20190708 153425.781 I [ProcessorBase.cpp:105): System: 20190708 153425.781 I [(ProcessorBase.cpp:131): CPU: AMD64 12 processors 64bit RAM: 51537072128 Granularity: 65536 Pagesize: 4096 20190708 153425.781 I [ProcessorBase.cpp:133): Environment: Variables: AFX43_DMC_TBLPATH=C: \Program Files\AccessData\Forensic Toolkit\4.0\bin\XSL-Formatter\base2;C:\ Program Files\AccessData\Forensic Toolkit\5.3\bin\xSL-Formatter\base2;C:\Program Files\AccessData\Fo rensic Toolkit\6.2\bin\XSL-Formatter\base2 AFX43_FONT_CONFIGFILE=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\xSL-Formatter\bin\f ont.config.xml;C:\Program Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin\font.config.xm 1;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\xXSL-Formatter\bin\font.config.xml AFX43_HOME=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\xXSL-Formatter\bin;C:\Program F iles\AccessData\Forensic Toolkit\5.3\bin\xSL-Formatter\bin;C:\Program Files\AccessData\Forensic Tool kit\6.2\bin\XSL-Formatter\bin AFX43_HYPDIC_PATH=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\XSL-Formatter\hyphenati on;C:\Program Files\AccessData\Forensic Toolkit\5.3\bin\xSL-Formatter\hyphenation;C:\Program Files\A ecessData\Forensic Toolkit\6.2\bin\XSL-Formatter\hyphenation AFX43_LIC_PATH=C:\Program Files\AccessData\Forensic Toolkit\4.0\bin\xSL-Formatter\bin;C:\Progr am Files\AccessData\Forensic Toolkit\5.3\bin\XSL-Formatter\bin;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin ALLUSERSPROFILE=C: \ProgramData APPDATA=C: \Users\aespivack \AppData\Roaming CommonProgramFiles=C:\Program Files\Common Files CommonProgramFiles (x86)=C:\Program Files (x86)\Common Files CommonProgramW6432=C:\Program Files\Common Files COMPUTERNAME=WORKSTATION-AES ComSpec=C: \Windows\system32\cmd.exe DEFAULT_CA_NR=CA100 FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Users\aespivack LOCALAPPDATA=C: \Users \aespivack\AppData\Local LOGONSERVER=\ \WORKSTATION-AES MOZ_PLUGIN_PATH=C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ NUMBER_OF_PROCESSORS=12 OPENSSL_CONF=C: \Users \AESPIV~1\AppData\Local\Temp\ {A48A84F7-BB48-4046-8BCE-40CD742C 9BB4}\\open ssl.cfg OS=Windows_NT Path=o: \oracle\product\10.2.0\client_1\bin;0: \Oracle\Product\10.2.0\AccessDataDB\bin;C: \Window s\system32; C:\Windows; C:\Windows \System32\Wbem; C: \Windows\System32\WindowsPowerShell\v1.0\;C:\Progra m Files\AccessData\Forensic Toolkit\4.0\bin\xSL-Formatter\bin;C:\Program Files\AccessData\Forensic T oolkit\5.3\bin\xSL-Formatter\bin;C:\Program Files (x86)\Common Files\Teleca Shared;C:\Program Files\ nodejs\;C:\Program Files\AccessData\Forensic Toolkit\6.2\bin\XSL-Formatter\bin;C:\Program Files (x86 )\Common Files\Apple\Apple Application Support;C:\Program Files (x86)\Common Files\Apple\Mobile Devi ce Support;C:\Program Files\Common Files\Apple\Apple Application Support;C:\Program Files\Common Fil es\Apple\Mobile Device Support;C:\Program Files (x86)\Microsoft SDKs\TypeScript\1.0\;C:\Users\aespiv ack\AppData\Roaming\npm PATHEXT=.COM; .EXE; .BAT; .CMD; .VBS; .VBE; .JS; .JSE; .WSF; .WSH; .MSC PROCESSOR_ARCHITECTURE=AMD64 PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 44 Stepping 2, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=2c02 ProgramData=C: \ProgramData ProgramFiles=C:\Program Files ProgramFiles(x86)=C:\Program Files (x86) ProgramW6432=C:\Program Files PSModulePath=C: \Windows\system32\WindowsPowerShell\v1.0\Modules\ PUBLIC=C: \Users\Public SESSIONNAME=Console SystemDrive=C: SystemRoot=C: \Windows TEMP=D: \adtemp TMP=D: \adtemp USERDOMAIN=Workstation-AES USERNAME=aespivack USERPROFILE=C: \Users\aespivack VBOX_MSI_INSTALL_PATH=C: \Program Files\Oracle\VirtualBox\ windir=C: \Windows windows_tracing_flags=3 windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log ___COMPAT_LAYER=RunAsAdmin DisableUserCallbackException Modules: C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADProcessor.exe 7:12:26 PM T uesday, April 18, 2017 10.16.1.9 C:\Windows\SYSTEM32\ntdll.dll 6:41:18 AM Thursday, November 17, 2011 6.1.7601.17725 C: \Windows\SYSTEM32\MSCOREE .DLL 3:23:48 AM Sunday, November 21, 2010 4.0.40305.0 C:\Windows\system32\KERNEL32.d11 5:37:12 AM Saturday, July 16, 2011 6.1.7601.17651 EFTA00281118

