Re: [sleuthkit-users] Multiple Images

[Derrick K. <dk...@gm...>]

Hi Brian.

I would like to see a version of #1 where images can be added to the
queue at any time without waiting for ingest to occur.  I often find
myself adding an image and then thinking, "Doh!  I should have also
added image X!", and then I have to wait.  I then get consumed by
something else since I have a few minutes to spare but then don't get
back to adding the other image for an hour, or two, or eight.  So, I
think Autopsy should be changed to cater to my poor multitasking
abilities.  :)

The current prioritization approach works for getting usable results
faster to the user and I don't think changing that is beneficial.  If
we could just have the ability to queue images at any time in the
Autopsy processing chain that would be slick.

Derrick


On Wed, Mar 25, 2015 at 9:15 PM, Brian Carrier <ca...@sl...> wrote:
> Starting a  new thread for one of the topics brought up today. A couple of people mentioned variations on queueing up multiple images into Autopsy or processing multiple images.
>
> The current behavior is:
> - A single case can be opened at a time.
> - You can add multiple data sources to a case (which is a process to scan the media to enumerate the files - no content analysis is performed), though only one is added at a time.  You'll need to wait several minutes before you can add the next one though.
> - After a data source has been added, the ingest modules are kicked off and you can add a 2nd data source.
> - Because of the prioritization methods in Autopsy, processing of the first data source may stop for a while after the 2nd data source is added. This is because there is a prioritized list of folders and folders in the 2nd data source may have a higher priority than the remaining folders in data source 1.
>
> So, what do you want to change / expand?  There seem to be two ideas that I could infer from the comments:
>
> 1) While you are waiting for the file system structure of data source one to finish, you can browse to additional data sources so that they are immediately added after the first one is and the rest of the process is as it is now.  You just don't need to wait around for a few minutes.
>
> 2) Or we change the prioritization approach so that the first data source finishes sooner than it will with the current approach.
>
> Or, is it something else that is wanted?
>
> thanks,
> brian
>
>
>
>
> ------------------------------------------------------------------------------
> Dive into the World of Parallel Programming The Go Parallel Website, sponsored
> by Intel and developed in partnership with Slashdot Media, is your hub for all
> things parallel software development, from weekly thought leadership blogs to
> news, videos, case studies, tutorials and more. Take a look and join the
> conversation now. http://goparallel.sourceforge.net/
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org