sleuthkit-users — List to discuss Autopsy and The Sleuth Kit.

Re: [sleuthkit-users] TSK-4.4 and SlackFiles

[Luís F. N. <lfc...@gm...>]

Hi Brian,

Thank you very much for your attention. The output of
FsContent.getMetaDataText() (equals to istat right?) is below. The
system.LOG-slack size is 2.026.496 bytes and system.LOG size is 1024 bytes.

details of /img_PC-HP.dd/vol_vol2/WINDOWS/system32/config/system.LOG-slack

MFT Entry Header Values:
Entry: 4106        Sequence: 1
$LogFile Sequence Number: 79246281526
Allocated File
Links: 1

$STANDARD_INFORMATION Attribute Values:
Flags: Hidden, Archive
Owner ID: 0
Security ID: 281  (S-1-5-32-544)
Last User Journal Update Sequence Number: 105272096
Created: 2004-09-02 08:00:12.000000000 (Hora oficial do Brasil)
File Modified: 2011-09-16 14:33:38.375000000 (Hora oficial do Brasil)
MFT Modified: 2011-09-16 14:33:38.375000000 (Hora oficial do Brasil)
Accessed: 2011-09-16 14:33:38.187500000 (Hora oficial do Brasil)

$FILE_NAME Attribute Values:
Flags: Hidden, Archive
Name: system.LOG
Parent MFT Entry: 3982 Sequence: 2
Allocated Size: 4096   Actual Size: 1024
Created: 2004-09-02 08:00:12.000000000 (Hora oficial do Brasil)
File Modified: 2004-09-02 08:00:12.000000000 (Hora oficial do Brasil)
MFT Modified: 2004-09-02 08:00:12.000000000 (Hora oficial do Brasil)
Accessed: 2004-09-02 08:00:12.000000000 (Hora oficial do Brasil)

$ATTRIBUTE_LIST Attribute Values:
Type: 16-0 MFT Entry: 4106 VCN: 0
Type: 48-4 MFT Entry: 4106 VCN: 0
Type: 128-0 MFT Entry: 40678 VCN: 0

Attributes:
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $ATTRIBUTE_LIST (32-5)   Name: N/A   Resident   size: 96
Type: $FILE_NAME (48-4)   Name: N/A   Resident   size: 86
Type: $DATA (128-6)   Name: N/A   Non-Resident   size: 1024  init_size: 1024
847844 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0
0 0 0 0 0 0 0

2017-01-31 12:56 GMT-02:00 Brian Carrier <ca...@sl...>:

> Hi Luis,
>
> My guess is that it's a file that has preallocated a large amount of
> space, but that has not fully used it yet. NTFS allows this.  If you read
> the file, TSK will only show you the space that is used.  Reading the
> slack, gives you the rest.
>
> If you run 'istat' on one of these files and send it along, we can confirm.
>
> thanks,
> brian
>
>
> On Tue, Jan 31, 2017 at 7:04 AM, Luís Filipe Nassif <lfc...@gm...>
> wrote:
>
>> Hi folks,
>>
>> I am upgrading to tsk-4.4 to benefit from the new support to slackfiles
>> from java bindings. But I noticed some slackfiles larger than the cluster
>> size (4k) are created in database. Some of them have megabytes of size and
>> its contents are accessible. Is it expected to have slackfiles larger than
>> cluster size? Could someone explain?
>>
>> Thanks,
>> Luis Nassif
>>
>> ------------------------------------------------------------
>> ------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>>
>

Re: [sleuthkit-users] TSK-4.4 and SlackFiles

[Brian C. <ca...@sl...>]

Hi Luis,

My guess is that it's a file that has preallocated a large amount of space,
but that has not fully used it yet. NTFS allows this.  If you read the
file, TSK will only show you the space that is used.  Reading the slack,
gives you the rest.

If you run 'istat' on one of these files and send it along, we can confirm.

thanks,
brian


On Tue, Jan 31, 2017 at 7:04 AM, Luís Filipe Nassif <lfc...@gm...>
wrote:

> Hi folks,
>
> I am upgrading to tsk-4.4 to benefit from the new support to slackfiles
> from java bindings. But I noticed some slackfiles larger than the cluster
> size (4k) are created in database. Some of them have megabytes of size and
> its contents are accessible. Is it expected to have slackfiles larger than
> cluster size? Could someone explain?
>
> Thanks,
> Luis Nassif
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

[sleuthkit-users] TSK-4.4 and SlackFiles

[Luís F. N. <lfc...@gm...>]

Hi folks,

I am upgrading to tsk-4.4 to benefit from the new support to slackfiles
from java bindings. But I noticed some slackfiles larger than the cluster
size (4k) are created in database. Some of them have megabytes of size and
its contents are accessible. Is it expected to have slackfiles larger than
cluster size? Could someone explain?

Thanks,
Luis Nassif

[sleuthkit-users] survey - Open Source DFIR developer exchange

[Joachim M. <joa...@gm...>]

We are playing with the idea to organize an Open Source digital forensics
and incident response tooling developer exchange. The idea is to have an
exchange for developer to discuss development, coding, maintenance, testing
and exchange ideas. With this survey we are gauging interest.

If you develop and/or maintain Open Source DFIR projects and are interested
please leave information about your projects at "I develop/maintain Open
Source DFIR projects".

https://docs.google.com/forms/d/e/1FAIpQLScgKBpr8_X8lzuxoV7HaB16kyr4vVuZdpzjnNJnV1WdFDhFlA/viewform?c=0&w=1

Thanks in advance,
Joachim

Re: [sleuthkit-users] Autopsy and TSK Releases

[Brian C. <ca...@sl...>]

Hi Ketil,

You should now use the new pull down in the “Add Data Source” wizard and choose “Unallocated Space Image File” instead of “Disk Image”.  

