sleuthkit-users

[sleuthkit-users] Solr / RegExp Update and Survey

[Brian C. <ca...@sl...>]

I have an update Solr / Elastic / regular expression work and a question about backward compatibility. 

Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before! 

Question: How much backward compatibility are people expecting? We have three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2. 
- fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them. 

I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?  

Re: [sleuthkit-users] Solr / RegExp Update and Survey

[Derrick K. <dk...@gm...>]

I'd be happy with either the first or second approach but would opt for no
backwards compatibility, at least for the way we use it. Since each Autopsy
version installs standalone in its own directory we typically keep multiple
installs going and rarely upgrade mid-case. Once a case is started with a
specific version we'll stick with it pending no major issues.

Derrick

On Tue, Dec 6, 2016 at 08:04 Brian Carrier <ca...@sl...> wrote:

> I have an update Solr / Elastic / regular expression work and a question
> about backward compatibility.
>
> Update: We’re sticking with Solr and will be breaking text into 32KB
> chunks to use a different regular expression searching approach that gives
> us better results. It is actually faster than before!
>
> Question: How much backward compatibility are people expecting? We have
> three general options:
> - no backward compatibility: You need to have  Autopsy 4.2 to open
> existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to
> call this release Autopsy 5 to make it clear what can open what. I’m not
> sure there are enough new features to justify such a major version increase.
> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s
> call it 4.3), but only searched.  You can’t add new data sources to it and
> it would have the old regular expression searching. If you need to add Data
> Sources, open the case up in 4.2.
> - fully: Autopsy converts the old schema to the new schema (a time
> intensive process). You could open Autopsy cases originally created with
> 4.2 in 4.3 and add to them.
>
> I’ll bias this thread by saying my preference is the read-only approach.
> It’s the least amount of work to provide some level of backward
> compatibility.  Historically, we have always upgraded cases to work with
> new versions of Autopsy.  This is just a lot of work to fully upgrade and
> it isn’t clear that there is a lot of value in doing it.
>
> Who would be sad if we did the read-only approach?
>
>
>
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] Solr / RegExp Update and Survey

[John L. <slo...@gm...>]

I second the motion. 

Sent from my iPhone

> On Dec 6, 2016, at 07:22, Derrick Karpo <dk...@gm...> wrote:
> 
> I'd be happy with either the first or second approach but would opt for no backwards compatibility, at least for the way we use it.  Since each Autopsy version installs standalone in its own directory we typically keep multiple installs going and rarely upgrade mid-case. Once a case is started with a specific version we'll stick with it pending no major issues.
> 
> Derrick
> 
>> On Tue, Dec 6, 2016 at 08:04 Brian Carrier <ca...@sl...> wrote:
>> I have an update Solr / Elastic / regular expression work and a question about backward compatibility.
>> 
>> Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before!
>> 
>> Question: How much backward compatibility are people expecting? We have three general options:
>> - no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
>> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2.
>> - fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them.
>> 
>> I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.
>> 
>> Who would be sad if we did the read-only approach?
>> 
>> 
>> ------------------------------------------------------------------------------
>> Developer Access Program for Intel Xeon Phi Processors
>> Access to Intel Xeon Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/xeonphi
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] Solr / RegExp Update and Survey

[Danilo M. <da...@gm...>]

Option 1.
Autopsy lets to keep earlier versions, so it wouldn't a big deal to open
old cases up with proper old ones.

Em 6 de dez de 2016 13:01, "Brian Carrier" <ca...@sl...> escreveu:

> I have an update Solr / Elastic / regular expression work and a question
> about backward compatibility.
>
> Update: We’re sticking with Solr and will be breaking text into 32KB
> chunks to use a different regular expression searching approach that gives
> us better results. It is actually faster than before!
>
> Question: How much backward compatibility are people expecting? We have
> three general options:
> - no backward compatibility: You need to have  Autopsy 4.2 to open
> existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to
> call this release Autopsy 5 to make it clear what can open what. I’m not
> sure there are enough new features to justify such a major version increase.
> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s
> call it 4.3), but only searched.  You can’t add new data sources to it and
> it would have the old regular expression searching. If you need to add Data
> Sources, open the case up in 4.2.
> - fully: Autopsy converts the old schema to the new schema (a time
> intensive process). You could open Autopsy cases originally created with
> 4.2 in 4.3 and add to them.
>
> I’ll bias this thread by saying my preference is the read-only approach.
> It’s the least amount of work to provide some level of backward
> compatibility.  Historically, we have always upgraded cases to work with
> new versions of Autopsy.  This is just a lot of work to fully upgrade and
> it isn’t clear that there is a lot of value in doing it.
>
> Who would be sad if we did the read-only approach?
>
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] Solr / RegExp Update and Survey

[MATT P. <mat...@ad...>]

Thank you for all the hard work you put in.  I am perfectly OK with breaking backwards compatibility.  I would hope that the tool recognizes older case types and warns the user of the issue.  It would be great if the user were able to create a new case based on the old case source data to fit the new capabilities.

-----Original Message-----
From: Brian Carrier [mailto:ca...@sl...] 
Sent: Tuesday, December 6, 2016 9:00 AM
To: sle...@li... users <sle...@li...>
Subject: [sleuthkit-users] Solr / RegExp Update and Survey

I have an update Solr / Elastic / regular expression work and a question about backward compatibility. 

Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before! 

Question: How much backward compatibility are people expecting? We have three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2. 
- fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them. 

I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?  


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi _______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] Solr / RegExp Update and Survey

[Hoyt H. <hoy...@gm...>]

My vote is option 2 - Read Only. I think a minor incrementation shouldn't
totally abandon work product from any release of the same major version, so
no option 1. As long as it's clear that older v4 cases will be read-only
and the previous minor release version should be retained (or
re-downloaded), that should be fine. Option 3 is probably not worth the
effort.

Hoyt

On Dec 6, 2016 9:04 AM, "Brian Carrier" <ca...@sl...> wrote:

> I have an update Solr / Elastic / regular expression work and a question
> about backward compatibility.
>
> Update: We’re sticking with Solr and will be breaking text into 32KB
> chunks to use a different regular expression searching approach that gives
> us better results. It is actually faster than before!
>
> Question: How much backward compatibility are people expecting? We have
> three general options:
> - no backward compatibility: You need to have  Autopsy 4.2 to open
> existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to
> call this release Autopsy 5 to make it clear what can open what. I’m not
> sure there are enough new features to justify such a major version increase.
> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s
> call it 4.3), but only searched.  You can’t add new data sources to it and
> it would have the old regular expression searching. If you need to add Data
> Sources, open the case up in 4.2.
> - fully: Autopsy converts the old schema to the new schema (a time
> intensive process). You could open Autopsy cases originally created with
> 4.2 in 4.3 and add to them.
>
> I’ll bias this thread by saying my preference is the read-only approach.
> It’s the least amount of work to provide some level of backward
> compatibility.  Historically, we have always upgraded cases to work with
> new versions of Autopsy.  This is just a lot of work to fully upgrade and
> it isn’t clear that there is a lot of value in doing it.
>
> Who would be sad if we did the read-only approach?
>
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

[sleuthkit-users] R: Solr / RegExp Update and Survey

[Alessandro F. <ale...@al...>]

Autopsy is big project and I really prefer to have improvement of
performance or new feature instead of having  backword compatibility.
So for me option 1 is good  if all old version wil still be available as
today on https://sourceforge.net/projects/autopsy/files/autopsy/


Dott. Alessandro Fiorenzi
www.studiofiorenzi.it
af...@st... / +39 3487920172

Studio Fiorenzi  - Security & Forensics
Tel  0550351263
Vai Daniele Manin, 50 50019 Sesto Fiorentino
http://www.studiofiorenzi.it
IMPORTANTE: questa e-mail (inclusi tutti gli allegati) è inviata dallo
Studio Informatica Forense Fiorenzi Alessandro e può contenere informazioni
riservate soggette a segreto professionale. Essa può essere letta, copiata e
usata solo dal destinatario indicato e non deve essere ritrasmessa con
modifiche senza il nostro consenso. Se l'avete ricevuta per errore, Vi
preghiamo di contattarci per e-mail o telefono e, quindi, di distruggerla
senza mostrarla ad alcun estraneo. La sicurezza e l'affidabilità  delle
e-mail non è garantita. Noi adottiamo programmi anti virus, ma decliniamo
ogni responsabilità  in ordine alla prevenzione degli eventuali virus.