--=PAGE_BREAK=--

C:\Windows\system32\KERNELBASE.d1l1 5:37:12 AM Saturday, July 16, 2011 6.1.7601.17651 C:\Windows\system32\apphelp.dll 3:24:03 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\AppPatch\AppPatch64\AcGenral.DLL 1:40:00 AM Tuesday, July 14, 2009 6.1.7600 16385 C:\Windows\system32\Sspicli.dll 6:35:26 AM Thursday, November 17, 2011 6.1.7601.17725 C:\Windows\system32\msvert.dll 8:46:06 AM Friday, December 16, 2011 7.0.7601.17744 C:\Windows\system32\RPCRT4.dll 3:24:02 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\SHLWAPI.d1ll 3:24:22 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\GDI32.dl1l 3:24:03 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\USER32.dl1 3:24:09 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\LPK.d1l1 1:41:19 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\USP10.dl1l 3:24:08 AM Sunday, November 21, 2010 1.626.7601.17514 C:\Windows\system32\ole32.dll 3:23:48 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\SHELL32.dll 5:43:10 AM Saturday, June 09, 2012 6.1.7601.17859 C:\Windows\system32\sfc.dll 1:33:06 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\sfc_os.DLL 1:41:54 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\USERENV.d1ll 3:24:03 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\profapi.dll 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\dwmapi.dll 1:40:34 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\ADVAPI32.dl1l 1:40:01 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\SYSTEM32\sechost .dll 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\MPR.d1l1 1:41:26 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\IMM32.DLL 1:41:09 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\MSCTF.dll 1:41:28 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\Microsoft .NET\Framework64\v4.0.30319\mscoreei.dll 12:34:06 AM Friday, November 06, 2015 4.6.1055.0 C:\Windows\system32\VERSION.d1ll 1:41:56 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\Microsoft .NET\Framework64\v4.0.30319\clr.dll 12:34:06 AM Friday, November 06, 2015 4.6.1055.0 C:\Windows\system32\MSVCR120_CLRO400.d11 2:09:00 PM Thursday, October 22, 2015 12.0.52 512.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ fa8eef6f6cb67c660d71lel5c5cad71b5\mscor lib.ni.dll 3:42:42 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\system32\CRYPTBASE.d1l 1:40:24 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\uxtheme.d1ll 1:41:56 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\CRYPTSP.d1ll 1:40:24 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\rsaenh.dll 1:43:15 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\RpcRtRemote.dll 3:24:01 AM Sunday, November 21, 2010 6.1.7601.1751 4 C:\Windows\Microsoft .NET\Framework64\v4.0.30319\clrjit.dll 12:34:06 AM Friday, November 0 6, 2015 4.6.1055.0 C:\Windows\system32\OLEAUT32.d11 5:37:49 AM Saturday, August 27, 2011 6.1.7601.17676 C:\Windows\assembly\NativeImages_v4.0.30319_64\System\5f£665a4076cb8d9479ca4d06e7827£b9F\System. ni.dll 3:42:49 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\1751687825177cb487cl080d7e37401£F \System.Drawing.ni.dll 4:09:48 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\a359814ff0333ca2c4ab29f30f 55dd20\System.Windows.Forms.ni.dll 4:09:57 PM Monday, July 02, 2018 4.6.1055.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADLogger.dll 7:10:38 PM Tues day, April 18, 2017 6.2.0.400 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ad_log.dll 7:10:36 PM Tuesda y, April 18, 2017 6.2.0.400 C:\Windows\system32\MSVCP140.d11 4:06:54 AM Friday, August 26, 2016 14.0.24215.1 C:\Windows\system32\VCRUNTIME140.d11 4:06:54 AM Friday, August 26, 2016 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-runtime-11-1-0.d1l1 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ucrtbase.DLL 4:45:24 PM Wedn esday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms—win-core-timezone-11-1-0.d ll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-file-12-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-localization-11-2 -O.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-synch-11-2-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-core-processthreads-11 -1-1.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms—win-core-file-11-2-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-string-1l1l-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-heap-11-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-stdio-1l1-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-convert-11-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-locale-11-1-0.dll EFTA00281119