At this point, there is no way to identify a range as a file system, though its a feature that we could now think about adding. 

One challenge though is that we add the image as unallocated space. If you were to identify a subset of that as a file system, we could easily define a file system over that range and find the files in it.  But, we’d probably get a lot of duplicate keyword hits and files if we analyze and carve  the original Unallocated space file.    So, it would seem more ideal to remake the original unallocated space files to not include the file system, but it could be too late if carving and keyword searching already ran….  

in an ideal world, this is probably best done by making the “Disk Image” data source processor have some logic to allow the user to specify an offset for a file system when one can’t be found from the partition table.






> On Jan 23, 2017, at 9:53 AM, Ketil Froyn <ke...@fr...> wrote:
> 
> Hi Brian,
> 
> On 18 January 2017 at 22:47, Brian Carrier <ca...@sl...> wrote:
>> There are new releases of both The Sleuth Kit and Autopsy.
>> 
>> New things in Autopsy 4.3.0 are:
> [snip]
>> * Support for images with no file systems (all data is added as unallocated space
> 
> This doesn't seem to work for all cases, are there any limitations?
> The test image linked below doesn't add to Autopsy 4.3.0, I get the
> usual error message:
> 
> -------------------------
> Add Image Log
> Errors occured while ingesting image
> 1. Cannot determine file system type (Sector offset: 0)
> -------------------------
> 
> Image link: https://www.dropbox.com/s/ywmfpwgtznqzam8/add-fail.img.gz?dl=0
> 
> This is a small test image (100MB), which originally had a DOS
> partition table and two (empty) file systems (FAT and EXT4). After
> creating the file systems, most data before the first file system was
> overwritten with random bytes, so the partition table is gone. I was
> hoping to test if it's possible to add an image that has no
> (recognized) partition table, and then find and add the file systems
> within autopsy. I'd be interested to learn how this can be done, if
> it's possible.
> 
> The file systems start at sector 2048 and 104448:
> 
> $ file - < <(dd if=add-fail.img bs=512 count=4)
> /dev/stdin: data
> 
> $ file - < <(dd if=add-fail.img bs=512 count=4 skip=2048)
> /dev/stdin: DOS/MBR boot sector, code offset 0x58+2, OEM-ID
> "mkfs.fat", Media descriptor 0xf8, sectors/track 63, heads 255,
> sectors 100353 (volumes > 32 MB) , FAT (32 bit), sectors/FAT 772,
> serial number 0xb3e93cf7, unlabeled
> 
> $ file - < <(dd if=add-fail.img bs=512 count=4 skip=104448)
> /dev/stdin: Linux rev 1.0 ext4 filesystem data,
> UUID=d86165df-56d5-43a1-b1ea-3d28ebba8c47 (extents) (large files)
> (huge files)
> 
> Regards, Ketil

Re: [sleuthkit-users] Autopsy and TSK Releases

[Ketil F. <ke...@fr...>]

Hi Brian,

On 18 January 2017 at 22:47, Brian Carrier <ca...@sl...> wrote:
> There are new releases of both The Sleuth Kit and Autopsy.
>
> New things in Autopsy 4.3.0 are:
[snip]
> * Support for images with no file systems (all data is added as unallocated space

This doesn't seem to work for all cases, are there any limitations?
The test image linked below doesn't add to Autopsy 4.3.0, I get the
usual error message:

-------------------------
Add Image Log
Errors occured while ingesting image
1. Cannot determine file system type (Sector offset: 0)
-------------------------

Image link: https://www.dropbox.com/s/ywmfpwgtznqzam8/add-fail.img.gz?dl=0

This is a small test image (100MB), which originally had a DOS
partition table and two (empty) file systems (FAT and EXT4). After
creating the file systems, most data before the first file system was
overwritten with random bytes, so the partition table is gone. I was
hoping to test if it's possible to add an image that has no
(recognized) partition table, and then find and add the file systems
within autopsy. I'd be interested to learn how this can be done, if
it's possible.

The file systems start at sector 2048 and 104448:

$ file - < <(dd if=add-fail.img bs=512 count=4)
/dev/stdin: data

$ file - < <(dd if=add-fail.img bs=512 count=4 skip=2048)
/dev/stdin: DOS/MBR boot sector, code offset 0x58+2, OEM-ID
"mkfs.fat", Media descriptor 0xf8, sectors/track 63, heads 255,
sectors 100353 (volumes > 32 MB) , FAT (32 bit), sectors/FAT 772,
serial number 0xb3e93cf7, unlabeled

$ file - < <(dd if=add-fail.img bs=512 count=4 skip=104448)
/dev/stdin: Linux rev 1.0 ext4 filesystem data,
UUID=d86165df-56d5-43a1-b1ea-3d28ebba8c47 (extents) (large files)
(huge files)

Regards, Ketil

Re: [sleuthkit-users] 4.3.1 release

[Jon S. <JSt...@St...>]

That's excellent news. In particular, the NTFS issue looks like it may be ungood. We're continuing to investigate it.