-----Messaggio originale-----
Da: Brian Carrier [mailto:ca...@sl...]
Inviato: martedì 6 dicembre 2016 16.00
A: sle...@li... users
<sle...@li...>
Oggetto: [sleuthkit-users] Solr / RegExp Update and Survey

I have an update Solr / Elastic / regular expression work and a question
about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks
to use a different regular expression searching approach that gives us
better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have
three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing
4.2 cases.  Existing cases are not upgraded. We’d probably need to call this
release Autopsy 5 to make it clear what can open what. I’m not sure there
are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call
it 4.3), but only searched.  You can’t add new data sources to it and it
would have the old regular expression searching. If you need to add Data
Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive
process). You could open Autopsy cases originally created with 4.2 in 4.3
and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s
the least amount of work to provide some level of backward compatibility.
Historically, we have always upgraded cases to work with new versions of
Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear
that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

Re: [sleuthkit-users] R: Solr / RegExp Update and Survey

[Richard M. <ma...@ma...>]

I vote for Option 2 (read-on), but would request that the new Autopsy
version be incremented a whole number (to 5.0) to make it easy to
ascertain which versions will be read-only.

On Tue, Dec 6, 2016 at 5:07 PM, Alessandro Fiorenzi
<ale...@al...> wrote:
> Autopsy is big project and I really prefer to have improvement of
> performance or new feature instead of having  backword compatibility.
> So for me option 1 is good  if all old version wil still be available as
> today on https://sourceforge.net/projects/autopsy/files/autopsy/
>
>
> Dott. Alessandro Fiorenzi
> www.studiofiorenzi.it
> af...@st... / +39 3487920172
>
> Studio Fiorenzi  - Security & Forensics
> Tel  0550351263
> Vai Daniele Manin, 50 50019 Sesto Fiorentino
> http://www.studiofiorenzi.it
> IMPORTANTE: questa e-mail (inclusi tutti gli allegati) è inviata dallo
> Studio Informatica Forense Fiorenzi Alessandro e può contenere informazioni
> riservate soggette a segreto professionale. Essa può essere letta, copiata e
> usata solo dal destinatario indicato e non deve essere ritrasmessa con
> modifiche senza il nostro consenso. Se l'avete ricevuta per errore, Vi
> preghiamo di contattarci per e-mail o telefono e, quindi, di distruggerla
> senza mostrarla ad alcun estraneo. La sicurezza e l'affidabilità  delle
> e-mail non è garantita. Noi adottiamo programmi anti virus, ma decliniamo
> ogni responsabilità  in ordine alla prevenzione degli eventuali virus.
>
>
> -----Messaggio originale-----
> Da: Brian Carrier [mailto:ca...@sl...]
> Inviato: martedì 6 dicembre 2016 16.00
> A: sle...@li... users
> <sle...@li...>
> Oggetto: [sleuthkit-users] Solr / RegExp Update and Survey
>
> I have an update Solr / Elastic / regular expression work and a question
> about backward compatibility.
>
> Update: We’re sticking with Solr and will be breaking text into 32KB chunks
> to use a different regular expression searching approach that gives us
> better results. It is actually faster than before!
>
> Question: How much backward compatibility are people expecting? We have
> three general options:
> - no backward compatibility: You need to have  Autopsy 4.2 to open existing
> 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this
> release Autopsy 5 to make it clear what can open what. I’m not sure there
> are enough new features to justify such a major version increase.
> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call
> it 4.3), but only searched.  You can’t add new data sources to it and it
> would have the old regular expression searching. If you need to add Data
> Sources, open the case up in 4.2.
> - fully: Autopsy converts the old schema to the new schema (a time intensive
> process). You could open Autopsy cases originally created with 4.2 in 4.3
> and add to them.
>
> I’ll bias this thread by saying my preference is the read-only approach. It’s
> the least amount of work to provide some level of backward compatibility.
> Historically, we have always upgraded cases to work with new versions of
> Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear
> that there is a lot of value in doing it.
>
> Who would be sad if we did the read-only approach?
>
>
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
> Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

