[sleuthkit-users] Multiple Images

[Brian C. <ca...@sl...>]

Starting a  new thread for one of the topics brought up today. A couple of people mentioned variations on queueing up multiple images into Autopsy or processing multiple images. 

The current behavior is:
- A single case can be opened at a time.
- You can add multiple data sources to a case (which is a process to scan the media to enumerate the files - no content analysis is performed), though only one is added at a time.  You'll need to wait several minutes before you can add the next one though.
- After a data source has been added, the ingest modules are kicked off and you can add a 2nd data source.
- Because of the prioritization methods in Autopsy, processing of the first data source may stop for a while after the 2nd data source is added. This is because there is a prioritized list of folders and folders in the 2nd data source may have a higher priority than the remaining folders in data source 1.

So, what do you want to change / expand?  There seem to be two ideas that I could infer from the comments:

1) While you are waiting for the file system structure of data source one to finish, you can browse to additional data sources so that they are immediately added after the first one is and the rest of the process is as it is now.  You just don't need to wait around for a few minutes. 

2) Or we change the prioritization approach so that the first data source finishes sooner than it will with the current approach.

Or, is it something else that is wanted?

thanks,
brian