Jon


> -----Original Message-----
> From: Brian Carrier [mailto:ca...@sl...]
> Sent: Wednesday, January 18, 2017 5:39 PM
> To: Jon Stewart <JSt...@St...>
> Cc: Joel Uckelman <juc...@st...>; sleuthkit-
> us...@li...; sle...@li...
> Subject: Re: [sleuthkit-users] 4.3.1 release
> 
> Hey Jon,
> 
> 
> I'll make sure we get those in for the next release.  We're going to get
> into a 2-month release rhythm.
> 
> 
> thanks,
> 
> brian
> 
> 
> 
> On Tue, Jan 17, 2017 at 12:39 PM, Jon Stewart
> <JSt...@st... <mailto:JSt...@st...> >
> wrote:
> 
> 
> 	The issue here:
> 	  https://github.com/sleuthkit/sleuthkit/issues/748
> <https://github.com/sleuthkit/sleuthkit/issues/748>
> 	appears to be a regression in NTFS between 4.2 and 4.3. We'll add
> more detail to it, but the issue seems due to an early exit from a loop.
> We may even be able to share the image, if someone can contact me off-
> list. It would be great to get this fixed in 4.4.
> 
> 	This open PR fixes some memory leaks:
> 	  https://github.com/sleuthkit/sleuthkit/pull/684
> <https://github.com/sleuthkit/sleuthkit/pull/684>
> 
> 	There's also this exFAT issue; we're trying to make up a tiny test
> evidence file to determine whether encoding exFAT uses is UTF-16 or UCS-
> 2:
> 	  https://github.com/sleuthkit/sleuthkit/pull/747
> <https://github.com/sleuthkit/sleuthkit/pull/747>
> 
> 
> 	Jon
> 
> 
> 	> -----Original Message-----
> 	> From: Brian Carrier [mailto:ca...@sl...
> <mailto:ca...@sl...> ]
> 	> Sent: Tuesday, January 17, 2017 10:21 AM
> 	> To: Joel Uckelman <juc...@st...
> <mailto:juc...@st...> >
> 	> Cc: sle...@li... <mailto:sleuthkit-
> us...@li...>
> 	> Subject: Re: [sleuthkit-users] 4.3.1 release
> 	>
> 	> Hey Joel,
> 	>
> 	>
> 	> We made the tag along with the Autopsy 4.2 release but never made
> the
> 	> full release in the craziness before OSDFCon.  We're about to
> make an
> 	> Autopsy 4.3 release along with a TSK 4.4.0 release.    Major
> difference
> 	> between 4.4 and 4.3 is the change in Visual Studio compiler.
> 	>
> 	>
> 	>
> 	>
> 	> On Wed, Jan 11, 2017 at 11:01 AM, Joel Uckelman
> 	> <juc...@st...
> <mailto:juc...@st...>
> <mailto:juc...@st...
> <mailto:juc...@st...> >
> 	> > wrote:
> 	>
> 	>
> 	>       I see a sleuthkit-4.3.1 tag on GitHub with commits that
> make it
> 	> look like a 4.3.1 release, but no mention of an actual release
> anywhere.
> 	> Is that going to be an official release at some point?
> 	>
> 	>
> 	>       Joel Uckelman | Senior Developer
> 	>
> 	>       Stroz Friedberg, an Aon company
> 	>       Capital House, 85 King William Street | London, EC4N 7BL
> 	>
> 	>       T: +44 20.7061.2239 | M: +44 79.6478.7296 | F: +44 20 7061
> 2201
> 	>       juc...@st...
> <mailto:juc...@st...>
> 	> <mailto:juc...@st...
> <mailto:juc...@st...> >  | www.strozfriedberg.com
> <http://www.strozfriedberg.com>
> 	> <http://www.strozfriedberg.com>
> 	>
> 	>       This message and/or its attachments may contain information
> that is
> 	> confidential and/or protected by privilege from disclosure. If
> you have
> 	> reason to believe you are not the intended recipient, please
> immediately
> 	> notify the sender by reply e-mail or by telephone, then delete
> this
> 	> message (and any attachments), as well as all copies, including
> any
> 	> printed copies. Thank you.
> 	>
> 	>       Stroz Friedberg Limited is a company registered in England
> and
> 	> Wales No: 4150500, Registered office: Capital House, 85 King
> William
> 	> Street, London EC4N 7BL, VAT registration No: 783 1701 29.
> 	>
> 	>
> 	>
> 	>       -----------------------------------------------------------
> --------
> 	> -----------
> 	>       Developer Access Program for Intel Xeon Phi Processors
> 	>       Access to Intel Xeon Phi processor-based developer
> platforms.
> 	>       With one year of Intel Parallel Studio XE.
> 	>       Training and support from Colfax.
> 	>       Order your platform today. http://sdm.link/xeonphi
> 	>       _______________________________________________
> 	>       sleuthkit-users mailing list
> 	>       https://lists.sourceforge.net/lists/listinfo/sleuthkit-
> users <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> 	> <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users> >
> 	>       http://www.sleuthkit.org
> 	>
> 	>
> 
> 
> 

Re: [sleuthkit-users] 4.3.1 release

[Brian C. <ca...@sl...>]

Hey Jon,

I'll make sure we get those in for the next release.  We're going to get
into a 2-month release rhythm.

thanks,
brian


On Tue, Jan 17, 2017 at 12:39 PM, Jon Stewart <JSt...@st...>
wrote:

