RE: [sleuthkit-users] Future of indexing in Autopsy and Sleuthkit

[Paul B. <ba...@fo...>]

Hi Matthew,

Thanks for your response.

> Paul, is it just me, or do I read that as alphanumeric only? I often=20
> need to search for instances of email addresses, and while it is not=20
> always mandatory, having access to the @ symbol sure does speed the=20
> process up.
I can understand your problem.... Please try to understand mine (As I =
see it). The problem with indexed searching is that you have to have a =
limited set of characters to search for. Otherwise it's not possible to =
generate an index file. The size of the index file grows exponentially =
with the size of the character set.

Therefore it might be possible to add some other characters like the =
diacrtitic ASCII characters and maybe an @ (BUt then other people want =
to have other characters too). Based on this it will probably be =
configurable in the final version.

Unicode is for me a NoNo.... Beacause of the sheer size of the set of =
characters contained therein.
If anyone can suggest a fix/solution I would greatly appreciate that!

I'm still thinking about a better solution.

You should remember though that there will always be Standard searching =
with regexp and all... Indexed searching is just to generate a speedup =
for the most commonly used search strings (Which in my opinion are the =
Alphanumeric and diacritic ASCII characters. PLEASE DEBATE WITH ME ON =
THIS!!!!!!!)

> >Issue 2:
> >Human readability of the files. A speedup in the indexed=20
> >searching process and a redeuction of the size of the used=20
>
> Not an issue in my opinion, in fact I agree with another post that=20
> mentioned making the file layout open, someone here will=20
> write a tool to=20
> read it.

I will do both. I will document the file format and provide a tool to
convert it to human readable format.

--
Paul Bakker

Fox-IT Experts in IT Security!
Haagweg 137=20
2281 AG RIJSWIJK=20
T 070 336 9999=20
F 070 336 9990=20
I www.fox-it.com=20
E ba...@fo...
57A6 C5EA 55E4 CC1C A967 B13C F8C0 C0FB 8135 E225

Disclaimer: This email may contain confidential information. If this =
message is not addressed to you, you may not retain or use the =
information in it for any purpose. If you have received it in error, =
please notify the sender and delete this message. We try to screen out =
viruses but take no responsibility if this email contains a virus.