--=PAGE_BREAK=--

4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms—-win-crt-math-11-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-multibyte-11-1-0.d 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-time-11-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-filesystem-11-1-0. dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-environment-11-1-0 .dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-utility-1l1-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_date_time-vc140-mt-1_59.dl1l 7:10:52 PM Tuesday, April 18, 2017 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_thread-vcel40-mt-1_59.dll 7:10:52 PM Tuesday, April 18, 2017 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_system-vcl40-mt-1_59.dll 7:10:52 PM Tuesday, April 18, 2017 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_chrono-vc140-mt-1_59.dll 7:10:48 PM Tuesday, April 18, 2017 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\PLIsupportManaged.dll 7:11:3 6 PM Tuesday, April 18, 2017 10.16.1.9 C:\Windows\Microsoft .NET\Framework64\v4.0.30319\nlssorting.dll 12:34:06 AM Friday, Novemb er 06, 2015 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\5034a88e58 £966dd7d69fe9b9875832c\Sy stem.Core.ni.dll 3:51:31 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\46ec60579b59cedec8c39cabca 6d1153\System.Configuration.ni.dll 3:51:33 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System. Xm1\c9576235d85a3db7 1la0bee45aa4155ba\Sys tem.Xml.ni.dll 3:51:23 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\system32\ws2_32.dll 3:24:28 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\NSI.d1l1 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\mswsock.dll 3:24:00 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\System32\wshtcpip.dll 1:41:58 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\System32\wship6.dll 1:41:58 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\NLAapi.dll 3:23:54 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\system32\napinsp.dll 1:41:52 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\pnrpnsp.dll 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\DNSAPI.dll 6:24:15 AM Thursday, March 03, 2011 6.1.7601.17570 C:\Windows\System32\winrnr.dll 1:41:56 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\wshbth.dll 3:24:36 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Windows\assembly\NativeImages_v4.0.30319_64\System. ServiceModel\ac14548e7a731da59e036d17baB e3c06\System.ServiceModel.ni.dll 4:11:13 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System. Servdidec626#\7a5Sb7af88001106023a3e276d8 fbe359\System. ServiceModel.Internals.ni.dll 4:10:39 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\SMDiagnostics\c329a07 fa3cb821400eb59734c1a04d8\ SMDiagnostics.ni.dll 4:10:02 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\assembly\NativeImages_v4.0.30319_64\System. Runteb92aal2#\ec3ea73175791bd1e5d2031d28 31e641\System.Runtime.Serialization.ni.dll 4:10:38 PM Monday, July 02, 2018 4.6.1055.0 C:\Windows\system32\pcwum.DLL 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Program Files\AccessData\Evidence Processing Engine\10.16\PLIsupport.dll 7:11:34 PM Tu esday, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Altova.dll 7:10:44 PM Tuesda y, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\AltovaxML.dll 7:10:46 PM Tue sday, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\processing_options.dll Till: 36 PM Tuesday, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\epshared.dll 7:11:06 PM Tues day, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\dtengine64.dll 9:58:02 PM Th ursday, August 04, 2016 7.73.8140.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\icuuc57.dll 7:11:18 PM Tuesd ay, April 18, 2017 57.1.0.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\icudt57.dll 7:11:22 PM Tuesd ay, April 18, 2017 57.1.0.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\icuin57.dll 7:11:16 PM Tuesd ay, April 18, 2017 57.1.0.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\adshattrdefs.dll 7:12:26 PM Tuesday, April 18, 2017 2.0.0.22 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_filesystem-vcl40-mt-1_59.dl 1 7:10:52 PM Tuesday, April 18, 2017 2.0.0.22 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Database.dll 7:11:00 PM Tues day, April 18, 2017 6.2.0.1026 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ad_globals.dll 7:10:34 PM Tu esday, April 18, 2017 6.2.0.479 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Database.Definition.Wrapper.dll 7:10:56 PM Tuesday, April 18, 2017 6.2.0.1026 EFTA00281120

