:16.686060 (196686060 microsecs ). 20190708 154003.709: process 5696 cpu accrued time: 0:03:18.667273 (198667273 microsecs). Wall cloc k transpired time: 0:05:34.729788 (334729788 microsecs). EFTA00281104