Re: [sleuthkit-users] Autopsy Users / Version

[Billy P. <bg...@gm...>]

Simson,

This is an interesting concept. I am a Mac user, I do understand, but I
still don't use it. Mostly because I filter my stuff in folders already so
the Tag seems redundant.

I guess the only difference I would want to point out for Autopsy is that I
am looking for a quick way to "tag" an item and move on and that is why a
check box would be beneficial (because I can hit the space bar and tag the
item and move on with the arrow keys).

This method you described might be good for the next step of going back to
my tagged items section, and filtering the items by putting them into
categories. Your method would allow me to select multiple files at one time
and categorize them from an easy dropdown menu.  Also, having this dropdown
available in the evidence window would allow someone that didn't just want
to tag an item (like me) to select a file and tag/categorize it from here.
If someone does this, then the Checkbox should automatically be checked by
the system when a category is attached to a file.

Make sense?

Billy

On Mon, Nov 17, 2014 at 8:17 AM, Simson Garfinkel <si...@gm...> wrote:

> Richard,
>
> For a tag UI, you might look at how tags are implemented in MacOS 10.10.
> There's a "tag" button that brings up an interface that allows people to
> specify new tags or choose from an existing one:
>
>
> New tags are created by simply typing their names:
>
>
> Tags can then be listed whenever file names are shown:
>
>
> However, it is worth pointing out that the vast majority of OSX users do
> not understand about the tag feature and do not use it.
>
>
>
>
> On Nov 17, 2014, at 7:14 AM, Richard Cordovano <rco...@ba...>
> wrote:
>
> Tags in general are intended to allow a user to flag files or results of
> interest. Tags have names (e.g., Bookmark) so that  files or results can be
> classified into different categories. Bookmark is actually just a
> predefined tag. So it's not Bookmark vs. tag - Bookmark is a tag.
>
> In addition to the ability to only include items with particular tags in
> reports, you can also see what items fall under what tags in the tree view
> on the left hand side of the main Autopsy window. This allows you to select
> a group of items with the same tag and view them in the table and thumbnail
> views to the right of the tree view.
>
> The UI for tags is definitely cumbersome. We already have a "story" in our
> internal issue tracking system at Basis Technology about making tagging
> more streamlined.
>
> The idea of having columns with check boxes in the table view is
> interesting. I think we would have difficulty scaling this up though. Let's
> say a user defines ten tags. A column for each tag would crowd out the
> actual data being displayed. This is not purely hypothetical; I know of at
> least one use case which requires five tags to do what the user needs to do
> with tagging.
>
> Richard Cordovano
> Basis Technology
>
>
>
> On Sun, Nov 16, 2014 at 10:48 PM, Billy Pronovost <bg...@gm...>
> wrote:
>
>> Hello TSK users... I had a question and a comment/suggestion.
>>
>> What is the intended purpose of Bookmark and Tag (or versus)?
>>
>> I get that Bookmarking is putting the item into the Report, but what about
>> Tag?
>>
>> For me, it seems like it should be just "tagging" and item, but I know
>> that
>> Bookmarking is a common term for forensic programs.
>>
>> Whatever the term is going to be, I really wish there was just a column
>> with a check box for this action. It is ridiculous to have to go through a
>> secondary click menu when this is one of the most common functions of an
>> investigation (marking an item for a report).
>>
>> What are the chances people agree with me and we could see a feature like
>> this in the next version?
>>
>> Thanks for your time.
>>
>> Billy
>>
>>
>> ------------------------------------------------------------------------------
>> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
>> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
>> with Interactivity, Sharing, Native Excel Exports, App Integration & more
>> Get technology previously reserved for billion-dollar corporations, FREE
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
>