--=PAGE_BREAK=--

C:\Program Files\AccessData\Evidence Processing Engine\10.16\DALWrapper.d1ll 7:10:52 PM Tu esday, April 18, 2017 6.2.0.1026 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Retrieval.dll 7:11:52 PM Tue sday, April 18, 2017 6.2.0.1026 C:\Windows\system32\WININET.d1ll 8:04:24 PM Wednesday, September 26, 2012 9.0.8112.1645 0 C:\Windows\system32\Normaliz.dll 1:31:40 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\iertutil.dll 8:04:24 PM Wednesday, September 26, 2012 9.0.8112.164 50 C:\Windows\system32\urlmon.dll 8:04:24 PM Wednesday, September 26, 2012 9.0.8112.16450 C:\Program Files\AccessData\Evidence Processing Engine\10.16\LIBEAY32.d1l1 7:13:00 PM Tues day, April 18, 2017 1.0.1.16 C:\Program Files\AccessData\Evidence Processing Engine\10.16\api-ms-win-crt-conio-11-1-0.dll 4:45:24 PM Wednesday, November 02, 2016 10.0.14393.33 C:\Program Files\AccessData\Evidence Processing Engine\10.16\v2client.dll 7:11:52 PM Tues day, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\socketcomm.dll 7:11:50 PM Tu esday, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\fipscomm.dll 7:11:10 PM Tues day, April 18, 2017 4.1.3.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\eshared.dll 7:11:06 PM Tuesd ay, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\SSLEAY32.d11 7:13:24 PM Tues day, April 18, 2017 1.0.1.16 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_regex-vel40-mt-1_59.dll 7:10:52 PM Tuesday, April 18, 2017 1.0.1.16 C:\Program Files\AccessData\Evidence Processing Engine\10.16\adtz_globals.dll 7:10:40 PM Tuesday, April 18, 2017 2016.4.0.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\adfs_globals.dll 7:10:40 PM Tuesday, April 18, 2017 6.2.0.479 C:\Program Files\AccessData\Evidence Processing Engine\10.16\agent_globals.dll 7:10:42 PM Tuesday, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\abstractclient.dll 7:10:40 P M Tuesday, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\agentfs.dll 7:10:42 PM Tuesd ay, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ProxyComm.dll 7:11:44 PM Tue sday, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\filtering_lib.dll 7:11:16 PM Tuesday, April 18, 2017 6.2.0.473 C:\Windows\system32\PSAPI.DLL 1:41:53 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADIsoDLL.dll 7:12:22 PM Tues day, April 18, 2017 6.2.0.479 C:\Program Files\AccessData\Evidence Processing Engine\10.16\FTKComm.dll 7:11:08 PM Tuesd ay, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\v2proxyclient.dll 7:11:52 PM Tuesday, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\eremote.dll 7:11:06 PM Tuesd ay, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\netfslib.dll 7:11:30 PM Tues day, April 18, 2017 6.2.0.473 C:\Program Files\AccessData\Evidence Processing Engine\10.16\libbfio.dll 7:11:22 PM Tuesd ay, April 18, 2017 1.0.0.0 C:\Program Files\AccessData\Evidence Processing Engine\10.16\libvshadow.d1ll 7:11:24 PM Tu esday, April 18, 2017 1.0.0.0 C:\Windows\system32\mfc140u.dll 4:02:10 AM Friday, July 22, 2016 14.0.24213.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\DataAccessWrapper.dll 7:10:5 2 PM Tuesday, April 18, 2017 6.2.0.1026 C:\Program Files\AccessData\Evidence Processing Engine\10.16\duplicate_text_analysis.dll 7:11:06 PM Tuesday, April 18, 2017 2.0.0.2 C:\Windows\system32\VCOMP140.DLL 4:06:54 AM Friday, August 26, 2016 14.0.24215.1 C:\Windows\system32\ESENT.dll 3:24:00 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Program Files\AccessData\Evidence Processing Engine\10.16\summary.dll 7:11:50 PM Tuesd ay, April 18, 2017 6.1.7601.17514 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Exporter.dll 7:11:12 PM Tues day, April 18, 2017 6.1.7601.17514 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Indexer.dll 7:11:20 PM Tuesd ay, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\LiveSearcher.dll 7:11:26 PM Tuesday, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Loader.d1ll 7:11:34 PM Tuesda y, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\Processor.dll 7:11:52 PM Tue sday, April 18, 2017 10.16.1.9 C:\Program Files\AccessData\Evidence Processing Engine\10.16\libcurl.dll 7:11:22 PM Tuesd ay, April 18, 2017 7.45.0.0 C:\Windows\system32\WLDAP32.d11 3:24:07 AM Sunday, November 21, 2010 6.1.7601.17514 C:\Program Files\AccessData\Evidence Processing Engine\10.16\libtextcat.dll 7:11:24 PM Tu esday, April 18, 2017 10.16.1.9 EFTA00281121

