[sleuthkit-users] What if a module fails to initialize

[Brian C. <ca...@sl...>]

There was an error reported last week that the Keyword Search module failed to initialize.  We're reviewing how that situation was handled and we have two options.  We're looking for feedback.  The scenario is that the user has selected the ingest modules that they want to run on the data source.  One of the modules fails to initialize (we have a model where each module is initialized, it then runs on the entire disk or set of files, and then is closed). What should we do when a module does not initialize (for the sake of example, let's say it was a hash calculation module). 

1) We log the error, notify the user with a message, and continue to run the modules that did initialize. In our current example, a challenge is that the later modules in the pipeline may be depending on that module's output. For example, the  hash lookup module will need the  hash value so that it can use its hash databases.   This approach requires the user to then decide to cancel and restart (which may result in duplicate data).

2) We halt the pipeline and no data is analyzed unless all modules could initialize.  The user is notified and can either fix the problem or remove the module from the pipeline so that it can continue.

Preferences?    

brian