Re: [sleuthkit-users] R: Solr / RegExp Update and Survey

[Alessandro <ale...@gm...>]

For me, option 1 is good.
Like Alessandro Fiorenzi, I'd like to download the 4.2 release if needed.

Alessandro

On 12/08/2016 06:11 PM, Richard McCutcheon wrote:
> I vote for Option 2 (read-on), but would request that the new Autopsy
> version be incremented a whole number (to 5.0) to make it easy to
> ascertain which versions will be read-only.
> 
> On Tue, Dec 6, 2016 at 5:07 PM, Alessandro Fiorenzi
> <ale...@al...> wrote:
>> Autopsy is big project and I really prefer to have improvement of
>> performance or new feature instead of having  backword compatibility.
>> So for me option 1 is good  if all old version wil still be available as
>> today on https://sourceforge.net/projects/autopsy/files/autopsy/
>>
>>
>> Dott. Alessandro Fiorenzi
>> www.studiofiorenzi.it
>> af...@st... / +39 3487920172
>>
>> Studio Fiorenzi  - Security & Forensics
>> Tel  0550351263
>> Vai Daniele Manin, 50 50019 Sesto Fiorentino
>> http://www.studiofiorenzi.it
>> IMPORTANTE: questa e-mail (inclusi tutti gli allegati) è inviata dallo
>> Studio Informatica Forense Fiorenzi Alessandro e può contenere informazioni
>> riservate soggette a segreto professionale. Essa può essere letta, copiata e
>> usata solo dal destinatario indicato e non deve essere ritrasmessa con
>> modifiche senza il nostro consenso. Se l'avete ricevuta per errore, Vi
>> preghiamo di contattarci per e-mail o telefono e, quindi, di distruggerla
>> senza mostrarla ad alcun estraneo. La sicurezza e l'affidabilità  delle
>> e-mail non è garantita. Noi adottiamo programmi anti virus, ma decliniamo
>> ogni responsabilità  in ordine alla prevenzione degli eventuali virus.
>>
>>
>> -----Messaggio originale-----
>> Da: Brian Carrier [mailto:ca...@sl...]
>> Inviato: martedì 6 dicembre 2016 16.00
>> A: sle...@li... users
>> <sle...@li...>
>> Oggetto: [sleuthkit-users] Solr / RegExp Update and Survey
>>
>> I have an update Solr / Elastic / regular expression work and a question
>> about backward compatibility.
>>
>> Update: We’re sticking with Solr and will be breaking text into 32KB chunks
>> to use a different regular expression searching approach that gives us
>> better results. It is actually faster than before!
>>
>> Question: How much backward compatibility are people expecting? We have
>> three general options:
>> - no backward compatibility: You need to have  Autopsy 4.2 to open existing
>> 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this
>> release Autopsy 5 to make it clear what can open what. I’m not sure there
>> are enough new features to justify such a major version increase.
>> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call
>> it 4.3), but only searched.  You can’t add new data sources to it and it
>> would have the old regular expression searching. If you need to add Data
>> Sources, open the case up in 4.2.
>> - fully: Autopsy converts the old schema to the new schema (a time intensive
>> process). You could open Autopsy cases originally created with 4.2 in 4.3
>> and add to them.
>>
>> I’ll bias this thread by saying my preference is the read-only approach. It’s
>> the least amount of work to provide some level of backward compatibility.
>> Historically, we have always upgraded cases to work with new versions of
>> Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear
>> that there is a lot of value in doing it.
>>
>> Who would be sad if we did the read-only approach?
>>
>>
>> ------------------------------------------------------------------------------
>> Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
>> Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/xeonphi
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>> ------------------------------------------------------------------------------
>> Developer Access Program for Intel Xeon Phi Processors
>> Access to Intel Xeon Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/xeonphi
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
> 
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
> 


-- 
Alessandro

Re: [sleuthkit-users] Solr / RegExp Update and Survey

[bolo d. <bol...@gm...>]

Option 1 for a major version number
Option 2 (read-only) could start the road to bloat.

