sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] Libevtx Prebuilt DLL

[Derrick K. <dk...@gm...>]

I haven't seen any!  If you followed Joachim's excellent build
instructions, and it's still giving you issues, I'd fire him off an
email.

  https://github.com/libyal/libevtx/wiki/Building

Derrick


On Sat, Jul 1, 2017 at 5:48 PM, Nick Flower <nic...@gm...> wrote:
> Are there any pre-built Libevtx .dll’s floating around out there?
>
> I can’t get it to build properly on Windows, so I’m hoping a prebuilt one
> will be sufficient.
>
>
>
> I know this is likely the wrong place to ask – if there’s a better place,
> please let me know.
>
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

[sleuthkit-users] Libevtx Prebuilt DLL

[Nick F. <nic...@gm...>]

Are there any pre-built Libevtx .dll’s floating around out there?
I can’t get it to build properly on Windows, so I’m hoping a prebuilt one will be sufficient.

I know this is likely the wrong place to ask – if there’s a better place, please let me know.

Re: [sleuthkit-users] 4:Cast Awards

[Nanni B. <dig...@gm...>]

Congrats! I'm happy too ...Autopsy was a worthy opponent :-)

2017-06-28 13:20 GMT+02:00 Brian Carrier <ca...@sl...>:

> Thanks for those who voted in the 4:cast awards.  Autopsy won the open
> source category:
>
>     https://forensic4cast.com/forensic-4cast-awards/2017-awards/
>
>
>
>
>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>


-- 
Dott. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net

[sleuthkit-users] 4:Cast Awards

[Brian C. <ca...@sl...>]

Thanks for those who voted in the 4:cast awards.  Autopsy won the open
source category:

    https://forensic4cast.com/forensic-4cast-awards/2017-awards/

[sleuthkit-users] OSDFCon Voting

[Brian C. <ca...@sl...>]

Voting has begun to form the annual OSDFCon agenda.  You can upvote and
downvote the open source forensics talks that you want to see here:

    https://www.surveymonkey.com/r/voteosdfcon

Voting is open until July 14.  The conference is October 17.

Registration is now open too.

    http://www.osdfcon.org

thanks,
brian

Re: [sleuthkit-users] sleuthkit-users Digest, Vol 132, Issue 7

[Jacquelyn B. <jac...@ic...>]

