search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
924 stars 217 forks source link

New column with item's processing time in a task (#1904) #1907

Closed wladimirleite closed 10 months ago

wladimirleite commented 11 months ago

Closes #1904.

lfcnassif commented 11 months ago

Thank you @tc-wleite! Wouldn't it be better to use evidence ID or evidence object instance itself instead of its path to check if the evidence changed?

wladimirleite commented 11 months ago

Thank you @tc-wleite! Wouldn't it be better to use evidence ID or evidence object instance itself instead of its path to check if the evidence changed?

Yes, I will make this change.

wladimirleite commented 11 months ago

I changed to use the item ID, concatenated with the task name. It would like to avoid holding any references to these objects.

lfcnassif commented 10 months ago

A while ago I realized this may not work so well with CarverTask because it pauses processing the parent item and process carved items immediately in the same Worker, so the new stat of parent items would be reset several times. Not sure if it is a real problem since the goal is to detect long frozen times executing the exact same job. What do you think @tc-wleite?

wladimirleite commented 10 months ago

A while ago I realized this may not work so well with CarverTask because it pauses processing the parent item and process carved items immediately in the same Worker, so the new stat of parent items would be reset several times. Not sure if it is a real problem since the goal is to detect long frozen times executing the exact same job. What do you think @tc-wleite?

The idea was to present some information about how long a task is running for a given item, without adding any control overhead or modifications in tasks' code. In the case you mentioned, the column would show how long it is running the carver task since it switched back to the parent item, not the total time, which seems fine to me.

lfcnassif commented 10 months ago

In the case you mentioned, the column would show how long it is running the carver task since it switched back to the parent item, not the total time, which seems fine to me.

Agreed, seems fine to me too given the goal!

without adding any control overhead or modifications in tasks' code.

I noticed this implementation approach (just local changes) and liked it very much! Thank you @tc-wleite!