> The issue here:
>   https://github.com/sleuthkit/sleuthkit/issues/748
> appears to be a regression in NTFS between 4.2 and 4.3. We'll add more
> detail to it, but the issue seems due to an early exit from a loop. We may
> even be able to share the image, if someone can contact me off-list. It
> would be great to get this fixed in 4.4.
>
> This open PR fixes some memory leaks:
>   https://github.com/sleuthkit/sleuthkit/pull/684
>
> There's also this exFAT issue; we're trying to make up a tiny test
> evidence file to determine whether encoding exFAT uses is UTF-16 or UCS-2:
>   https://github.com/sleuthkit/sleuthkit/pull/747
>
>
> Jon
>
>
> > -----Original Message-----
> > From: Brian Carrier [mailto:ca...@sl...]
> > Sent: Tuesday, January 17, 2017 10:21 AM
> > To: Joel Uckelman <juc...@st...>
> > Cc: sle...@li...
> > Subject: Re: [sleuthkit-users] 4.3.1 release
> >
> > Hey Joel,
> >
> >
> > We made the tag along with the Autopsy 4.2 release but never made the
> > full release in the craziness before OSDFCon.  We're about to make an
> > Autopsy 4.3 release along with a TSK 4.4.0 release.    Major difference
> > between 4.4 and 4.3 is the change in Visual Studio compiler.
> >
> >
> >
> >
> > On Wed, Jan 11, 2017 at 11:01 AM, Joel Uckelman
> > <juc...@st... <mailto:juc...@st...>
> > > wrote:
> >
> >
> >       I see a sleuthkit-4.3.1 tag on GitHub with commits that make it
> > look like a 4.3.1 release, but no mention of an actual release anywhere.
> > Is that going to be an official release at some point?
> >
> >
> >       Joel Uckelman | Senior Developer
> >
> >       Stroz Friedberg, an Aon company
> >       Capital House, 85 King William Street | London, EC4N 7BL
> >
> >       T: +44 20.7061.2239 | M: +44 79.6478.7296 | F: +44 20 7061 2201
> >       juc...@st...
> > <mailto:juc...@st...>  | www.strozfriedberg.com
> > <http://www.strozfriedberg.com>
> >
> >       This message and/or its attachments may contain information that is
> > confidential and/or protected by privilege from disclosure. If you have
> > reason to believe you are not the intended recipient, please immediately
> > notify the sender by reply e-mail or by telephone, then delete this
> > message (and any attachments), as well as all copies, including any
> > printed copies. Thank you.
> >
> >       Stroz Friedberg Limited is a company registered in England and
> > Wales No: 4150500, Registered office: Capital House, 85 King William
> > Street, London EC4N 7BL, VAT registration No: 783 1701 29.
> >
> >
> >
> >       ------------------------------------------------------------
> -------
> > -----------
> >       Developer Access Program for Intel Xeon Phi Processors
> >       Access to Intel Xeon Phi processor-based developer platforms.
> >       With one year of Intel Parallel Studio XE.
> >       Training and support from Colfax.
> >       Order your platform today. http://sdm.link/xeonphi
> >       _______________________________________________
> >       sleuthkit-users mailing list
> >       https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> >       http://www.sleuthkit.org
> >
> >
>
>

[sleuthkit-users] Autopsy and TSK Releases

[Brian C. <ca...@sl...>]

There are new releases of both The Sleuth Kit and Autopsy.

New things in Autopsy 4.3.0 are:
* Support for slack space on files (as separate virtual files) to enable
keyword searching and other analysis
* Simple mode for the file extension mismatch module that focuses on only
only multimedia and executable files to reduce false positives
* New view in tree that shows the MIME types
* Tagged items are highlighted in table views
* Ordering of columns is saved when user changes them
* Support for Android devices with preloaders (uses backup GPT)
* Support for images with no file systems (all data is added as unallocated
space
* User can bulk add list of keywords to a keyword list
* New "Experimental" module (activate via Tools, Plugins) with auto ingest
feature
* Assorted bug fixes and minor enhancements.

You can download it from: http://www.sleuthkit.org/autopsy/download.php


As was pointed out, we didn't officially release TSK 4.3.1, so this binary
release has new things from that release and the 4.4.0 release:

4.4.0:
* Compiling in Windows now uses Visual Studio 2015
* tsk_loaddb now adds new files for slack space and JNI was upgraded
accordingly.

4.3.1:
* NTFS works on 4k sectors
* Added support in Java to store local files in encoded form (XORed)
* Added Java Account object into datamodel

You can download it from: http://www.sleuthkit.org/sleuthkit/download.php

[sleuthkit-users] Autopsy Training

[Brian C. <ca...@sl...>]

We’d like to remind you about the upcoming Autopsy training sessions, which are being offered in Herndon, VA and online. 

	• Mar 7, 2017: Herndon, VA
	• Apr 4, 2017: Online

Registration links are available at: 
    http://www.autopsy.com/training/

The 1-day Autopsy course is $499 and  provides an overview of using and configuring Autopsy.  It combines lecture sessions with hands on exercises. All sessions are worth 6 CPE credits and students receive certificates of completion for attendance.  At the end of the class, you’ll know about how all of the modules work and how to efficiently use the tool.

More details can be found here: 
    http://www.autopsy.com/training/

We’re looking to add more events to the schedule. If you’d like training closer to you, then let us know where. 

Re: [sleuthkit-users] 4.3.1 release

[Jon S. <JSt...@St...>]

The issue here:
  https://github.com/sleuthkit/sleuthkit/issues/748
appears to be a regression in NTFS between 4.2 and 4.3. We'll add more detail to it, but the issue seems due to an early exit from a loop. We may even be able to share the image, if someone can contact me off-list. It would be great to get this fixed in 4.4.

This open PR fixes some memory leaks:
  https://github.com/sleuthkit/sleuthkit/pull/684

There's also this exFAT issue; we're trying to make up a tiny test evidence file to determine whether encoding exFAT uses is UTF-16 or UCS-2:
  https://github.com/sleuthkit/sleuthkit/pull/747