--=PAGE_BREAK=--

C:\Program Files\AccessData\Evidence Processing Engine\10.16\entity_extraction.dll 7:11:0 6 PM Tuesday, April 18, 2017 2.0.0.2 C:\Program Files\AccessData\Evidence Processing Engine\10.16\dna-decryption.dll 7:11:02 P M Tuesday, April 18, 2017 2.0.0.2 C:\Program Files\AccessData\Evidence Processing Engine\10.16\dna-id.dll 7:11:06 PM Tuesda y, April 18, 2017 2.0.0.2 C:\Program Files\AccessData\Evidence Processing Engine\10.16\PhotoDNA.dll 7:11:34 PM Tues day, April 18, 2017 4.3.1.2 C:\Windows\WinSxS\amd64_microsoft .windows.gdiplus_6595b64144ccfldf_1.1.7601.17825_none_2b253c8 271ec7765\gdiplus.dll 5:16:47 AM Saturday, April 21, 2012 6.1.7601.17825 C:\Windows\system32\CONCRT140.d11 4:06:54 AM Friday, August 26, 2016 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\leveldb.dll 7:11:20 PM Tuesd ay, April 18, 2017 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\boost_iostreams-—vc140-mt-1_59.dll 7:10:52 PM Tuesday, April 18, 2017 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\topic_model.dll 7:11:52 PM T uesday, April 18, 2017 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\ADG.nKFFClient10.dll 7:10:40 PM Tuesday, April 18, 2017 14.0.24215.1 C:\Program Files\AccessData\Evidence Processing Engine\10.16\AgentRightsMgt .dll 7:10:44 P M Tuesday, April 18, 2017 6.2.0.1026 C:\Windows\system32\ACTIVEDS.dll 1:40:00 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\adsldpe.dll 1:40:00 AM Tuesday, July 14, 2009 6.1.7600.16385 C:\Windows\system32\ATL.DLL 1:40:03 AM Tuesday, July 14, 2009 3.5.2284.0 20190708 153425.796 (ProcessorBase.cpp:391): [6476,}) CaseID: 40 20190708 153425.796 (ProcessorBase.cpp:392): [6476,) JobID: 55b5alc7?3ad24fed8af8e3020a5ca5e8 20190708 153425.796 (ProcessorBase.cpp:393]: [6476,) CasePath: Y:\Epstein\FTK\Epstein - DVDs 20190708 153425.796 (ProcessorBase.cpp:394]: [6476,) DB system: Postgres 20190708 153425.796 (ProcessorBase.cpp:395]: [6476,) DB username: ADG6x2 20190708 153425.796 (ProcessorBase.cpp:396]: [6476,) DB integrated security: 0 20190708 153425.796 (ProcessorBase.cpp:397]: [6476,] DB host: WORKSTATION-AES 20190708 153425.796 (ProcessorBase.cpp:398]: [6476,) DB port: 5432 20190708 153425.796 (ProcessorBase.cpp:399]: [6476,]) DB sid: ADG 20190708 153425.796 (ProcessorBase.cpp:400]: [6476,) FTK username: aespivack 20190708 153425.796 (ProcessorBase.cpp:401]: [6476,) Size limit: 104857600 20190708 153425.796 (ProcessorBase.cpp:402): [6476,] Count limit: 300 20190708 153425.796 (ProcessorBase.cpp:441]: [6476,]) Working list path: D:\adtemp\55b5alc7?3ad24fed Saf 8e3020a5ca5e8.0.Processor.WORKSTATION-AES 20190708 153427.138 I [ProcessorBase.cpp:665]): ProcessorBase: : SetNumThreads (6) 20190708 153427.497 I [(ProcessorBase.cpp:787): _workerCount:0 _minQueueLen:8 _queueMultiplier:2 Work QueuveSize:0 20190708 153427.497 I [ProcessorBase.cpp:787): Handles: 435 Threads: 24 Read operations: 80 Read bytes: 525880 Write operations: 8 Write bytes: 1004 Other operations: 4874 Other bytes: 30218 Kernel time: 296 ms User time: 1544 ms Page fault count: 201338 Peak working set: 249061376 Working set: 204337152 Peak pagefile usage: 272232448 Pagefile usage: 213286912 Private bytes: 213286912 HHHHH HHH HHH HH 20190708 153429.712 I [DataProxy.cpp:272]: [7892,c0230912aclbf42019aTefd2746eladeb00) DBThreadPool m ax threads: 12 20190708 153429.712 I [DataProxy.cpp:275]: [7892,c0230912aclbf42019aTefd2746eladeb00) DBThreadCountB ulkOperations max threads: 6 20190708 153430.336 I [Processor.cpp:258): [6672,c48115a8640f94badbee55fef2644£90400) Read 1: 22 Read 2: 0 Update 1: 158 Update 2: 0 Retrieval: 16 Processing 1: 26,1,26 Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 0,1,0 Identify: 0,1,0 PostIdentifyRefinement: 0,1,0 PhotoDna: 0,0,0 Thumbnail: 0,0,0 Hashing: 0,1,0 EFTA00281122

