[sleuthkit-users] R: Solr / RegExp Update and Survey

[Alessandro F. <ale...@al...>]

Autopsy is big project and I really prefer to have improvement of
performance or new feature instead of having  backword compatibility.
So for me option 1 is good  if all old version wil still be available as
today on https://sourceforge.net/projects/autopsy/files/autopsy/


Dott. Alessandro Fiorenzi
www.studiofiorenzi.it
af...@st... / +39 3487920172

Studio Fiorenzi  - Security & Forensics
Tel  0550351263
Vai Daniele Manin, 50 50019 Sesto Fiorentino
http://www.studiofiorenzi.it
IMPORTANTE: questa e-mail (inclusi tutti gli allegati) è inviata dallo
Studio Informatica Forense Fiorenzi Alessandro e può contenere informazioni
riservate soggette a segreto professionale. Essa può essere letta, copiata e
usata solo dal destinatario indicato e non deve essere ritrasmessa con
modifiche senza il nostro consenso. Se l'avete ricevuta per errore, Vi
preghiamo di contattarci per e-mail o telefono e, quindi, di distruggerla
senza mostrarla ad alcun estraneo. La sicurezza e l'affidabilità  delle
e-mail non è garantita. Noi adottiamo programmi anti virus, ma decliniamo
ogni responsabilità  in ordine alla prevenzione degli eventuali virus.


-----Messaggio originale-----
Da: Brian Carrier [mailto:ca...@sl...]
Inviato: martedì 6 dicembre 2016 16.00
A: sle...@li... users
<sle...@li...>
Oggetto: [sleuthkit-users] Solr / RegExp Update and Survey

I have an update Solr / Elastic / regular expression work and a question
about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks
to use a different regular expression searching approach that gives us
better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have
three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing
4.2 cases.  Existing cases are not upgraded. We’d probably need to call this
release Autopsy 5 to make it clear what can open what. I’m not sure there
are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call
it 4.3), but only searched.  You can’t add new data sources to it and it
would have the old regular expression searching. If you need to add Data
Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive
process). You could open Autopsy cases originally created with 4.2 in 4.3
and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s
the least amount of work to provide some level of backward compatibility.
Historically, we have always upgraded cases to work with new versions of
Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear
that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org