Please remove jac...@ic... from your mailing list 

Continued Blessings,


Jacquelyn Beckman


> On Jun 24, 2017, at 7:04 AM, sle...@li... wrote:
> 
> Send sleuthkit-users mailing list submissions to
>    sle...@li...
> 
> To subscribe or unsubscribe via the World Wide Web, visit
>    https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> or, via email, send a message with subject or body 'help' to
>    sle...@li...
> 
> You can reach the person managing the list at
>    sle...@li...
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of sleuthkit-users digest..."
> 
> 
> Today's Topics:
> 
>   1. Re: Naming Help Needed (Jasey DePriest)
>   2. Re: Naming Help Needed (Kalin KOZHUHAROV)
> 
> 
> ----------------------------------------------------------------------
> 
> Message: 1
> Date: Fri, 23 Jun 2017 09:45:56 -0500
> From: Jasey DePriest <jrd...@gm...>
> To: Brian Carrier <ca...@sl...>
> Cc: sleuthkit-users <sle...@li...>
> Subject: Re: [sleuthkit-users] Naming Help Needed
> Message-ID:
>    <CAM...@ma...>
> Content-Type: text/plain; charset="utf-8"
> 
> Would "indicators" work for these? We typically call the discovery of
> known-bad hash values and hitting black listed sites an "indicator of
> compromise". But not all indicators are necessarily negative.
> 
> -Jasey
> 
> On Fri, Jun 23, 2017 at 9:32 AM, Brian Carrier <ca...@sl...>
> wrote:
> 
>> Thanks for everyone's comments on this.
>> 
>> We decided to go with attributes because we already use that term in
>> Autopsy and so it is less confusing.
>> 
>> The remaining naming question is a generic name for lists of "known"
>> things (good, bad, etc.):
>> - hashsets
>> - watch lists / black lists (i.e. phone numbers or emails of "bad" people)
>> - white lists (i.e. generic phone numbers or emails)
>> 
>> We've discussed the term "reference set". Any other ideas?  We don't want
>> to change the schema after we release this!
>> 
>> thanks,
>> brian
>> 
>> 
>> 
>> 
>> 
>> On Wed, Jun 21, 2017 at 10:32 AM, Brian Carrier <ca...@sl...>
>> wrote:
>> 
>>> We're about to release the first version of a new database that Autopsy
>>> can use to support various analytical features and we're having trouble
>>> with terms and naming.  So, we are seeking some more opinions.
>>> 
>>> Question 1) A file has additional data, such as its path and MD5 values.
>>> What do you call those?  We've used the terms feature, indicator, artifact,
>>> property, etc.  Which makes the most sense to you?
>>> 
>>> Question 2) A web bookmark has additional data, such as dates and URL.
>>> What do you call those?  Same as in Q1?
>>> 
>>> To give some more context, we are about to release a new database that
>>> can be used to correlate data between cases (or between devices in the same
>>> case).  But, we need a name to describe what we are storing, which includes:
>>> - MD5 hash of files
>>> - path of files
>>> - Email addresses
>>> - Domain names
>>> - Phone numbers
>>> 
>>> For a while, we were referring to these as artifacts, but that got too
>>> confusing because we already have a notion of artifacts in Autopsy, which
>>> are "bigger" things like web bookmarks and  keyword hits.
>>> 
>>> thanks,
>>> brian
>>> 
>> 
>> 
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>> 
>> 
> -------------- next part --------------
> An HTML attachment was scrubbed...
> 
> ------------------------------
> 
> Message: 2
> Date: Fri, 23 Jun 2017 23:53:25 +0200
> From: Kalin KOZHUHAROV <me....@gm...>
> To: Brian Carrier <ca...@sl...>
> Cc: sleuthkit-users <sle...@li...>
> Subject: Re: [sleuthkit-users] Naming Help Needed
> Message-ID:
>    <CAK...@ma...>
> Content-Type: text/plain; charset="utf-8"
> 
> On Jun 23, 2017 16:33, "Brian Carrier" <ca...@sl...> wrote:
> 
> Thanks for everyone's comments on this.
> 
> We decided to go with attributes because we already use that term in
> Autopsy and so it is less confusing.
> 
> The remaining naming question is a generic name for lists of "known" things
> (good, bad, etc.):
> - hashsets
> - watch lists / black lists (i.e. phone numbers or emails of "bad" people)
> - white lists (i.e. generic phone numbers or emails)
> 
> We've discussed the term "reference set". Any other ideas?
> 
> 
> Simply list/s or matchlist/s may do.
> 
> Kalin.
> -------------- next part --------------
> An HTML attachment was scrubbed...
> 
> ------------------------------
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> 
> ------------------------------
> 
> Subject: Digest Footer
> 
> _______________________________________________
> sleuthkit-users mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> 
> 
> ------------------------------
> 
> End of sleuthkit-users Digest, Vol 132, Issue 7
> ***********************************************

Re: [sleuthkit-users] Naming Help Needed

[Kalin K. <me....@gm...>]

On Jun 23, 2017 16:33, "Brian Carrier" <ca...@sl...> wrote:

Thanks for everyone's comments on this.

We decided to go with attributes because we already use that term in
Autopsy and so it is less confusing.

The remaining naming question is a generic name for lists of "known" things
(good, bad, etc.):
- hashsets
- watch lists / black lists (i.e. phone numbers or emails of "bad" people)
- white lists (i.e. generic phone numbers or emails)

We've discussed the term "reference set". Any other ideas?


Simply list/s or matchlist/s may do.

Kalin.

Re: [sleuthkit-users] Naming Help Needed

[Jasey D. <jrd...@gm...>]

Would "indicators" work for these? We typically call the discovery of
known-bad hash values and hitting black listed sites an "indicator of
compromise". But not all indicators are necessarily negative.

-Jasey

On Fri, Jun 23, 2017 at 9:32 AM, Brian Carrier <ca...@sl...>
wrote:

> Thanks for everyone's comments on this.
>
> We decided to go with attributes because we already use that term in
> Autopsy and so it is less confusing.
>
> The remaining naming question is a generic name for lists of "known"
> things (good, bad, etc.):
> - hashsets
> - watch lists / black lists (i.e. phone numbers or emails of "bad" people)
> - white lists (i.e. generic phone numbers or emails)
>
> We've discussed the term "reference set". Any other ideas?  We don't want
> to change the schema after we release this!
>
> thanks,
> brian
>
>
>
>
>
> On Wed, Jun 21, 2017 at 10:32 AM, Brian Carrier <ca...@sl...>
> wrote:
>
>> We're about to release the first version of a new database that Autopsy
>> can use to support various analytical features and we're having trouble
>> with terms and naming.  So, we are seeking some more opinions.
>>
>> Question 1) A file has additional data, such as its path and MD5 values.
>> What do you call those?  We've used the terms feature, indicator, artifact,
>> property, etc.  Which makes the most sense to you?
>>
>> Question 2) A web bookmark has additional data, such as dates and URL.
>> What do you call those?  Same as in Q1?
>>
>> To give some more context, we are about to release a new database that
>> can be used to correlate data between cases (or between devices in the same
>> case).  But, we need a name to describe what we are storing, which includes:
>> - MD5 hash of files
>> - path of files
>> - Email addresses
>> - Domain names
>> - Phone numbers
>>
>> For a while, we were referring to these as artifacts, but that got too
>> confusing because we already have a notion of artifacts in Autopsy, which
>> are "bigger" things like web bookmarks and  keyword hits.
>>
>> thanks,
>> brian
>>
>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] Naming Help Needed

[Brian C. <ca...@sl...>]

Actually, I should clarify.  We are using the term attribute in the code so
that there is an obvious mapping between "Blackboard Attributes" and
"Correlation Attributes", but we'll likely use property in the UI since
that seems to be a more natural term for users.

On Fri, Jun 23, 2017 at 10:32 AM, Brian Carrier <ca...@sl...>
wrote:

> Thanks for everyone's comments on this.
>
> We decided to go with attributes because we already use that term in
> Autopsy and so it is less confusing.
>
> The remaining naming question is a generic name for lists of "known"
> things (good, bad, etc.):
> - hashsets
> - watch lists / black lists (i.e. phone numbers or emails of "bad" people)
> - white lists (i.e. generic phone numbers or emails)
>
> We've discussed the term "reference set". Any other ideas?  We don't want
> to change the schema after we release this!
>
> thanks,
> brian
>
>
>
>
>
> On Wed, Jun 21, 2017 at 10:32 AM, Brian Carrier <ca...@sl...>
> wrote:
>
>> We're about to release the first version of a new database that Autopsy
>> can use to support various analytical features and we're having trouble
>> with terms and naming.  So, we are seeking some more opinions.
>>
>> Question 1) A file has additional data, such as its path and MD5 values.
>> What do you call those?  We've used the terms feature, indicator, artifact,
>> property, etc.  Which makes the most sense to you?
>>
>> Question 2) A web bookmark has additional data, such as dates and URL.
>> What do you call those?  Same as in Q1?
>>
>> To give some more context, we are about to release a new database that
>> can be used to correlate data between cases (or between devices in the same
>> case).  But, we need a name to describe what we are storing, which includes:
>> - MD5 hash of files
>> - path of files
>> - Email addresses
>> - Domain names
>> - Phone numbers
>>
>> For a while, we were referring to these as artifacts, but that got too
>> confusing because we already have a notion of artifacts in Autopsy, which
>> are "bigger" things like web bookmarks and  keyword hits.
>>
>> thanks,
>> brian
>>
>
>

Re: [sleuthkit-users] Naming Help Needed

[Brian C. <ca...@sl...>]

Thanks for everyone's comments on this.

We decided to go with attributes because we already use that term in
Autopsy and so it is less confusing.

The remaining naming question is a generic name for lists of "known" things
(good, bad, etc.):
- hashsets
- watch lists / black lists (i.e. phone numbers or emails of "bad" people)
- white lists (i.e. generic phone numbers or emails)

We've discussed the term "reference set". Any other ideas?  We don't want
to change the schema after we release this!

thanks,
brian





On Wed, Jun 21, 2017 at 10:32 AM, Brian Carrier <ca...@sl...>
wrote:

> We're about to release the first version of a new database that Autopsy
> can use to support various analytical features and we're having trouble
> with terms and naming.  So, we are seeking some more opinions.
>
> Question 1) A file has additional data, such as its path and MD5 values.
> What do you call those?  We've used the terms feature, indicator, artifact,
> property, etc.  Which makes the most sense to you?
>
> Question 2) A web bookmark has additional data, such as dates and URL.
> What do you call those?  Same as in Q1?
>
> To give some more context, we are about to release a new database that can
> be used to correlate data between cases (or between devices in the same
> case).  But, we need a name to describe what we are storing, which includes:
> - MD5 hash of files
> - path of files
> - Email addresses
> - Domain names
> - Phone numbers
>
> For a while, we were referring to these as artifacts, but that got too
> confusing because we already have a notion of artifacts in Autopsy, which
> are "bigger" things like web bookmarks and  keyword hits.
>
> thanks,
> brian
>

Re: [sleuthkit-users] Naming Help Needed

[Hoyt H. <hoy...@gm...>]

I agree with "property" as well.

