[sleuthkit-users] Feature Placement

[Brian C. <ca...@sl...>]

Question for the Autopsy users on the list.  We’re about to add a feature to extract pictures from inside of Word/PowerPoint/Excel docs and add them in as derived files that will be hashed, searched, etc.

The question is where we put the module. 

Technically, it is using the same library that we use in Keyword Search to extract text from these file types, so it would be fastest and least code for us to add it as a by-product of that module. Though, it is not very intuitive that the Keyword Search module would be doing that (from a user experience perspective).

A second option is to make a module just for that.  In addition to a slight performance hit, my other concern with this is that the list of ingest modules is starting to get long.  I don’t want Autopsy to have a list of 20 items to select from each time (when most of them will always be enabled).  There are of course longer-term ways to group modules by category, but that doesn’t solve the problem of where do we check this in next week.

A third option is to make a module that is graphic image focused and merge the EXIF module into it.  So, this new module would extract images from Word and EXIF extract and have a name that is graphics-based. 

Any strong thoughts?  Should performance trump a little confusion about who is actually going to be extracting the images?