Re: [sleuthkit-users] Autopsy Users / Version

[Richard C. <rco...@ba...>]

Tags in general are intended to allow a user to flag files or results of
interest. Tags have names (e.g., Bookmark) so that  files or results can be
classified into different categories. Bookmark is actually just a
predefined tag. So it's not Bookmark vs. tag - Bookmark is a tag.

In addition to the ability to only include items with particular tags in
reports, you can also see what items fall under what tags in the tree view
on the left hand side of the main Autopsy window. This allows you to select
a group of items with the same tag and view them in the table and thumbnail
views to the right of the tree view.

The UI for tags is definitely cumbersome. We already have a "story" in our
internal issue tracking system at Basis Technology about making tagging
more streamlined.

The idea of having columns with check boxes in the table view is
interesting. I think we would have difficulty scaling this up though. Let's
say a user defines ten tags. A column for each tag would crowd out the
actual data being displayed. This is not purely hypothetical; I know of at
least one use case which requires five tags to do what the user needs to do
with tagging.

Richard Cordovano
Basis Technology



On Sun, Nov 16, 2014 at 10:48 PM, Billy Pronovost <bg...@gm...> wrote:

> Hello TSK users... I had a question and a comment/suggestion.
>
> What is the intended purpose of Bookmark and Tag (or versus)?
>
> I get that Bookmarking is putting the item into the Report, but what about
> Tag?
>
> For me, it seems like it should be just "tagging" and item, but I know that
> Bookmarking is a common term for forensic programs.
>
> Whatever the term is going to be, I really wish there was just a column
> with a check box for this action. It is ridiculous to have to go through a
> secondary click menu when this is one of the most common functions of an
> investigation (marking an item for a report).
>
> What are the chances people agree with me and we could see a feature like
> this in the next version?
>
> Thanks for your time.
>
> Billy
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>