Overview
When a file in a cloud service is updated, moved, or shared, Incydr calculates the hash value for the file. However, in some cases, Incydr is unable to obtain the hash. This article lists possible error messages and explains why files can't be hashed.
Hash error messages
The following error messages appear in the MD5 hash or SHA256 hash fields in Forensic Search file results.
| Error message | Description |
|---|---|
| Hash unavailable. File not modified since initial inventory. | After you authorize Incydr to connect to your cloud service, Incydr inventories your cloud service environment to discover the drives and files it contains. To speed up this initial inventory process, files are not hashed. Instead, hash values are calculated for files when they are involved in new file activity. |
| Hash unavailable. Google file type. | Native Google files, such as Google Docs, Sheets, and Slides files, generally only contain a reference to the data located on Google's platform. Because these files function largely as containers to fetch and display that data, these files undergo constant change and cannot be hashed. |
| Hash unavailable. Malware detected by OneDrive. | Microsoft OneDrive has identified the file as malware. As such, Incydr does not access it to calculate its hash value. |
| Hash unavailable. File size is too large. | The file is too large to be efficiently hashed. To enhance performance, Incydr does not calculate hash values for files over 3 GB. |
| Hash unavailable. Locked file. | The file is locked. As such, Incydr cannot access it to calculate its hash value. |
| Hash unavailable. File owner is outside your organization. | When a file is shared with someone in your organization by an external user, Incydr is often unable to access it and thus cannot calculate its hash value. |
|
Hash unavailable. <Type> file type.
(<Type> lists a specific package type, such as "OneNote" or "Unknown") |
Some software programs (OneNote, for example) package information into larger containers rather than creating individual files for that data. Incydr does not calculate the hash value for such package files. |
| Hash unavailable. Folders cannot be hashed. | Because Incydr prioritizes monitoring file activity over folder activity, hashes are not calculated for folders or directories. |
| Hash unavailable. File modified during hash calculation. |
Files that are modified while Incydr is in the process of calculating the hash do not display a hash value. |
| Hash unavailable. Encrypted file. |
Hash values are not calculated for encrypted files, including password-protected zip files. |
Comments
0 comments
Please sign in to leave a comment.