--=PAGE_BREAK=--

Hashing 2: 0,1,0 FBFS Detection: 20,1,20 oleStreamRefinement: 0,1,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,1,0 Parse Email Field: 0,1,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: 0,0,0 generateNativeSWF: 0,0,0 generateGraphic: 0,0,0 generateGraphicSwF: 0,0,0 generateRedactedText: 0,0,0 languageIdentification: 0,0,0 duplicate_text_feature_extraction: 0,0,0 Jami: 0,1,0 Browser History: 0,1,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 20190708 153430.336 I [Processor.cpp:258): Read 2: 0 Update 1: 161 Update 2: 0 Retrieval: 89 Processing 1: 23,1,23 Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 0,1,0 Identify: 0,1,0 PostIdentifyRefinement: 0,1,0 PhotoDna: 0,0,0 Thumbnail: 0,0,0 Hashing: 0,1,0 Hashing 2: 0,1,0 FBFS Detection: 20,1,20 oleStreamRefinement: 0,1,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 ectpLookup: 0,0,0 LTU Porn Scoring: 0,1,0 Parse Email Field: 0,1,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: 0,0,0 generateNativeswF: 0,0,0 generateGraphic: 0,0,0 generateGraphicSwF: 0,0,0 generateRedactedText: 0,0,0 languageIdentification: 0,0,0 duplicate_text_feature_extraction: 0,0,0 Jami: 0,1,0 Browser History: 0,1,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 20190708 153433.472 I [Processor.cpp:258): Read 2: 0 Update 1: 26 Update 2: 0 Retrieval: 0 Processing 1: 3073,2,1536.5 Processing 2: 0,0,0 AdditionalItemReporting: 0 (7892,c0230912aclbf£42019aTefd2746ela0eb00) Read 1: 51 (7892, c01819d5ebc4e42238£58c5956112216200) Read 1: 27 EFTA00281123

--=PAGE_BREAK=--

KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 2,2,1 Identify: 2973,2,1486.5 PostIdentifyRefinement: 0,2,0 PhotoDna: 0,0,0 Thumbnail: 0,0,0 Hashing: 83,2,41.5 Hashing 2: 0,2,0 FBFS Detection: 10,2,5 oleStreamRefinement: 0,2,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,2,0 Parse Email Field: 0,2,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: generateNativesSwWF: 0, generateGraphic: 0,0, generateGraphicSwFr: 0,0,0 generateRedactedText: 0,0,0 languageIdentification: 0,0,0 duplicate_text_feature_extraction: 0,0,0 Jami: 0,2,0 Browser History: 0,2,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 10 0,0 0,0 0 , 20190708 153433.534 I [Processor.cpp:258): [7892,cd2f£9da2cbbf24447b8e8c4aBab5fde5200) Read 1: 32 Read 2: 0 Update 1: 24 Update 2: 0 Retrieval: 0 Processing 1: 0,1,0 Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 0,1,0 Identify: 0,1,0 PostIdentifyRefinement: 0,1,0 PhotoDna: 0,0,0 Thumbnail: 0,0,0 Hashing: 0,1,0 Hashing 2: 0,1,0 FBFS Detection: 0,1,0 oleStreamRefinement: 0,1,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,1,0 Parse Email Field: 0,1,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: 0,0,0 generateNativeswWF: 0,0,0 generateGraphic: 0,0,0 generateGraphicSwF: 0,0,0 generateRedactedText: 0,0,0 languageIdentification: 0,0,0 duplicate_text_feature_extraction: 0,0,0 Jaml: 0,1,0 Browser History: 0,1,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 EFTA00281124

--=PAGE_BREAK=--

20190708 153433.550 I [Processor.cpp:258): [(6064,c1a90618873ca419ea04£99e1c828675200) Read 1: 93 Read 2: 0 Update 1: 19 Update 2: 0 Retrieval: 89 Processing 1: 3366,2,1683 Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 0,2,0 Identify: 3092,2,1546 PostIdentifyRefinement: 0,2,0 PhotoDna: 0,0,0 Thumbnail: 0,0,0 Hashing: 249,2,124.5 Hashing 2: 0,2,0 FBFS Detection: 19,2,9.5 oleStreamRefinement: 0,2,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,2,0 Parse Email Field: 0,2,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: generateNativeswF: 0, generateGraphic: 0,0, generateGraphicsSwF: 0 generateRedactedText: languageIdentification: duplicate_text_feature_e Jami: 0,2,0 Browser History: 0,2,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 70 0,0 0,0 0 0,0 0,0,0 0,0,0 xtraction: 0,0,0 20190708 153433.924 I [Processor.cpp:258): [6856,c22£1a254842e44659aal190ac923c086200) Read 1: 49 Read 2: 0 Update 1: 24 Update 2: 0 Retrieval: 103 Processing 1: 3694,19,194.421 Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 2,19,0.105263 Identify: 3446,19,181.368 PostIdentifyRefinement: 0,19,0 PhotoDna: 0,0,0 Thumbnail: 0,0,0 Hashing: 148,19,7.78947 Hashing 2: 0,19,0 FBFS Detection: 44,19,2.31579 oleStreamRefinement: 0,19,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,19,0 Parse Email Field: 0,19,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: 0,0,0 generateNativeswWF: 0,0,0 EFTA00281125