On Wed, Jun 21, 2017 at 9:32 AM, Brian Carrier <ca...@sl...>
wrote:

> We're about to release the first version of a new database that Autopsy
> can use to support various analytical features and we're having trouble
> with terms and naming.  So, we are seeking some more opinions.
>
> Question 1) A file has additional data, such as its path and MD5 values.
> What do you call those?  We've used the terms feature, indicator, artifact,
> property, etc.  Which makes the most sense to you?
>
> Question 2) A web bookmark has additional data, such as dates and URL.
> What do you call those?  Same as in Q1?
>
> To give some more context, we are about to release a new database that can
> be used to correlate data between cases (or between devices in the same
> case).  But, we need a name to describe what we are storing, which includes:
> - MD5 hash of files
> - path of files
> - Email addresses
> - Domain names
> - Phone numbers
>
> For a while, we were referring to these as artifacts, but that got too
> confusing because we already have a notion of artifacts in Autopsy, which
> are "bigger" things like web bookmarks and  keyword hits.
>
> thanks,
> brian
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>


-- 
Hoyt
-----------------
There are 11 kinds of people - those who think binary jokes are funny,
those who don't, ...and those who don't know binary.

[sleuthkit-users] New NSRL Index

[Brian C. <ca...@sl...>]

256 is indexed and on SF.net:

https://sourceforge.net/projects/autopsy/files/NSRL/NSRL-256m-Autopsy.zip/download

[sleuthkit-users] .MSG file association

[Schmidt, T. E <tsc...@wi...>]

Is there a way in Autopsy to associate .msg files with email instead of with regular text files or some vs outlook file that then doesn't show up for under "email" for our legal folks?

Re: [sleuthkit-users] Naming Help Needed

[Kalin K. <me....@gm...>]

On Wed, Jun 21, 2017 at 4:32 PM, Brian Carrier <ca...@sl...> wrote:
> Question 1) A file has additional data, such as its path and MD5 values.
> What do you call those?  We've used the terms feature, indicator, artifact,
> property, etc.  Which makes the most sense to you?
>
Definitely not any of "feature, indicator, artifact".

Files, by default, have no "MD5 values", those are calculated. Same
with any hashing algorithm. I'd call those properties, probably
avoiding metadata. Same for say some other classification like
entropy, etc. To make it clear, I may add "calculated properties" or
intrinsic properties.

Paths are slightly different, they are "organizational metadata", or
I'd say filesystem metadata, or simply metadata. I can probably live
with property, better "external property", or "location property".
Similar to paths are inodes, URLs (that file was fetched from),
location on disk (sector/offset + size), location within other object
(3rd file in a certain ZIP archive), etc.
All those location properties can vary, be changed in time, yet the
file itself is not changing (and so its intrinsic properties).

Although properties is a word abused in the Windows world of
forensics, I think it is ok and will be happy it is more classified
into intrinsic, location, time, security, etc. proerties.

> Question 2) A web bookmark has additional data, such as dates and URL.  What
> do you call those?  Same as in Q1?
>
What is a web bookmark? A record in a (flat file) database? A file?
I'd say, the moment you define "web bookmark" it must consist of a
URL, may be name, description, may be dates.

Yes, I'd go with same as Q1.

> To give some more context, we are about to release a new database that can
> be used to correlate data between cases (or between devices in the same
> case).  But, we need a name to describe what we are storing, which includes:
> - MD5 hash of files
calculated properties

> - path of files
location properties

> - Email addresses
> - Domain names
> - Phone numbers
artifacts or regexp matches

> For a while, we were referring to these as artifacts, but that got too
> confusing because we already have a notion of artifacts in Autopsy, which
> are "bigger" things like web bookmarks and  keyword hits.
>
IMHO, there is no problem in using artifacts broadly, if you keep
properties for things like sizes, paths, hashes, etc.

A domain name is a genuine artifact, it may be a property of a
bookmark though if viewed in that context. Same for TLD.

Kalin.