Jon


> -----Original Message-----
> From: Brian Carrier [mailto:ca...@sl...]
> Sent: Tuesday, January 17, 2017 10:21 AM
> To: Joel Uckelman <juc...@st...>
> Cc: sle...@li...
> Subject: Re: [sleuthkit-users] 4.3.1 release
> 
> Hey Joel,
> 
> 
> We made the tag along with the Autopsy 4.2 release but never made the
> full release in the craziness before OSDFCon.  We're about to make an
> Autopsy 4.3 release along with a TSK 4.4.0 release.    Major difference
> between 4.4 and 4.3 is the change in Visual Studio compiler.
> 
> 
> 
> 
> On Wed, Jan 11, 2017 at 11:01 AM, Joel Uckelman
> <juc...@st... <mailto:juc...@st...>
> > wrote:
> 
> 
> 	I see a sleuthkit-4.3.1 tag on GitHub with commits that make it
> look like a 4.3.1 release, but no mention of an actual release anywhere.
> Is that going to be an official release at some point?
> 
> 
> 	Joel Uckelman | Senior Developer
> 
> 	Stroz Friedberg, an Aon company
> 	Capital House, 85 King William Street | London, EC4N 7BL
> 
> 	T: +44 20.7061.2239 | M: +44 79.6478.7296 | F: +44 20 7061 2201
> 	juc...@st...
> <mailto:juc...@st...>  | www.strozfriedberg.com
> <http://www.strozfriedberg.com>
> 
> 	This message and/or its attachments may contain information that is
> confidential and/or protected by privilege from disclosure. If you have
> reason to believe you are not the intended recipient, please immediately
> notify the sender by reply e-mail or by telephone, then delete this
> message (and any attachments), as well as all copies, including any
> printed copies. Thank you.
> 
> 	Stroz Friedberg Limited is a company registered in England and
> Wales No: 4150500, Registered office: Capital House, 85 King William
> Street, London EC4N 7BL, VAT registration No: 783 1701 29.
> 
> 
> 
> 	-------------------------------------------------------------------
> -----------
> 	Developer Access Program for Intel Xeon Phi Processors
> 	Access to Intel Xeon Phi processor-based developer platforms.
> 	With one year of Intel Parallel Studio XE.
> 	Training and support from Colfax.
> 	Order your platform today. http://sdm.link/xeonphi
> 	_______________________________________________
> 	sleuthkit-users mailing list
> 	https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> <https://lists.sourceforge.net/lists/listinfo/sleuthkit-users>
> 	http://www.sleuthkit.org
> 
> 

Re: [sleuthkit-users] 4.3.1 release

[Brian C. <ca...@sl...>]

Hey Joel,

We made the tag along with the Autopsy 4.2 release but never made the full
release in the craziness before OSDFCon.  We're about to make an Autopsy
4.3 release along with a TSK 4.4.0 release.    Major difference between 4.4
and 4.3 is the change in Visual Studio compiler.



On Wed, Jan 11, 2017 at 11:01 AM, Joel Uckelman <
juc...@st...> wrote:

> I see a sleuthkit-4.3.1 tag on GitHub with commits that make it look like
> a 4.3.1 release, but no mention of an actual release anywhere. Is that
> going to be an official release at some point?
>
>
> Joel Uckelman | Senior Developer
>
> Stroz Friedberg, an Aon company
> Capital House, 85 King William Street | London, EC4N 7BL
>
> T: +44 20.7061.2239 | M: +44 79.6478.7296 | F: +44 20 7061 2201
> juc...@st... | www.strozfriedberg.com
>
> This message and/or its attachments may contain information that is
> confidential and/or protected by privilege from disclosure. If you have
> reason to believe you are not the intended recipient, please immediately
> notify the sender by reply e-mail or by telephone, then delete this message
> (and any attachments), as well as all copies, including any printed copies.
> Thank you.
>
> Stroz Friedberg Limited is a company registered in England and Wales No:
> 4150500, Registered office: Capital House, 85 King William Street, London
> EC4N 7BL, VAT registration No: 783 1701 29.
>
>
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today. http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] tsk - get clusters/sectors associated with a file

[Brian C. <ca...@sl...>]

The easiest way is to do a "walk" on the file (or attribute).  There are a
variety of ways of doing this.  Either tsk_fs_file_walk()
<http://www.sleuthkit.org/sleuthkit/docs/api-docs/4.2/group__fslib.html#ga17bc6f9ac09af7afed905b94d8257494>or
tsk_fs_attr_walk() will do it.

You can pass in the TSK_FS_FILE_WALK_FLAG_AONLY flag if you care only about
addresses.  That will be faster because it won't waste time loading file
content into the buffer.

There is an example callback in tsk/fs/ifind_lib.c (ifind_data_file_act())
that could be a useful starting place.


On Mon, Jan 16, 2017 at 11:59 PM, Lloyd <llo...@gm...> wrote:

> Hi,
>
> In tsk, is it possible to get the sectors/clusters associated with a file
> using tsk API? If not which part of the source should i refer to get this
> information?
>
> Thanks,
>   Lloyd
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>

[sleuthkit-users] tsk - get clusters/sectors associated with a file

[Lloyd <llo...@gm...>]

Hi,

In tsk, is it possible to get the sectors/clusters associated with a file
using tsk API? If not which part of the source should i refer to get this
information?

Thanks,
  Lloyd

[sleuthkit-users] 4.3.1 release

[Joel U. <juc...@st...>]

I see a sleuthkit-4.3.1 tag on GitHub with commits that make it look like a 4.3.1 release, but no mention of an actual release anywhere. Is that going to be an official release at some point?


Joel Uckelman | Senior Developer

Stroz Friedberg, an Aon company
Capital House, 85 King William Street | London, EC4N 7BL

T: +44 20.7061.2239 | M: +44 79.6478.7296 | F: +44 20 7061 2201
juc...@st... | www.strozfriedberg.com

This message and/or its attachments may contain information that is confidential and/or protected by privilege from disclosure. If you have reason to believe you are not the intended recipient, please immediately notify the sender by reply e-mail or by telephone, then delete this message (and any attachments), as well as all copies, including any printed copies. Thank you.

Stroz Friedberg Limited is a company registered in England and Wales No: 4150500, Registered office: Capital House, 85 King William Street, London EC4N 7BL, VAT registration No: 783 1701 29.

