search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
893 stars 214 forks source link

Enable Telegram iOS parser for UFDR and expose "extractMessages" parameter for Telegram Parser #2005

Closed wladimirleite closed 5 months ago

wladimirleite commented 7 months ago

As discussed in https://github.com/sepinf-inc/IPED/pull/1999#issuecomment-1833743319.

wladimirleite commented 7 months ago

@lfcnassif, think a little bit more about this, wouldn't it make more sense to control which parser should be used (internal, external or both) per application (not globally as it is today using "phoneParsersToUse" parameter)? For example, if I prefer the internal WhatsApp parser, but for Telegram I would like to use the external one...

Another point, I personally started using "all" sometime ago, and found it the best option, because I have already seen cases where an external parser brought some recovered message and that was not shown in internal parsed chats. And the opposite. Besides that, our WhatsApp parser shows some information not presented in the external parser. The only inconvenience is the duplication of information. Not sure how to deal with this... maybe, it would help if WhatsApp chats (and any type of chat that has both parsing options, like Telegram) have two subcategories, for internally and externally parsed chats.

lfcnassif commented 7 months ago

Hi @wladimirleite! Yes, I have already thought about this and I agree a per parser configuration, into ParserConfig.xml, would be better. We could create a forth possible value for phoneParsersToUse like dynamic or perApplication and use it by default.

About all results, I agree specific subcategories for internal and external would be clearer for users, especially for those that receive already processed cases.

wladimirleite commented 7 months ago

Hi @wladimirleite! Yes, I have already thought about this and I agree a per parser configuration, into ParserConfig.xml, would be better. We could create a fourth possible value for phoneParsersToUse like dynamic or perApplication and use it by default.

About all results, I agree specific subcategories for internal and external would be clearer for users, especially for those that receive already processed cases.

Great! I think we should leave this for future issue, as the current PR (#1999) already mixed a few different things.

lfcnassif commented 5 months ago

Closed by #1999.