Re: [sleuthkit-users] Naming Help Needed

[Robert P. <rj...@gm...>]

I think the Properties label works well...
Rob

On Wed, Jun 21, 2017, 12:06 PM MATT PIERCE <mat...@ad...> wrote:

> My initial idea was metadata.  I have a concern with that as ediscovery
> folks and lawyers use that term generically for document embedded data
> about the creation and modifation attributes.
>
> I would go with properties or attributes myself.
>
> -----Original Message-----
> From: Jon Stewart [mailto:JSt...@St...]
> Sent: Wednesday, June 21, 2017 10:11 AM
> To: Keith Wall <kwa...@gm...>; Brian Carrier <ca...@sl...
> >
> Cc: sleuthkit-users <sle...@li...>
> Subject: Re: [sleuthkit-users] Naming Help Needed
>
> Or just good old "metadata" for the collection of them (a hash is computed
> so that could be argued, but path is clearly "metadata"). But
> property/properties makes sense and is pretty consistent with other tools.
>
>
> Jon
>
> > -----Original Message-----
> > From: Keith Wall [mailto:kwa...@gm...]
> > Sent: Wednesday, June 21, 2017 11:03 AM
> > To: Brian Carrier <ca...@sl...>
> > Cc: sleuthkit-users <sle...@li...>
> > Subject: Re: [sleuthkit-users] Naming Help Needed
> >
> > I would go with property/properties for both. Artifacts of an artifact
> > is confusing. I don't like feature or indicator.
> >
> > "Details" might not be a bad term as well. These are the fine details
> > pertaining to an artifact.
> >
> > -keith
> >
> > On Wed, Jun 21, 2017 at 8:32 AM, Brian Carrier <ca...@sl...
> > <mailto:ca...@sl...> > wrote:
> >
> >
> >       We're about to release the first version of a new database that
> > Autopsy can use to support various analytical features and we're
> > having trouble with terms and naming.  So, we are seeking some more
> opinions.
> >
> >
> >       Question 1) A file has additional data, such as its path and MD5
> > values.  What do you call those?  We've used the terms feature,
> > indicator, artifact, property, etc.  Which makes the most sense to you?
> >
> >
> >       Question 2) A web bookmark has additional data, such as dates and
> > URL.  What do you call those?  Same as in Q1?
> >
> >
> >       To give some more context, we are about to release a new database
> > that can be used to correlate data between cases (or between devices
> > in the same case).  But, we need a name to describe what we are
> > storing, which includes:
> >
> >       - MD5 hash of files
> >
> >       - path of files
> >
> >       - Email addresses
> >
> >       - Domain names
> >
> >       - Phone numbers
> >
> >
> >       For a while, we were referring to these as artifacts, but that got
> > too confusing because we already have a notion of artifacts in
> > Autopsy, which are "bigger" things like web bookmarks and  keyword hits.
> >
> >
> >       thanks,
> >
> >       brian
> >
> >
> >       -------------------------------------------------------------------
> > -----------
> >       Check out the vibrant tech community on one of the world's most
> >       engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> >       _______________________________________________
> >       sleuthkit-users mailing list
> >       https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> >       http://www.sleuthkit.org
> >
> >
> >
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most engaging
> tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] Naming Help Needed

[MATT P. <mat...@ad...>]

My initial idea was metadata.  I have a concern with that as ediscovery folks and lawyers use that term generically for document embedded data about the creation and modifation attributes.

I would go with properties or attributes myself.

-----Original Message-----
From: Jon Stewart [mailto:JSt...@St...] 
Sent: Wednesday, June 21, 2017 10:11 AM
To: Keith Wall <kwa...@gm...>; Brian Carrier <ca...@sl...>
Cc: sleuthkit-users <sle...@li...>
Subject: Re: [sleuthkit-users] Naming Help Needed

Or just good old "metadata" for the collection of them (a hash is computed so that could be argued, but path is clearly "metadata"). But property/properties makes sense and is pretty consistent with other tools.