--=PAGE_BREAK=--

generateGraphic: 0,0,0 generateGraphicSwr: 0,0,0 generateRedactedText: 0,0,0 languageIdentification: 0,0,0 duplicate_text_feature_extraction: 0,0,0 Jami: 0,19,0 Browser History: 0,19,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 20190708 153434.283 I [Processor.cpp:258]: Read 2: 0 Update 1: 22 Update 2: 0 Retrieval: 0 Processing 1: 299,1,299 Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 0,1,0 Identify: 270,1,270 PostIdentifyRefinement: 0,1,0 PhotoDna: 0,0,0 Thumbnail: 0,0,0 Hashing: 24,1,24 Hashing 2: 0,1,0 FBFS Detection: 2,1,2 oleStreamRefinement: 0,1,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,1,0 Parse Email Field: 0,1,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: generateNativesSWF: 0, generateGraphic: 0,0, generateGraphicSwF: 0,0,0 generateRedactedText: 0,0,0 languageIdentification: 0,0,0 duplicate_text_feature_extraction: 0,0,0 Jaml: 0,1,0 Browser History: 0,1,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 a) 0,0 0,0 0 , 20190708 153434.829 I [Processor.cpp:258]: Read 2: 0 Update 1: 20 Update 2: 0 Retrieval: 107 Processing 1: 4623,5,924.6 Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 0,5,0 Identify: 3440,5, 688 PostIdentifyRefinement: 0,5,0 PhotoDna: 0,0,0 Thumbnail: 0,0,0 Hashing: 1160,5,232 Hashing 2: 0,5,0 FBFS Detection: 11,5,2.2 oleStreamRefinement: 0,5,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,5,0 (6856, cef51d4da67234a8db59bc5b47£76dc6b00) Read 1: 23 (3052, c2968bab7ef244039aae435aeNdfbcf4d00) Read 1: 43 EFTA00281126

--=PAGE_BREAK=--

Parse Email Field: 0,5,0 OcR: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: 0,0,0 generateNativeswWF: 0,0,0 generateGraphic: 0,0,0 generateGraphicSwF: 0,0,0 generateRedactedText: 0,0,0 languageIdentification: 0,0,0 duplicate_text_feature_extraction: 0,0,0 Jami: 0,5,0 Browser History: 0,5,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 20190708 153603.733 I [(ProcessorBase.cpp:665): ProcessorBase::SetNumThreads (12) 20190708 153635.558 I [(Processor.cpp:258): [6672,c775ff£9abfb7£4a0bb332a95029£2480600) Read 1: 24 Read 2: 0 Update 1: 53 Update 2: 0 Retrieval: 0 Processing 1: 125133,1,125133 Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 0,1,0 Identify: 3951,1,3951 PostIdentifyRefinement: 0,1,0 PhotoDna: 0,0,0 Thumbnail: 243,1,243 Hashing: 120937,1,120937 Hashing 2: 0,1,0 FBFS Detection: 0,1,0 oleStreamRefinement: 0,1,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,1,0 Parse Email Field: 0,1,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTIF: generateNativeswWF: 0 generateGraphic: 0,0 generateGraphicSwF: generateRedactedText: languageIdentification: duplicate_text_feature_e tion: 0,0,0 Jami: 0,1,0 Browser History: 0,1,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 20190708 153636.556 I [(Processor.cpp:258]: [7008,c73fclfeb359848ad8ee75c57cd9d50b200) Read 1: 34 Read 2: 0 Update 1: 19 Update 2: 0 Retrieval: 87 Processing 1: 126371,1,126371 Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 0,1,0 Identify: 3278,1,3278 PostIdentifyRefinement: 0,1,0 PhotoDna: 0,0,0 EFTA00281127

--=PAGE_BREAK=--

Thumbnail: 239,1,239 Hashing: 122838,1,122838 Hashing 2: 0,1,0 FBFS Detection: 6,1,6 oleStreamRefinement: 0,1,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,1,0 Parse Email Field: 0,1,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: 0,0,0 generateNativesSwWF: 0,0,0 generateGraphic: 0,0,0 generateGraphicSwF: 0,0,0 generateRedactedText: 0,0,0 languageIdentification: 0,0,0 duplicate_text_feature_extraction: 0,0,0 Jamil: 0,1,0 Browser History: 0,1,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 20190708 153636.650 I [Processor.cpp:258): Read 2: 0 Update 1: 19 Update 2: 0 Retrieval: 0 Processing 1: 123064,1,123064 Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 0,1,0 Identify: 1309,1,1309 PostIdentifyRefinement: 0,1,0 PhotoDna: 0,0,0 Thumbnail: 228,1,228 Hashing: 121523,1,121523 Hashing 2: 0,1,0 FBFS Detection: 0,1,0 oleStreamRefinement: 0,1,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,1,0 Parse Email Field: 0,1,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: generateNativesSWF: 0, generateGraphic: 0,0, generateGraphicsSwF: 0 generateRedactedText: languageIdentification: duplicate_text_feature_e Jami: 0,1,0 Browser History: 0,1,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 70 0,0 0,0 i) 0,0 0,0,0 0,0,0 xtraction: 0,0,0 20190708 153636.728 I [(Processor.cpp:258): Read 2: 0 Update 1: 18 Update 2: 0 Retrieval: 0 Processing 1: 123138,1,123138 (7892, cd5e93e26e98b4edda3d5dabe038700ba00) Read 1: 23 (6064, ce03031bc05184cda8fel2f195fledcc500) Read 1: 22 EFTA00281128