On Tue, Dec 6, 2016 at 2:59 PM, Brian Carrier <ca...@sl...> wrote:

> I have an update Solr / Elastic / regular expression work and a question
> about backward compatibility.
>
> Update: We’re sticking with Solr and will be breaking text into 32KB
> chunks to use a different regular expression searching approach that gives
> us better results. It is actually faster than before!
>
> Question: How much backward compatibility are people expecting? We have
> three general options:
> - no backward compatibility: You need to have  Autopsy 4.2 to open
> existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to
> call this release Autopsy 5 to make it clear what can open what. I’m not
> sure there are enough new features to justify such a major version increase.
> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s
> call it 4.3), but only searched.  You can’t add new data sources to it and
> it would have the old regular expression searching. If you need to add Data
> Sources, open the case up in 4.2.
> - fully: Autopsy converts the old schema to the new schema (a time
> intensive process). You could open Autopsy cases originally created with
> 4.2 in 4.3 and add to them.
>
> I’ll bias this thread by saying my preference is the read-only approach.
> It’s the least amount of work to provide some level of backward
> compatibility.  Historically, we have always upgraded cases to work with
> new versions of Autopsy.  This is just a lot of work to fully upgrade and
> it isn’t clear that there is a lot of value in doing it.
>
> Who would be sad if we did the read-only approach?
>
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>

Re: [sleuthkit-users] Solr / RegExp Update and Survey

[Nanni B. <dig...@gm...>]

Option1 for sure! :)

2016-12-09 12:19 GMT+01:00 bolo dev <bol...@gm...>:

> Option 1 for a major version number
> Option 2 (read-only) could start the road to bloat.
>
> On Tue, Dec 6, 2016 at 2:59 PM, Brian Carrier <ca...@sl...>
> wrote:
>
>> I have an update Solr / Elastic / regular expression work and a question
>> about backward compatibility.
>>
>> Update: We’re sticking with Solr and will be breaking text into 32KB
>> chunks to use a different regular expression searching approach that gives
>> us better results. It is actually faster than before!
>>
>> Question: How much backward compatibility are people expecting? We have
>> three general options:
>> - no backward compatibility: You need to have  Autopsy 4.2 to open
>> existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to
>> call this release Autopsy 5 to make it clear what can open what. I’m not
>> sure there are enough new features to justify such a major version increase.
>> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s
>> call it 4.3), but only searched.  You can’t add new data sources to it and
>> it would have the old regular expression searching. If you need to add Data
>> Sources, open the case up in 4.2.
>> - fully: Autopsy converts the old schema to the new schema (a time
>> intensive process). You could open Autopsy cases originally created with
>> 4.2 in 4.3 and add to them.
>>
>> I’ll bias this thread by saying my preference is the read-only approach.
>> It’s the least amount of work to provide some level of backward
>> compatibility.  Historically, we have always upgraded cases to work with
>> new versions of Autopsy.  This is just a lot of work to fully upgrade and
>> it isn’t clear that there is a lot of value in doing it.
>>
>> Who would be sad if we did the read-only approach?
>>
>>
>> ------------------------------------------------------------
>> ------------------
>> Developer Access Program for Intel Xeon Phi Processors
>> Access to Intel Xeon Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/xeonphi
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>
>
> ------------------------------------------------------------
> ------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
>


-- 
Dott. Nanni Bassetti
http://www.nannibassetti.com
CAINE project manager - http://www.caine-live.net