Re: [sleuthkit-users] Autopsy portable case

[Nanni B. <dig...@gm...>]

Thank you ;)

2017-01-09 15:53 GMT+01:00 Brian Carrier <ca...@sl...>:

> Hi Nanni,
>
> The original intention was that the case could be moved around. It’s a bug
> that you can’t. We’ll fix that.
>
> Quick background: Autopsy used to find the database in the case folder no
> matter where it was moved to, but we now provide more details in the case
> file because the DB can be in a remote PostgreSQL system.  It’s a bug that
> we are specifying the full path instead of the relative path.
>
>
>
> > On Jan 7, 2017, at 3:51 AM, Nanni Bassetti <dig...@gm...> wrote:
> >
> > Hi all,
> > I saw that if I create a case then I want to give it or to move it to
> another computer, I have to change manually the file .aut, changing the
> database path, and then Autopsy runs the case but it ask the new path of
> the image file.
> > Is it possible to have the same GUI for the .aut file instead of using
> the notepad editor?
> > Thanks
> >
> > --
> > Dott. Nanni Bassetti
> > http://www.nannibassetti.com
> > CAINE project manager - http://www.caine-live.net
> > ------------------------------------------------------------
> ------------------
> > Check out the vibrant tech community on one of the world's most
> > engaging tech sites, SlashDot.org! http://sdm.link/slashdot______
> _________________________________________
> > sleuthkit-users mailing list
> > https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> > http://www.sleuthkit.org
>
>


-- 
Dott. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net

Re: [sleuthkit-users] Autopsy portable case

[Brian C. <ca...@sl...>]

Hi Nanni,

The original intention was that the case could be moved around. It’s a bug that you can’t. We’ll fix that.  

Quick background: Autopsy used to find the database in the case folder no matter where it was moved to, but we now provide more details in the case file because the DB can be in a remote PostgreSQL system.  It’s a bug that we are specifying the full path instead of the relative path.



> On Jan 7, 2017, at 3:51 AM, Nanni Bassetti <dig...@gm...> wrote:
> 
> Hi all,
> I saw that if I create a case then I want to give it or to move it to another computer, I have to change manually the file .aut, changing the database path, and then Autopsy runs the case but it ask the new path of the image file. 
> Is it possible to have the same GUI for the .aut file instead of using the notepad editor?
> Thanks
> 
> -- 
> Dott. Nanni Bassetti
> http://www.nannibassetti.com
> CAINE project manager - http://www.caine-live.net
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most 
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] Autopsy portable case

[Nanni B. <dig...@gm...>]

Hi all,
I saw that if I create a case then I want to give it or to move it to
another computer, I have to change manually the file .aut, changing the
database path, and then Autopsy runs the case but it ask the new path of
the image file.
Is it possible to have the same GUI for the .aut file instead of using the
notepad editor?
Thanks

-- 
Dott. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net

Re: [sleuthkit-users] Error to generate report.

[Danilo M. <da...@gm...>]

Nevermind, I downloaded the version 4.2.0 and I got success to generate the
report.

2016-12-26 17:36 GMT-02:00 Danilo Marques <da...@gm...>:

> Autopsy versions: 4.1.1 / 4.1.0
> Workstation: HP Z820 running Windows 10 Pro x64
>
> When I try to generate a report, with a set of tagged files, Autopsy
> returns a java.lang.NullPointerException and the application get stuck,
> then I have to shutdown it.
>
> I have attached the autopsy_traces.log.2.7z
> ---
> Danilo Caio Marcucci Marques
> Computer Forensic Investigator - ICCE-DGPTC/PCERJ/Brazil
> Linux user #419162
> [image: MyFreeCopyright.com Registered & Protected]
> <http://www.myfreecopyright.com/registered_mcn/CEM82_BNX21_KQM8A>
>



-- 
---
Danilo Caio Marcucci Marques
Computer Forensic Investigator - ICCE-DGPTC/PCERJ/Brazil
Linux user #419162
[image: MyFreeCopyright.com Registered & Protected]
<http://www.myfreecopyright.com/registered_mcn/CEM82_BNX21_KQM8A>

[sleuthkit-users] Error to generate report.

[Danilo M. <da...@gm...>]

Autopsy versions: 4.1.1 / 4.1.0
Workstation: HP Z820 running Windows 10 Pro x64

When I try to generate a report, with a set of tagged files, Autopsy
returns a java.lang.NullPointerException and the application get stuck,
then I have to shutdown it.

I have attached the autopsy_traces.log.2.7z
---
Danilo Caio Marcucci Marques
Computer Forensic Investigator - ICCE-DGPTC/PCERJ/Brazil
Linux user #419162
[image: MyFreeCopyright.com Registered & Protected]
<http://www.myfreecopyright.com/registered_mcn/CEM82_BNX21_KQM8A>

Re: [sleuthkit-users] Solr / RegExp Update and Survey

[Nanni B. <dig...@gm...>]

Option1 for sure! :)

2016-12-09 12:19 GMT+01:00 bolo dev <bol...@gm...>:

> Option 1 for a major version number
> Option 2 (read-only) could start the road to bloat.
>
> On Tue, Dec 6, 2016 at 2:59 PM, Brian Carrier <ca...@sl...>
> wrote:
>
>> I have an update Solr / Elastic / regular expression work and a question
>> about backward compatibility.
>>
>> Update: We’re sticking with Solr and will be breaking text into 32KB
>> chunks to use a different regular expression searching approach that gives
>> us better results. It is actually faster than before!
>>
>> Question: How much backward compatibility are people expecting? We have
>> three general options:
>> - no backward compatibility: You need to have  Autopsy 4.2 to open
>> existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to
>> call this release Autopsy 5 to make it clear what can open what. I’m not
>> sure there are enough new features to justify such a major version increase.
>> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s
>> call it 4.3), but only searched.  You can’t add new data sources to it and
>> it would have the old regular expression searching. If you need to add Data
>> Sources, open the case up in 4.2.
>> - fully: Autopsy converts the old schema to the new schema (a time
>> intensive process). You could open Autopsy cases originally created with
>> 4.2 in 4.3 and add to them.
>>
>> I’ll bias this thread by saying my preference is the read-only approach.
>> It’s the least amount of work to provide some level of backward
>> compatibility.  Historically, we have always upgraded cases to work with
>> new versions of Autopsy.  This is just a lot of work to fully upgrade and
>> it isn’t clear that there is a lot of value in doing it.
>>
>> Who would be sad if we did the read-only approach?
>>
>>
>> ------------------------------------------------------------
>> ------------------
>> Developer Access Program for Intel Xeon Phi Processors
>> Access to Intel Xeon Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/xeonphi
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>


