Re: [sleuthkit-users] Autopsy Survey: Directory Contents Count

[Grundy B. J T. <Bar...@ti...>]

I say leave them in (vote to include).  One of the original strengths of TSK/Autopsy is that the tools themselves simply show the data without showing/hiding things for sake of "false clarity".  If an examiner cannot look at the count and the contents of the directory and figure out the relationship...well then.

I still lament the inclusion of "ifind -p" functionality in "fls -d" for NTFS file systems for that very reason...  ;-)


/*******************************************
Barry J. Grundy
Assistant Special Agent in Charge
Digital Forensic Support Group  
Electronic Crimes and Intelligence Division
Treasury Inspector General for Tax Administration
(301) 210-8741 (w)
(202) 527-5778 (c)
Bar...@ti...
********************************************\


> -----Original Message-----
> From: Brian Carrier [mailto:ca...@sl...]
> Sent: Thursday, December 05, 2013 5:51 PM
> To: sle...@li... users
> Subject: [sleuthkit-users] Autopsy Survey: Directory Contents Count
> 
> Currently, the tree on the left of Autopsy shows the number of items in the
> directory.  If there is a "." or ".." entry in the directory, they are included in
> the count.  In our last training course, someone suggested that we should
> not include those entries in the number so that a directory with no files or
> sub-folders shows up as "0" in the tree except "2".   I'm a bit torn on this one
> because they are in fact entries in the database and some could also get
> confused that there are more rows in the table than what was reported.
> 
> Thoughts? Do you want the number in the tree to include the "." and ".." or
> not?
> 
> brian
> 
> 
> ------------------------------------------------------------------------------
> Sponsored by Intel(R) XDK
> Develop, test and display web and hybrid apps with a single code base.
> Download it for free now!
> http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.cl
> ktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org