The issue seems to be caused by records in the sys_attachment table that have the wrong table associated with them. In our case this is because we have created a child table of the incident table and the attachments point to the parent 'incident' table instead of the child table.
Here is a script that you can run as a background script to analyse the sys_attachment table (be careful when running this in a production environment as there may be a massive amount of records in that table!):
var tableName = 'incident';
var grAttachment = new GlideRecord('sys_attachment');
grAttachment.addQuery('table_name', tableName);
grAttachment.query();
while (grAttachment.next()) {
var recordSysID = grAttachment.getValue('table_sys_id');
var grIncident = new GlideRecord('incident');
if (grIncident.get(recordSysID)) {
var incidentClass = grIncident.getValue('sys_class_name');
if (incidentClass != tableName) {
gs.print(gs.getMessage('File "{0}" [{1}] attached to {2} "{3}"', [
grAttachment.getValue('file_name'),
grAttachment.getUniqueValue(),
incidentClass,
grIncident.getValue('number')
]));
}
}
else {
gs.print(gs.getMessage('File "{0}" [{1}] no longer attached to {2} with sys_id={3}', [
grAttachment.getValue('file_name'),
grAttachment.getUniqueValue(),
tableName,
recordSysID
]));
}
}
