[ERROR] [engine.sleuthkit.SleuthkitClientInputStream] MemoryReadTimeout - emlx:DECOMP

[danieuuul]

Error in several files while processing a image of a macbook obtained using Digital Collector (AFF4 -> E01). IPED didn't abort, just reported the error in the prompt.

"2025-03-18 11:38:42 [ERROR] [engine.sleuthkit.SleuthkitClientInputStream] MemoryReadTimeout waiting SleuthkitServer 1: /img_MAC_image.E01/APFS Pool/vol_vol4/Users/XXXXXX/Library/Mail/V10/0B3DB49A-54AE-475C-AC1B-3AB7B50A571C/INBOX.mbox/8836A31E-B8FB-47C9-B4D6-A4C7A044F2F3/Data/1/Messages/1053.emlx:DECOMP"

[lfcnassif]

Hi @danieuuul. On what OS you were running IPED? Could you share the full processing log?

This shouldn't occur, it is released to a memory consistency check in inter process communication... As a workaround, you can disable robustImageReading into conf/FileSystemConfig.txt, processing will be slower, but this issue won't happen.

[lfcnassif]

And please share the full log.

[danieuuul]

It was on Windows 10 Pro. I'm sending you the full log and one exemple of "hs_err_pidXXX.log" generated by JVM.

[lfcnassif]

After talking to @danieuuul and analyzing the Java core dump log, it is a bug in sleuthkit native library, causing the image reader process to crash. The robust "delegate image reading to another process" approach used by IPED worked, isolated the problem and its main process didn't crash. The bug should be reported and fixed in sleuthkit library, there is nothing we could do here beyond the explained workaround. So I'm closing this as won't fix.