--=PAGE_BREAK=--

Processing 2: 0,0,0 AdditionalItemReporting: 0 KFF Lookup: 0 Carving: 0,0,0 Metacarving: 0,0,0 SlackEnumeration: 0,1,0 Identify: 1307,1,1307 PostIdentifyRefinement: 0,1,0 PhotoDna: 0,0,0 Thumbnail: 227,1,227 Hashing: 121601,1,121601 Hashing 2: 0,1,0 FBFS Detection: 1,1,1 oleStreamRefinement: 0,1,0 storeKeyFiles: 0,1,0 createPDFs: 0,0,0 createHTML: 0,0,0 etpLookup: 0,0,0 LTU Porn Scoring: 0,1,0 Parse Email Field: 0,1,0 ocr: 0,0,0 generatedItemReporting: 0,0,0 clearStream: 0,0,0 saveNativeStream: 0,0,0 saveEmailBody: 0,0,0 generateMSG: 0,0,0 generateCoolHTMLRTF: 0,0,0 generateNativeswF: 0,0,0 generateGraphic: 0,0,0 generateGraphicSwFr: 0,0,0 generateRedactedText: 0,0,0 languageIdentification: 0,0,0 duplicate_text_feature_extraction: 0,0,0 Jami: 0,1,0 Browser History: 0,1,0 EntityExtraction: 0,0,0 scrapeEmailSignatures: 0,0,0 20190708 153639.255 I [PostProcessing.cpp:55): [7008, fdb2abec7T3efe4578bbefcfdf828e281f00) Post-Proce ssing: DeleteRefinedOutItems took: 94ms 20190708 153640.035 I [PostProcessing.cpp:628]: [7008, fdb2abec7?3efe4578bbefcfdf828e281f00) Post-Proc essing: Update geolocation data took: 780ms 20190708 153642.110 I [PostProcessing.cpp:600]: [7008, fdb2abec7?3efe4578bbefcfdf828e281f00) Post-Proc essing: RestoreObjectConstraints took: 2075ms 20190708 153642.125 I [PostProcessing.cpp:203]: [7008, fdb2abec?3efe4578bbefcfdf828e281f00) Post-Proc essing: RelocateEudoraAttachments took: 15ms 20190708 153642.125 I [PostProcessing.cpp:81)]: [7008, fdb2abec73efe4578bbefcfdf828e281f00) Post-Proce ssing: RestoreConstraintsAndIndexes took: Oms 20190708 153642.266 I [(PostProcessing.cpp:161]: (7008, fdb2abec73efe4578bbefcfd£828e281f00) Post-Proc essing: Create Bitmap Indexes took: 141ms 20190708 153642.546 I [PostProcessing.cpp:267]: (7008, fdb2abec73efe4578bbefcfd£828e281f00) Post-Proc essing: Materialize Views took: 280ms 20190708 153642.593 I [PostProcessing.cpp:491]: [7008, fdb2abec?3efe4578bbefcfdf828e281F00) Post-Proc essing: GatherSchemaStats took: 47ms 20190708 153642.609 I [(PostProcessing.cpp:532]: [7008, fdb2abec?3efe4578bbefcfdf828e281£00) Post-Proc essing: Setting DB took: léms 20190708 153642.609 I [PostProcessing.cpp:565]: [7008, fdb2abec?3efe4578bbefcfdf828e281f00) Post-Proc essing: Log Job Completion took: Oms 20190708 153643.233 I [ProcessorBase.cpp:665]): ProcessorBase: :SetNumThreads (0) 20190708 153643.638 I logger processor (6448) thread cpu accrued time: 0:00:00.000000 (0 microsecs). Wall clock transpired time: 0:02:18.200642 (138200642 microsecs). 20190708 153643.638 I total of above threads’ cpu accrued times: 0:00:00.000000 (0 microsecs). 20190708 153643.638: process 1368 cpu accrued time: 0:00:25.630964 (25630964 microsecs). Wall clock transpired time: 0:02:18.918244 (138918244 microsecs) . EFTA00281129