Jon

> -----Original Message-----
> From: Keith Wall [mailto:kwa...@gm...]
> Sent: Wednesday, June 21, 2017 11:03 AM
> To: Brian Carrier <ca...@sl...>
> Cc: sleuthkit-users <sle...@li...>
> Subject: Re: [sleuthkit-users] Naming Help Needed
> 
> I would go with property/properties for both. Artifacts of an artifact 
> is confusing. I don't like feature or indicator.
> 
> "Details" might not be a bad term as well. These are the fine details 
> pertaining to an artifact.
> 
> -keith
> 
> On Wed, Jun 21, 2017 at 8:32 AM, Brian Carrier <ca...@sl... 
> <mailto:ca...@sl...> > wrote:
> 
> 
> 	We're about to release the first version of a new database that 
> Autopsy can use to support various analytical features and we're 
> having trouble with terms and naming.  So, we are seeking some more opinions.
> 
> 
> 	Question 1) A file has additional data, such as its path and MD5 
> values.  What do you call those?  We've used the terms feature, 
> indicator, artifact, property, etc.  Which makes the most sense to you?
> 
> 
> 	Question 2) A web bookmark has additional data, such as dates and 
> URL.  What do you call those?  Same as in Q1?
> 
> 
> 	To give some more context, we are about to release a new database 
> that can be used to correlate data between cases (or between devices 
> in the same case).  But, we need a name to describe what we are 
> storing, which includes:
> 
> 	- MD5 hash of files
> 
> 	- path of files
> 
> 	- Email addresses
> 
> 	- Domain names
> 
> 	- Phone numbers
> 
> 
> 	For a while, we were referring to these as artifacts, but that got 
> too confusing because we already have a notion of artifacts in 
> Autopsy, which are "bigger" things like web bookmarks and  keyword hits.
> 
> 
> 	thanks,
> 
> 	brian
> 
> 
> 	-------------------------------------------------------------------
> -----------
> 	Check out the vibrant tech community on one of the world's most
> 	engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> 	_______________________________________________
> 	sleuthkit-users mailing list
> 	https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> 	http://www.sleuthkit.org
> 
> 
> 

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] Naming Help Needed

[Derrick K. <dk...@gm...>]

I'd go with property on q1 as well.  I've seen "metadata" abused for things
like q2 and in some cases it actually isn't a bad choice.  However, we are
so used to metadata being data that is internal to a single file though
that it may be confusing to use it for data that is related to an artifact.

Derrick


On Jun 21, 2017 09:09, "Keith Wall" <kwa...@gm...> wrote:

> I would go with property/properties for both. Artifacts of an artifact is
> confusing. I don't like feature or indicator.
>
> "Details" might not be a bad term as well. These are the fine details
> pertaining to an artifact.
>
> -keith
>
> On Wed, Jun 21, 2017 at 8:32 AM, Brian Carrier <ca...@sl...>
> wrote:
>
>> We're about to release the first version of a new database that Autopsy
>> can use to support various analytical features and we're having trouble
>> with terms and naming.  So, we are seeking some more opinions.
>>
>> Question 1) A file has additional data, such as its path and MD5 values.
>> What do you call those?  We've used the terms feature, indicator, artifact,
>> property, etc.  Which makes the most sense to you?
>>
>> Question 2) A web bookmark has additional data, such as dates and URL.
>> What do you call those?  Same as in Q1?
>>
>> To give some more context, we are about to release a new database that
>> can be used to correlate data between cases (or between devices in the same
>> case).  But, we need a name to describe what we are storing, which includes:
>> - MD5 hash of files
>> - path of files
>> - Email addresses
>> - Domain names
>> - Phone numbers
>>
>> For a while, we were referring to these as artifacts, but that got too
>> confusing because we already have a notion of artifacts in Autopsy, which
>> are "bigger" things like web bookmarks and  keyword hits.
>>
>> thanks,
>> brian
>>
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] Naming Help Needed

[Pasquale R. <pjr...@gm...>]

that information seems to all be different types of "identifiers". Not sure
if you are using that one already. Otherwise details or properties works.

Pasquale

On Wed, Jun 21, 2017 at 11:03 AM, Keith Wall <kwa...@gm...> wrote:

> I would go with property/properties for both. Artifacts of an artifact is
> confusing. I don't like feature or indicator.
>
> "Details" might not be a bad term as well. These are the fine details
> pertaining to an artifact.
>
> -keith
>
> On Wed, Jun 21, 2017 at 8:32 AM, Brian Carrier <ca...@sl...>
> wrote:
>
>> We're about to release the first version of a new database that Autopsy
>> can use to support various analytical features and we're having trouble
>> with terms and naming.  So, we are seeking some more opinions.
>>
>> Question 1) A file has additional data, such as its path and MD5 values.
>> What do you call those?  We've used the terms feature, indicator, artifact,
>> property, etc.  Which makes the most sense to you?
>>
>> Question 2) A web bookmark has additional data, such as dates and URL.
>> What do you call those?  Same as in Q1?
>>
>> To give some more context, we are about to release a new database that
>> can be used to correlate data between cases (or between devices in the same
>> case).  But, we need a name to describe what we are storing, which includes:
>> - MD5 hash of files
>> - path of files
>> - Email addresses
>> - Domain names
>> - Phone numbers
>>
>> For a while, we were referring to these as artifacts, but that got too
>> confusing because we already have a notion of artifacts in Autopsy, which
>> are "bigger" things like web bookmarks and  keyword hits.
>>
>> thanks,
>> brian
>>
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] Naming Help Needed

[Luís F. N. <lfc...@gm...>]

Property or attribute.