-- 
Dott. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net

Re: [sleuthkit-users] Solr / RegExp Update and Survey

[bolo d. <bol...@gm...>]

Option 1 for a major version number
Option 2 (read-only) could start the road to bloat.

On Tue, Dec 6, 2016 at 2:59 PM, Brian Carrier <ca...@sl...> wrote:

> I have an update Solr / Elastic / regular expression work and a question
> about backward compatibility.
>
> Update: We’re sticking with Solr and will be breaking text into 32KB
> chunks to use a different regular expression searching approach that gives
> us better results. It is actually faster than before!
>
> Question: How much backward compatibility are people expecting? We have
> three general options:
> - no backward compatibility: You need to have  Autopsy 4.2 to open
> existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to
> call this release Autopsy 5 to make it clear what can open what. I’m not
> sure there are enough new features to justify such a major version increase.
> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s
> call it 4.3), but only searched.  You can’t add new data sources to it and
> it would have the old regular expression searching. If you need to add Data
> Sources, open the case up in 4.2.
> - fully: Autopsy converts the old schema to the new schema (a time
> intensive process). You could open Autopsy cases originally created with
> 4.2 in 4.3 and add to them.
>
> I’ll bias this thread by saying my preference is the read-only approach.
> It’s the least amount of work to provide some level of backward
> compatibility.  Historically, we have always upgraded cases to work with
> new versions of Autopsy.  This is just a lot of work to fully upgrade and
> it isn’t clear that there is a lot of value in doing it.
>
> Who would be sad if we did the read-only approach?
>
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] R: Solr / RegExp Update and Survey

[Alessandro <ale...@gm...>]

For me, option 1 is good.
Like Alessandro Fiorenzi, I'd like to download the 4.2 release if needed.

Alessandro

On 12/08/2016 06:11 PM, Richard McCutcheon wrote:
> I vote for Option 2 (read-on), but would request that the new Autopsy
> version be incremented a whole number (to 5.0) to make it easy to
> ascertain which versions will be read-only.
> 
> On Tue, Dec 6, 2016 at 5:07 PM, Alessandro Fiorenzi
> <ale...@al...> wrote:
>> Autopsy is big project and I really prefer to have improvement of
>> performance or new feature instead of having  backword compatibility.
>> So for me option 1 is good  if all old version wil still be available as
>> today on https://sourceforge.net/projects/autopsy/files/autopsy/
>>
>>
>> Dott. Alessandro Fiorenzi
>> www.studiofiorenzi.it
>> af...@st... / +39 3487920172
>>
>> Studio Fiorenzi  - Security & Forensics
>> Tel  0550351263
>> Vai Daniele Manin, 50 50019 Sesto Fiorentino
>> http://www.studiofiorenzi.it
>> IMPORTANTE: questa e-mail (inclusi tutti gli allegati) è inviata dallo
>> Studio Informatica Forense Fiorenzi Alessandro e può contenere informazioni
>> riservate soggette a segreto professionale. Essa può essere letta, copiata e
>> usata solo dal destinatario indicato e non deve essere ritrasmessa con
>> modifiche senza il nostro consenso. Se l'avete ricevuta per errore, Vi
>> preghiamo di contattarci per e-mail o telefono e, quindi, di distruggerla
>> senza mostrarla ad alcun estraneo. La sicurezza e l'affidabilità  delle
>> e-mail non è garantita. Noi adottiamo programmi anti virus, ma decliniamo
>> ogni responsabilità  in ordine alla prevenzione degli eventuali virus.
>>
>>
>> -----Messaggio originale-----
>> Da: Brian Carrier [mailto:ca...@sl...]
>> Inviato: martedì 6 dicembre 2016 16.00
>> A: sle...@li... users
>> <sle...@li...>
>> Oggetto: [sleuthkit-users] Solr / RegExp Update and Survey
>>
>> I have an update Solr / Elastic / regular expression work and a question
>> about backward compatibility.
>>
>> Update: We’re sticking with Solr and will be breaking text into 32KB chunks
>> to use a different regular expression searching approach that gives us
>> better results. It is actually faster than before!
>>
>> Question: How much backward compatibility are people expecting? We have
>> three general options:
>> - no backward compatibility: You need to have  Autopsy 4.2 to open existing
>> 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this
>> release Autopsy 5 to make it clear what can open what. I’m not sure there
>> are enough new features to justify such a major version increase.
>> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call
>> it 4.3), but only searched.  You can’t add new data sources to it and it
>> would have the old regular expression searching. If you need to add Data
>> Sources, open the case up in 4.2.
>> - fully: Autopsy converts the old schema to the new schema (a time intensive
>> process). You could open Autopsy cases originally created with 4.2 in 4.3
>> and add to them.
>>
>> I’ll bias this thread by saying my preference is the read-only approach. It’s
>> the least amount of work to provide some level of backward compatibility.
>> Historically, we have always upgraded cases to work with new versions of
>> Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear
>> that there is a lot of value in doing it.
>>
>> Who would be sad if we did the read-only approach?
>>
>>
>> ------------------------------------------------------------------------------
>> Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
>> Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/xeonphi
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>> ------------------------------------------------------------------------------
>> Developer Access Program for Intel Xeon Phi Processors
>> Access to Intel Xeon Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/xeonphi
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 


-- 
Alessandro

Re: [sleuthkit-users] R: Solr / RegExp Update and Survey

[Richard M. <ma...@ma...>]

I vote for Option 2 (read-on), but would request that the new Autopsy
version be incremented a whole number (to 5.0) to make it easy to
ascertain which versions will be read-only.

