Re: [sleuthkit-users] Naming Help Needed
Brought to you by:
carrier
From: Robert P. <rj...@gm...> - 2017-06-21 18:13:11
|
I think the Properties label works well... Rob On Wed, Jun 21, 2017, 12:06 PM MATT PIERCE <mat...@ad...> wrote: > My initial idea was metadata. I have a concern with that as ediscovery > folks and lawyers use that term generically for document embedded data > about the creation and modifation attributes. > > I would go with properties or attributes myself. > > -----Original Message----- > From: Jon Stewart [mailto:JSt...@St...] > Sent: Wednesday, June 21, 2017 10:11 AM > To: Keith Wall <kwa...@gm...>; Brian Carrier <ca...@sl... > > > Cc: sleuthkit-users <sle...@li...> > Subject: Re: [sleuthkit-users] Naming Help Needed > > Or just good old "metadata" for the collection of them (a hash is computed > so that could be argued, but path is clearly "metadata"). But > property/properties makes sense and is pretty consistent with other tools. > > > Jon > > > -----Original Message----- > > From: Keith Wall [mailto:kwa...@gm...] > > Sent: Wednesday, June 21, 2017 11:03 AM > > To: Brian Carrier <ca...@sl...> > > Cc: sleuthkit-users <sle...@li...> > > Subject: Re: [sleuthkit-users] Naming Help Needed > > > > I would go with property/properties for both. Artifacts of an artifact > > is confusing. I don't like feature or indicator. > > > > "Details" might not be a bad term as well. These are the fine details > > pertaining to an artifact. > > > > -keith > > > > On Wed, Jun 21, 2017 at 8:32 AM, Brian Carrier <ca...@sl... > > <mailto:ca...@sl...> > wrote: > > > > > > We're about to release the first version of a new database that > > Autopsy can use to support various analytical features and we're > > having trouble with terms and naming. So, we are seeking some more > opinions. > > > > > > Question 1) A file has additional data, such as its path and MD5 > > values. What do you call those? We've used the terms feature, > > indicator, artifact, property, etc. Which makes the most sense to you? > > > > > > Question 2) A web bookmark has additional data, such as dates and > > URL. What do you call those? Same as in Q1? > > > > > > To give some more context, we are about to release a new database > > that can be used to correlate data between cases (or between devices > > in the same case). But, we need a name to describe what we are > > storing, which includes: > > > > - MD5 hash of files > > > > - path of files > > > > - Email addresses > > > > - Domain names > > > > - Phone numbers > > > > > > For a while, we were referring to these as artifacts, but that got > > too confusing because we already have a notion of artifacts in > > Autopsy, which are "bigger" things like web bookmarks and keyword hits. > > > > > > thanks, > > > > brian > > > > > > ------------------------------------------------------------------- > > ----------- > > Check out the vibrant tech community on one of the world's most > > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > > _______________________________________________ > > sleuthkit-users mailing list > > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > > <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users> > > http://www.sleuthkit.org > > > > > > > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most engaging > tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > > > > ------------------------------------------------------------------------------ > Check out the vibrant tech community on one of the world's most > engaging tech sites, Slashdot.org! http://sdm.link/slashdot > _______________________________________________ > sleuthkit-users mailing list > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users > http://www.sleuthkit.org > |