Re: [sleuthkit-users] Autopsy Survey #2: Keyword Search Snippits

[Lehr, J. <jl...@sl...>]

My vote is to keep snippets.  It is essential in weeding out 'false' hits.  User option to disable is handy when snippets are not essential, but I would prefer to see them by default.

---------------------------------
John Lehr
Evidence Technician
San Luis Obispo Police Department
________________________________________
From: Brian Carrier [ca...@sl...]
Sent: Friday, December 06, 2013 8:56
To: sle...@li... users
Subject: [sleuthkit-users] Autopsy Survey #2: Keyword Search Snippits

Currently, Autopsy will display a "snippit" of each keyword search hit that shows the text around each keyword hit in the table view.  After debugging some reports that keyword searching was taking longer than expected, the snippit code is the culprit.   A search that has a couple of thousand hits can take 8 seconds from "enter" to a displayed list w/out snippits and 68 seconds with snippits.   Other users are seeing that their searches take minutes.

We're obviously looking to see if we can still incorporate snippits in a more efficient manner, but I wanted to throw the question out there if the snippits were essential or not.  If we can't find a more efficient method, do people want to wait a minute (or several) to have the snippits or would you rather that we disable that feature?  We can obviously make this a user option, but we'll still need to know the default value based on what most people want.

Votes?

thanks,
brian




------------------------------------------------------------------------------
Sponsored by Intel(R) XDK
Develop, test and display web and hybrid apps with a single code base.
Download it for free now!
http://pubads.g.doubleclick.net/gampad/clk?id=111408631&iu=/4140/ostg.clktrk
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org