sleuthkit-users

Re: [sleuthkit-users] Split Image Question

[Aaron P. <dop...@gm...>]

I think using the native globbing support is an excellent idea.  

As a possible example of the interface, you could start the interface
with a field for entering the directory your image pieces reside in. 
Fill in and Submit.  Next page shows all files in that directory with
check boxes beside each one.  Options are to check or uncheck boxes,
or to use some form of regex to filter and check all files that fit
the filter.  It could be your choice whether you use PCRE or globbing
or whatever.  It really doesn't matter to me.  PCRE is probably more
flexible... Anyway, say you use a filter.  Fill in and click "filter".
 so now on the next page, everything that fits "myimage.*" has it's
check box selected.  But say you picked up some files that weren't
part of the image, so you deselect them.  click "done" and it rebuilds
the image or whatever you have designed for it to do with the pieces
parts.  If you really wanted to, you could have links to move a file
up or down in the order or numbered fields that one could change to
quickly move a file from 39 in the order to 13, but I can't imagine
why anyone would not just have image parts in order...

That's my two cents anyway.

RE: [sleuthkit-users] Split Image Question

[Surago J. <su...@sj...>]

(Meant to send this to the whole group before, doh.)

Hi Brian,

Whilst I haven't required the support of split images yet, I have had to
configure a host with numerous mount points (images), and whilst I was
setting these up I was thinking that it would be significantly quicker
if one could import the details in a text file of some type. =20

In my situation I previously had a text file with the full path names to
the image files, along with the MD5 hash's, so it would be been an
extremely quick step to configure the host if I was able to import the
details from a text file.  With this method it would be rather simple to
import details for split images (And also avoid the need to have
numerous input boxes)

A second option, I'm not sure if it would be possible to implement
easily with the HTML interface in autopsy, would be to include a Browse
button so one could point to the image files rather than having to type
the full path and filename in.  However I have a funny suspicion this
may not be easily implemented whilst keeping the interface compatible
among different browsers.

Cheers

Surago.

-----Original Message-----
From: sle...@li...
[mailto:sle...@li...] On Behalf Of Brian
Carrier
Sent: Tuesday, 1 February 2005 12:27 p.m.
To: 'sle...@li...'
<sle...@li...>
Subject: [sleuthkit-users] Split Image Question

As I was adding the new split image features to Autopsy, I realized that
I do not fully  understand how people use split images.  Is their
purpose so that you can acquire the image in 650MB or 2GB chunks for
burning to disk and then import those images into TSK/Autopsy?




-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time by
over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org