Re: [sleuthkit-users] Naming Help Needed

[Jon S. <JSt...@St...>]

Or just good old "metadata" for the collection of them (a hash is computed so that could be argued, but path is clearly "metadata"). But property/properties makes sense and is pretty consistent with other tools.


Jon

> -----Original Message-----
> From: Keith Wall [mailto:kwa...@gm...]
> Sent: Wednesday, June 21, 2017 11:03 AM
> To: Brian Carrier <ca...@sl...>
> Cc: sleuthkit-users <sle...@li...>
> Subject: Re: [sleuthkit-users] Naming Help Needed
> 
> I would go with property/properties for both. Artifacts of an artifact
> is confusing. I don't like feature or indicator.
> 
> "Details" might not be a bad term as well. These are the fine details
> pertaining to an artifact.
> 
> -keith
> 
> On Wed, Jun 21, 2017 at 8:32 AM, Brian Carrier <ca...@sl...
> <mailto:ca...@sl...> > wrote:
> 
> 
> 	We're about to release the first version of a new database that
> Autopsy can use to support various analytical features and we're having
> trouble with terms and naming.  So, we are seeking some more opinions.
> 
> 
> 	Question 1) A file has additional data, such as its path and MD5
> values.  What do you call those?  We've used the terms feature,
> indicator, artifact, property, etc.  Which makes the most sense to you?
> 
> 
> 	Question 2) A web bookmark has additional data, such as dates and
> URL.  What do you call those?  Same as in Q1?
> 
> 
> 	To give some more context, we are about to release a new database
> that can be used to correlate data between cases (or between devices in
> the same case).  But, we need a name to describe what we are storing,
> which includes:
> 
> 	- MD5 hash of files
> 
> 	- path of files
> 
> 	- Email addresses
> 
> 	- Domain names
> 
> 	- Phone numbers
> 
> 
> 	For a while, we were referring to these as artifacts, but that got
> too confusing because we already have a notion of artifacts in Autopsy,
> which are "bigger" things like web bookmarks and  keyword hits.
> 
> 
> 	thanks,
> 
> 	brian
> 
> 
> 	-------------------------------------------------------------------
> -----------
> 	Check out the vibrant tech community on one of the world's most
> 	engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> 	_______________________________________________
> 	sleuthkit-users mailing list
> 	https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> 	http://www.sleuthkit.org
> 
> 
>