Luis

Em 21 de jun de 2017 11:37 AM, "Brian Carrier" <ca...@sl...>
escreveu:

> We're about to release the first version of a new database that Autopsy
> can use to support various analytical features and we're having trouble
> with terms and naming.  So, we are seeking some more opinions.
>
> Question 1) A file has additional data, such as its path and MD5 values.
> What do you call those?  We've used the terms feature, indicator, artifact,
> property, etc.  Which makes the most sense to you?
>
> Question 2) A web bookmark has additional data, such as dates and URL.
> What do you call those?  Same as in Q1?
>
> To give some more context, we are about to release a new database that can
> be used to correlate data between cases (or between devices in the same
> case).  But, we need a name to describe what we are storing, which includes:
> - MD5 hash of files
> - path of files
> - Email addresses
> - Domain names
> - Phone numbers
>
> For a while, we were referring to these as artifacts, but that got too
> confusing because we already have a notion of artifacts in Autopsy, which
> are "bigger" things like web bookmarks and  keyword hits.
>
> thanks,
> brian
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] Naming Help Needed

[Jon S. <JSt...@St...>]

Or just good old "metadata" for the collection of them (a hash is computed so that could be argued, but path is clearly "metadata"). But property/properties makes sense and is pretty consistent with other tools.


Jon

> -----Original Message-----
> From: Keith Wall [mailto:kwa...@gm...]
> Sent: Wednesday, June 21, 2017 11:03 AM
> To: Brian Carrier <ca...@sl...>
> Cc: sleuthkit-users <sle...@li...>
> Subject: Re: [sleuthkit-users] Naming Help Needed
> 
> I would go with property/properties for both. Artifacts of an artifact
> is confusing. I don't like feature or indicator.
> 
> "Details" might not be a bad term as well. These are the fine details
> pertaining to an artifact.
> 
> -keith
> 
> On Wed, Jun 21, 2017 at 8:32 AM, Brian Carrier <ca...@sl...
> <mailto:ca...@sl...> > wrote:
> 
> 
> 	We're about to release the first version of a new database that
> Autopsy can use to support various analytical features and we're having
> trouble with terms and naming.  So, we are seeking some more opinions.
> 
> 
> 	Question 1) A file has additional data, such as its path and MD5
> values.  What do you call those?  We've used the terms feature,
> indicator, artifact, property, etc.  Which makes the most sense to you?
> 
> 
> 	Question 2) A web bookmark has additional data, such as dates and
> URL.  What do you call those?  Same as in Q1?
> 
> 
> 	To give some more context, we are about to release a new database
> that can be used to correlate data between cases (or between devices in
> the same case).  But, we need a name to describe what we are storing,
> which includes:
> 
> 	- MD5 hash of files
> 
> 	- path of files
> 
> 	- Email addresses
> 
> 	- Domain names
> 
> 	- Phone numbers
> 
> 
> 	For a while, we were referring to these as artifacts, but that got
> too confusing because we already have a notion of artifacts in Autopsy,
> which are "bigger" things like web bookmarks and  keyword hits.
> 
> 
> 	thanks,
> 
> 	brian
> 
> 
> 	-------------------------------------------------------------------
> -----------
> 	Check out the vibrant tech community on one of the world's most
> 	engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> 	_______________________________________________
> 	sleuthkit-users mailing list
> 	https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> 	http://www.sleuthkit.org
> 
> 
> 

Re: [sleuthkit-users] Naming Help Needed

[Keith W. <kwa...@gm...>]

I would go with property/properties for both. Artifacts of an artifact is
confusing. I don't like feature or indicator.

"Details" might not be a bad term as well. These are the fine details
pertaining to an artifact.

