[sleuthkit-users] Autopsy Survey #2: Keyword Search Snippits

[Brian C. <ca...@sl...>]

Currently, Autopsy will display a "snippit" of each keyword search hit that shows the text around each keyword hit in the table view.  After debugging some reports that keyword searching was taking longer than expected, the snippit code is the culprit.   A search that has a couple of thousand hits can take 8 seconds from "enter" to a displayed list w/out snippits and 68 seconds with snippits.   Other users are seeing that their searches take minutes. 

We're obviously looking to see if we can still incorporate snippits in a more efficient manner, but I wanted to throw the question out there if the snippits were essential or not.  If we can't find a more efficient method, do people want to wait a minute (or several) to have the snippits or would you rather that we disable that feature?  We can obviously make this a user option, but we'll still need to know the default value based on what most people want.

Votes?

thanks,
brian