[sleuthkit-users] Autopsy Case Management Gripes

[Brian C. <ca...@sl...>]

I'm looking for input and suggestions.   TSK v2 now supports disk 
images, split images, and will soon support other formats.  It also 
autodetects the file system and partition types (I really should have 
done that a long time ago).  Now I need to redo the case management 
part of autopsy to work these features in.  While I am at it, I want to 
know what people hate about the case management or any suggestions that 
people have to make it better.

The new basic design will be that you give the path to the 
disk/partition image and Autopsy will identify the image type and what 
file systems are in a disk image.  You can change the settings and add 
a known MD5 and then the image will be imported.   You will also be 
able to manually define the locations of partitions.

I am planning on having a "recent" list on the front page that allows 
you to bypass the Case and Host opening.

Any ideas, suggestions, or opinions?

brian