Skip to content

Troubleshooting

LLIMAGERW and LLIMAGER Linux include diagnostics and error messaging to help identify issues during acquisition. Below are common scenarios and their resolutions.

App Blocked by Windows Defender SmartScreen

Windows may flag *LL**IMAGER-win***.exe as an unrecognized app since it runs portably from USB rather than through a signed installer.

Solution:

  1. When the SmartScreen prompt appears, click More info.
  2. Click Run anyway.

License File Errors

If LLIMAGERW reports a license error, or Home screen modules appear unexpectedly restricted:

Solution:

  1. Confirm llimager.lic is present in the same \llimager folder as *LL**IMAGER-win***.exe.
  2. Confirm your license type — see Licensing. Dead Box, Convert/Hash, Send to Cloud, and Verify & Anchor Images all require a Standard license.
  3. If you believe your license is incorrectly restricted, contact your e-Forensics account representative.

Imaging Fails Immediately

This usually occurs if the destination drive is not formatted correctly or lacks sufficient space.

Solution:

  • Space check: verify the destination has free space equal to the source's used space plus 10% — see Requirements.
  • Format check: exFAT is recommended for cross-platform compatibility.
  • Write protection: ensure any physical write-protect switch on your destination USB (if applicable) is in the "Off" position.

Dead Box: No Boot Device Menu Appears

If the target machine boots straight into Windows (or its installed OS) instead of showing a boot device selection menu:

Solution:

  1. Use LLIMAGERW's Boot Key Lookup / Boot Instructions tab to confirm the correct key for the machine's specific brand and model — this is a reference only and may not match every BIOS/UEFI revision.
  2. Restart and press the boot-menu key more quickly and repeatedly, immediately after power-on.
  3. If the boot menu still doesn't appear, Secure Boot may need to be temporarily disabled in the BIOS/UEFI settings first.

Reminder: always power off the target machine completely before attempting a dead-box boot — never hibernate. Hibernation writes a memory image to disk that can contaminate the acquisition.

Dead Box: Case Metadata Not Pre-Populated in LLIMAGER Linux

Currently, automatic hand-off of case metadata from llimager_deadbox.json to LLIMAGER Linux is not yet implemented end-to-end. If fields appear blank after boot, this is expected — manually re-enter case metadata inside LLIMAGER Linux. See Dead Box Imaging (Linux Boot).

T2-Equipped Intel Macs: Keyboard/Trackpad Not Working During Dead-Box Boot

This is a hardware limitation of the T2 security chip during external boot, not a software defect.

Solution: connect an external USB mouse (and keyboard, if needed) before booting.

Reduced Screen Coverage in the Live Linux Environment

On some hardware, the LLIMAGER Linux live environment may only use approximately 70% of the available screen, due to resolution detection limitations.

Cloud Upload Failures

If the image completes but the Send to Cloud upload fails:

  • Network: ensure the machine has an active internet connection.
  • Credentials: re-check your AWS/GCP/Azure keys. Even a single missing character in a Secret Key will cause an authentication failure.

Hash Mismatch During Verify & Anchor Images

If the E01 Verification result shows ✘ HASH MISMATCH, treat this as a potential integrity issue:

  1. Confirm you selected the correct/first segment of a split E01.
  2. Re-run verification to rule out a transient read error on the storage media.
  3. If the mismatch persists, document it in your chain-of-custody notes and escalate per your organization's evidence-handling procedures — do not assume the image is invalid without further investigation.

Collecting Diagnostic Logs

The LLIMAGER Linux live environment automatically mounts available USB drives and periodically copies diagnostic logs (start.log, Xorg.0.log, app.log, dmesg.log) to them. If you need to report an issue, include these logs.

FAQs

Frequently asked questions are available online at https://www.llimager.com/faq

Technical Support

If you encounter a specific error not listed here, please take a screenshot and send it along with your llimager.lic details to support@e-forensicsinc.com.

LLIMAGER and LLSmartVerify are trademarks of e-Forensics Inc. Miami, Florida, USA. The integrated forensic integrity framework, comprising the LLIMAGER acquisition sequence and the LLSmartVerify blockchain-anchored verification ecosystem, is U.S. Patent Pending (App No. 63/908,380)