google / turbinia

Automation and Scaling of Digital Forensics Tools
Apache License 2.0
750 stars 163 forks source link

[FR]: Add evidence metadata to redis on upload #1543

Open aarontp opened 2 months ago

aarontp commented 2 months ago

What is the feature you are proposing?

Add the evidence metadata to redis on upload so that after evidence has been uploaded that it can be queried by the command line.

What would this feature improve or what problem would it solve?

This would allow users to query evidence after upload even if it's not processed yet. This may be useful if the upload happens separately from the processing or is done by another user. It also makes it easier for the user to understand what the current evidence state is because if the evidence doesn't show up after querying it looks like an error may have occurred.

What alternatives have you considered?

No response

jleaniz commented 1 month ago

Turbinia currently stores evidence metadata from serialized Evidence objects. When you upload a file manually via the command line without an associated Turbinia Request, an Evidence object is not created. So the only metadata available is a file name, a path and optionally, a file hash. It seems like a bad idea to create a generic Evidence object with just a path attribute to keep track of uploaded files.

We would have to implement a few changes to the way Evidence objects are stored in order to accomplish this. Another option would be to track uploaded files separately from Evidence objects that are associated with actual requests. Maybe that would make more sense?