-keith

On Wed, Jun 21, 2017 at 8:32 AM, Brian Carrier <ca...@sl...>
wrote:

> We're about to release the first version of a new database that Autopsy
> can use to support various analytical features and we're having trouble
> with terms and naming.  So, we are seeking some more opinions.
>
> Question 1) A file has additional data, such as its path and MD5 values.
> What do you call those?  We've used the terms feature, indicator, artifact,
> property, etc.  Which makes the most sense to you?
>
> Question 2) A web bookmark has additional data, such as dates and URL.
> What do you call those?  Same as in Q1?
>
> To give some more context, we are about to release a new database that can
> be used to correlate data between cases (or between devices in the same
> case).  But, we need a name to describe what we are storing, which includes:
> - MD5 hash of files
> - path of files
> - Email addresses
> - Domain names
> - Phone numbers
>
> For a while, we were referring to these as artifacts, but that got too
> confusing because we already have a notion of artifacts in Autopsy, which
> are "bigger" things like web bookmarks and  keyword hits.
>
> thanks,
> brian
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

Re: [sleuthkit-users] Naming Help Needed

[Danilo M. <da...@gm...>]

Property.

Em 21 de jun de 2017 11:37, "Brian Carrier" <ca...@sl...>
escreveu:

> We're about to release the first version of a new database that Autopsy
> can use to support various analytical features and we're having trouble
> with terms and naming.  So, we are seeking some more opinions.
>
> Question 1) A file has additional data, such as its path and MD5 values.
> What do you call those?  We've used the terms feature, indicator, artifact,
> property, etc.  Which makes the most sense to you?
>
> Question 2) A web bookmark has additional data, such as dates and URL.
> What do you call those?  Same as in Q1?
>
> To give some more context, we are about to release a new database that can
> be used to correlate data between cases (or between devices in the same
> case).  But, we need a name to describe what we are storing, which includes:
> - MD5 hash of files
> - path of files
> - Email addresses
> - Domain names
> - Phone numbers
>
> For a while, we were referring to these as artifacts, but that got too
> confusing because we already have a notion of artifacts in Autopsy, which
> are "bigger" things like web bookmarks and  keyword hits.
>
> thanks,
> brian
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

[sleuthkit-users] Naming Help Needed

[Brian C. <ca...@sl...>]

We're about to release the first version of a new database that Autopsy can
use to support various analytical features and we're having trouble with
terms and naming.  So, we are seeking some more opinions.

Question 1) A file has additional data, such as its path and MD5 values.
What do you call those?  We've used the terms feature, indicator, artifact,
property, etc.  Which makes the most sense to you?

Question 2) A web bookmark has additional data, such as dates and URL.
What do you call those?  Same as in Q1?

To give some more context, we are about to release a new database that can
be used to correlate data between cases (or between devices in the same
case).  But, we need a name to describe what we are storing, which includes:
- MD5 hash of files
- path of files
- Email addresses
- Domain names
- Phone numbers

For a while, we were referring to these as artifacts, but that got too
confusing because we already have a notion of artifacts in Autopsy, which
are "bigger" things like web bookmarks and  keyword hits.

thanks,
brian

[sleuthkit-users] Triage Features

[Brian C. <ca...@sl...>]

I made a blog posting that goes into more detail about using the new triage
features in 4.4.0.  The new features let you:

   - Skip the acquisition / imaging step
   - Analyze only a subset of the files
   - Preprogram Autopsy to do certain types of analysis

http://www.autopsy.com/triage-media-with-autopsy-4-4-0/

[sleuthkit-users] New Autopsy and TSK Releases!

[Brian C. <ca...@sl...>]

We missed our goal of a quarterly release, but we managed to get Autopsy
4.4.0 and TSK 4.4.1 out.

*Autopsy 4.4.0:*
- Has a bunch of keyword search improvements, including better regular
expression searching with spaces, better hit highlighting, and ability to
edit keyword lists.
- New triage features, such as:
-- You can make a sparse VHD file when analyzing a local drive (USB) so
that you don't need to acquire first.  When your analysis is over, you'll
have a VHD image of the drive!
-- Ingest filters allow you to run the ingest modules only a subset of
files during triage
-- Ingest profiles allow you to pick an ingest filter and set of ingest
modules to make it eaiser to preprogram for triage
- Lots of other changes and improvements to existing features.

More changes can be found on the history
<http://sleuthkit.org/autopsy/history.php> page.

You can download it from the download
<http://sleuthkit.org/autopsy/download.php> page (Note that we are now
using github for releases).

*The Sleuth Kit 4.4.1:*
- Mostly bug fixes, including memory leaks, unicode cleanup, missing NTFS
files (in rare cases), really long folder structures and database inserts.
- The code to make the VHD sparse image is in TSK, but not exposed via any
of the command line tools.

You can download it from the download
<http://www.sleuthkit.org/sleuthkit/download.php> page.

Thanks to the community members who contributed to the TSK fixes this
release and the Basis team for the new features and fixes.

Next release is scheduled for July 1ish so that we get back on our
quarterly schedule.

brian