On Tue, Dec 6, 2016 at 5:07 PM, Alessandro Fiorenzi
<ale...@al...> wrote:
> Autopsy is big project and I really prefer to have improvement of
> performance or new feature instead of having  backword compatibility.
> So for me option 1 is good  if all old version wil still be available as
> today on https://sourceforge.net/projects/autopsy/files/autopsy/
>
>
> Dott. Alessandro Fiorenzi
> www.studiofiorenzi.it
> af...@st... / +39 3487920172
>
> Studio Fiorenzi  - Security & Forensics
> Tel  0550351263
> Vai Daniele Manin, 50 50019 Sesto Fiorentino
> http://www.studiofiorenzi.it
> IMPORTANTE: questa e-mail (inclusi tutti gli allegati) è inviata dallo
> Studio Informatica Forense Fiorenzi Alessandro e può contenere informazioni
> riservate soggette a segreto professionale. Essa può essere letta, copiata e
> usata solo dal destinatario indicato e non deve essere ritrasmessa con
> modifiche senza il nostro consenso. Se l'avete ricevuta per errore, Vi
> preghiamo di contattarci per e-mail o telefono e, quindi, di distruggerla
> senza mostrarla ad alcun estraneo. La sicurezza e l'affidabilità  delle
> e-mail non è garantita. Noi adottiamo programmi anti virus, ma decliniamo
> ogni responsabilità  in ordine alla prevenzione degli eventuali virus.
>
>
> -----Messaggio originale-----
> Da: Brian Carrier [mailto:ca...@sl...]
> Inviato: martedì 6 dicembre 2016 16.00
> A: sle...@li... users
> <sle...@li...>
> Oggetto: [sleuthkit-users] Solr / RegExp Update and Survey
>
> I have an update Solr / Elastic / regular expression work and a question
> about backward compatibility.
>
> Update: We’re sticking with Solr and will be breaking text into 32KB chunks
> to use a different regular expression searching approach that gives us
> better results. It is actually faster than before!
>
> Question: How much backward compatibility are people expecting? We have
> three general options:
> - no backward compatibility: You need to have  Autopsy 4.2 to open existing
> 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this
> release Autopsy 5 to make it clear what can open what. I’m not sure there
> are enough new features to justify such a major version increase.
> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call
> it 4.3), but only searched.  You can’t add new data sources to it and it
> would have the old regular expression searching. If you need to add Data
> Sources, open the case up in 4.2.
> - fully: Autopsy converts the old schema to the new schema (a time intensive
> process). You could open Autopsy cases originally created with 4.2 in 4.3
> and add to them.
>
> I’ll bias this thread by saying my preference is the read-only approach. It’s
> the least amount of work to provide some level of backward compatibility.
> Historically, we have always upgraded cases to work with new versions of
> Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear
> that there is a lot of value in doing it.
>
> Who would be sad if we did the read-only approach?
>
>
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
> Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

[sleuthkit-users] R: Solr / RegExp Update and Survey

[Alessandro F. <ale...@al...>]

Autopsy is big project and I really prefer to have improvement of
performance or new feature instead of having  backword compatibility.
So for me option 1 is good  if all old version wil still be available as
today on https://sourceforge.net/projects/autopsy/files/autopsy/


Dott. Alessandro Fiorenzi
www.studiofiorenzi.it
af...@st... / +39 3487920172

Studio Fiorenzi  - Security & Forensics
Tel  0550351263
Vai Daniele Manin, 50 50019 Sesto Fiorentino
http://www.studiofiorenzi.it
IMPORTANTE: questa e-mail (inclusi tutti gli allegati) è inviata dallo
Studio Informatica Forense Fiorenzi Alessandro e può contenere informazioni
riservate soggette a segreto professionale. Essa può essere letta, copiata e
usata solo dal destinatario indicato e non deve essere ritrasmessa con
modifiche senza il nostro consenso. Se l'avete ricevuta per errore, Vi
preghiamo di contattarci per e-mail o telefono e, quindi, di distruggerla
senza mostrarla ad alcun estraneo. La sicurezza e l'affidabilità  delle
e-mail non è garantita. Noi adottiamo programmi anti virus, ma decliniamo
ogni responsabilità  in ordine alla prevenzione degli eventuali virus.


-----Messaggio originale-----
Da: Brian Carrier [mailto:ca...@sl...]
Inviato: martedì 6 dicembre 2016 16.00
A: sle...@li... users
<sle...@li...>
Oggetto: [sleuthkit-users] Solr / RegExp Update and Survey

I have an update Solr / Elastic / regular expression work and a question
about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks
to use a different regular expression searching approach that gives us
better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have
three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing
4.2 cases.  Existing cases are not upgraded. We’d probably need to call this
release Autopsy 5 to make it clear what can open what. I’m not sure there
are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call
it 4.3), but only searched.  You can’t add new data sources to it and it
would have the old regular expression searching. If you need to add Data
Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive
process). You could open Autopsy cases originally created with 4.2 in 4.3
and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s
the least amount of work to provide some level of backward compatibility.
Historically, we have always upgraded cases to work with new versions of
Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear
that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org