Re: [sleuthkit-users] Keyword Searching for three letter term results in Please Wait
Brought to you by:
carrier
Menu
▾
▴
Re: [sleuthkit-users] Keyword Searching for three letter term results in Please Wait
|
From: MATT P. <mat...@ad...> - 2014-04-17 21:25:29
|
It is an ongoing litigation so I'm being careful with the context. I used Robocopy to extract all the document types and preserve file locations. The extracted files were then entered into the Case. I am rerunning the keyword ingest process. Say my Keyword list was: FDA Federal Drug Administration I'm using normal search and I'm using the basic three letters no punctuation. I can search on the last three elements via the keyword search bar with no issues. The first generates the Please Wait. I reran ingest using my keyword list and the FDA keyword did not create a Single Literal Keyword Search entry. I added the keyword /^fda$/as a search term and reran ingest with it flaged as regex. Here is the Keyword Indexing Result Files with known types 1883 Files with general strings extracted 76 Metadata only was indexed 561 Error (indexer) 0 Error (text extraction) 0 Error (I/O) 0 I do not see a Keyword Snipit option in Options/Keyword Seach. From: Jason Letourneau [mailto:jle...@ba...] Sent: Thursday, April 17, 2014 9:46 AM To: MATT PIERCE Cc: sle...@li... Subject: Re: [sleuthkit-users] Keyword Searching for three letter term results in Please Wait Hi Matt - It's tough to know precisely based on the information we have, but have you tried adding your search term as part of a keyword list and re-running ingest? If you have logs ( Help > About > Userdir:) that you can share, that would help us see if something is throwing an error. Another thing I notice is that in searching for acronyms with periods at the end of them, the trailing period is ignored in the actual hits. For instance, Ms. will return matches for any occurrence of ms, likewise, m.s. will match occurrences for "m.s" - I am not sure if either of these help with your particular issue, but it could be that you have more hits than you expect based on this and loading is taking more time than expected as highlighting the keyword hits and showing a preview turns out to be a somewhat intensive process. Jason ------------------------------------------------ Jason Letourneau Product Manager, Digital Forensics Basis Technology jle...@ba...<mailto:jle...@ba...> 617-386-2000 ext. 152 On Apr 17, 2014, at 9:35 AM, MATT PIERCE <mat...@ad...<mailto:mat...@ad...>> wrote: I'm sorry to repost but I was hoping someone could explain why my keyword search didn't progress. From: MATT PIERCE Sent: Monday, April 14, 2014 4:15 PM To: sle...@li...<mailto:sle...@li...> Subject: Keyword Searching for three letter term results in Please Wait I'm running Autopsy 3.0.9. I have imported two directories worth of extracted files from a workstation under ediscovery. I can run various keyword searches and get appropriate responses. When I search for a three letter acronym relevant to the case I get "Please Wait" the search never returns from that state. Does anyone have any guidance? ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/NeoTech_______________________________________________ sleuthkit-users mailing list https://lists.sourceforge.net/lists/listinfo/sleuthkit-users http://www.sleuthkit.org |
