000012865 - After upgrading to RSA NetWitness Investigator 9.8.5.20  session reconstruction does not correctly display MD5 file hashes

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000012865
Applies ToRSA NetWitness NextGen
RSA NetWitness Investigator
RSA NetWitness Investigator 9.8.5.20
IssueAfter upgrading to RSA NetWitness Investigator 9.8.5.20, session reconstruction does not correctly display MD5 file hashes.

After upgrading to Windows client RSA NetWitness Investigator Enterprise Edition (EE) v9.8.5.20, session reconstruction is displaying the MD5 hash of all files as 00000000000000000000000000000000.

CauseA bug was introduced into RSA NetWitness Investigator v9.8.5.20 which will be resolved in future versions of Investigator.
ResolutionThe workaround is to downgrade to a lower version of Investigator such as v9.8.5.19 until a new version of RSA NetWitness Investigator is released.
Legacy Article IDa67854

Attachments

    Outcomes