IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
884
stars
209
forks
source link
Add a separate Timeline table to replace the Timeline view/clock ? #2143
At first I decided to create a switch button to change the main table to timeline view (it is a small clock at the table top-right) because of memory consumption concerns: another item table will use more heap memory, that may be an issue with huge cases with dozens of millions of items. But I understand that when a filter is applied (term search, category, combo filter, etc), if the user finds an useful artifact and wants to see adjacent events, those events probably will be filtered out. It is possible to check the item of interest, clear all filters, sort by checkbox, select the artifact of interest again and finally sort by timestamp, then the user will see adjacent events, but a more straightforward way to see surrounding events could make user's life easier. Displaying them in another table is an option. But when selecting an item on main table, scrolling to the event on the timeline table couldn't be done automatically, because the artifact could have many different associated events, the user would need to click on a context option and select the timestamp of interest. The opposite is easy: from the separate timeline table view, there is just one item to automatically scroll to on the main table and rendered in the viewer.
So, my question for devs and contributors: should we create a separate timeline table view and pay the (maybe not that big) memory cost associated with it (maybe allocate the memory structures just when the new tab is used/rendered), or should we keep current "clock switch" approach, hidden and unknown by many users, where it is possible to see surrounding events with some UI interactions that most users don't know?
PS: Current Timeline tab should be renamed to TimeChart
Quoting https://github.com/sepinf-inc/IPED/discussions/1304#discussioncomment-3666616:
At first I decided to create a switch button to change the main table to timeline view (it is a small clock at the table top-right) because of memory consumption concerns: another item table will use more heap memory, that may be an issue with huge cases with dozens of millions of items. But I understand that when a filter is applied (term search, category, combo filter, etc), if the user finds an useful artifact and wants to see adjacent events, those events probably will be filtered out. It is possible to check the item of interest, clear all filters, sort by checkbox, select the artifact of interest again and finally sort by timestamp, then the user will see adjacent events, but a more straightforward way to see surrounding events could make user's life easier. Displaying them in another table is an option. But when selecting an item on main table, scrolling to the event on the timeline table couldn't be done automatically, because the artifact could have many different associated events, the user would need to click on a context option and select the timestamp of interest. The opposite is easy: from the separate timeline table view, there is just one item to automatically scroll to on the main table and rendered in the viewer.
So, my question for devs and contributors: should we create a separate timeline table view and pay the (maybe not that big) memory cost associated with it (maybe allocate the memory structures just when the new tab is used/rendered), or should we keep current "clock switch" approach, hidden and unknown by many users, where it is possible to see surrounding events with some UI interactions that most users don't know?
PS: Current Timeline tab should be renamed to TimeChart