Troubleshooting

16.1 Browser Not Launching

Possible causes:

• Missing browser executable.
• Installation incomplete.
• Insufficient permissions.
• Antivirus blocking execution.
• Corrupt configuration.
• Unsupported operating system.

Recommended actions:

1. Restart Eviquire.
2. Confirm installation path.
3. Check application logs.
4. Confirm license status.
5. Run a test acquisition.
6. Contact support if the browser process exits immediately.

16.1.1 File Attachments or Detail Fields Not Visible

If a case file or integrity field is not visible, first confirm that the correct case is selected and inspect the right-side CASE DETAILS panel. Case attachments are administered in EDIT CASE → FILES, while acquired evidence appears in the lower EVIDENCE list. Scroll the right pane when its content exceeds the window height, and ensure the window is large enough to display the relevant fields. The exact icons may vary with the installed maintenance build.

16.2 Capture Failed

Possible causes:

• Page changed during capture.
• Disk space exhausted.
• Browser rendering issue.
• Network connection failed.
• Script-heavy page did not stabilize.
• Full-page capture exceeded resources. Recommended actions:

1. Review chain-of-custody logs.
2. Check error messages.
3. Confirm disk space.
4. Try a smaller capture.
5. Capture screenshot and source separately.
6. Record the limitation in notes.

16.3 Downloads Missing

Possible causes:

• Download was blocked.
• File already existed and duplicate handling cancelled part of a workflow.
• Browser download did not complete.
• Target required authentication.
• Disk path was unavailable.

Recommended actions:

1. Review download events.
2. Check evidence Downloads folder.
3. Check browser/network logs.
4. Repeat download in a new acquisition if legally permitted.
5. Confirm file hash and size.

16.4 Hash Mismatch

Possible causes:

• File changed after initial hash.
• File was incomplete when first recorded.
• Manual alteration.
• Packaging issue.
• Filesystem or tool error.

Recommended actions:

1. Preserve the package as-is.
2. Review evidence hash list.
3. Compare database hash and packaging hash.
4. Check timestamps.
5. Review chain-of-custody entries.
6. Document findings.
7. Reacquire if necessary and permitted.

16.5 Network Capture Unavailable

Possible causes:

• TShark not installed.
• Capture driver missing.
• Insufficient permissions.
• Tool path incorrect.
• Endpoint protection blocked capture.

Recommended actions:

1. Install or repair Wireshark/TShark.
2. Confirm dumpcap availability.
3. Run Eviquire with required permissions if policy permits.
4. Validate with a test acquisition.
5. Disable network capture if not required.

16.6 License Issue

Possible causes:

• License expired.
• Offline activation not completed.
• Network validation unavailable.
• Incorrect key.
• Edition does not include requested feature.

Recommended actions:

1. Check license status.
2. Re-enter license key.
3. Confirm network access to licensing service.
4. Contact administrator.
5. Confirm edition entitlements.

16.7 Slow Performance

Possible causes:

• Large page.
• Full-page capture.
• Video recording.
• Network capture.
• Deep collection.
• Low RAM.
• Slow disk.
• Proxy or Tor latency.

Recommended actions:

1. Close unrelated applications.
2. Disable unnecessary options.
3. Use SSD storage.
4. Increase RAM.
5. Split capture into smaller acquisitions.
6. Avoid Tor unless required.

16.8 Large Case Exports

Possible causes:

• PCAP files.
• Video recordings.
• Browser profiles.
• Large downloads.
• Batch captures.
• Full-page screenshots.

Recommended actions:

1. Estimate size before export.
2. Use high-capacity storage.
3. Confirm free space is at least three times expected export size.
4. Use secure transfer designed for large files.
5. Preserve export hash.

16.9 Automatic Consent or Social Expansion Does Not Work

Cookie consent automation and social-media comment expansion depend on supported website structures. If a banner is not handled or comments fail to expand, first confirm the applicable option is enabled, whether the target changed layout, and what Chain of Custody recorded. Attempt an authorized manual action if permitted, or preserve the partially collected page with explanatory notes.

16.10 HAR, NetLog, or Cookie Records Are Missing

Review the acquisition details to confirm Application Network Acquisition (HAR), Chromium Network Audit (NetLog), or Advanced Cookies Collection was enabled. A setting may not create a substantial artifact if no eligible activity occurred. Check browser logs and finalization results before concluding that a collection failed.

16.11 Interrupted Pageshot or Recovery Operation

If capture ends early because of a timeout, target-page change, browser close, or cancelled operation, Eviquire is designed to preserve completed frames where possible. Verify the pageshot sequence and PDF against the captured scope. Preserve incomplete output, identify the stopping point, and make a new authorized acquisition when further collection is required.

16.12 Portable Startup, Video Playback, and Linux Permissions

For portable Windows operation, confirm full extraction, writable application folders, and endpoint-policy compatibility. For Ubuntu AppImage operation, confirm a compatible runtime with X11/XWayland. If packet capture is unavailable, check host TShark/dumpcap rather than the AppImage’s bundled multimedia tools. AV1/HEVC playback depends on the matching multimedia runtime; do not change the evidence files to make a viewer work.

16.13 Getting Technical Support

If a problem cannot be resolved by the procedures in this chapter, open the in-application Support option or contact [email protected]. The online help center is available at help.eviquire.com. Include sufficient detail to reproduce the behavior while protecting case information.

Prepare the following information, where relevant:

Eviquire build/version, operating system and edition or deployment type (Windows installed/portable, Ubuntu AppImage, macOS beta).

Affected function, expected result, actual result, reproducible steps and the exact on-screen error message.

Date and time of the incident, including the displayed time zone; acquisition and case identifiers only when authorized to disclose them.

Relevant redacted screenshots, harmless configuration details and diagnostic logs. Do not send license keys, passwords, tokens, cookies or TLS key logs. Whether the original evidence/archive remains intact and whether acquisition finalization or integrity verification reported a problem.

Evidence safety: Preserve original acquisition and case packages unchanged. Do not transmit sensitive evidence or diagnostic archives containing case data unless authorized and instructed to use an approved secure transfer method.