sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
884 stars 209 forks source link

Alternative method to view chat media details #2206

Open wladimirleite opened 1 month ago

wladimirleite commented 1 month ago

This was requested by several users here...

When analysing WhatsApp chats (or any chats), once an important media is found, the user wants to get more details about it, like the file name and hash. So the initial request was to add the media's file name and hash to the chat preview. That wouldn't be a good solution, as the chat preview would be bloated, and sometimes there are more than one linked file (same hash, but different paths/file names).

I suggested using the checkbox, maybe together with the existing "References" tab, but there are a few issues. When there are many media files in a chat, it is not easy to find the ones that were checked. That could be overcome, but the other issue is that once you click on an item of the references tab (to view its details), you lose the point you are in the chat, which may be long, and that is inconvenient. What I do myself is just check all important media in the chat, and once I finish, I filter checked items and then pick details, add them to bookmarks etc. But that is also not very straightforward when there are many checked items, especially audios, which are not easy to identify/memorize as images/videos/PDFs.

So I came up with an alternative approach that would help in this case and hopefully others (like P2P reports). Close to the checkbox, there would be a new "button", that would show all items associated with that particular media in a new panel, together with their basic metadata and preview. It would be an "auxiliary view".

The premise would be to have a simple user interface, minimal changes in existing code and keep current features (i.e. do not replace or change existing panels/features).

I implemented a minimal working version (changing only WhatsApp chats) and have been using it for analysing a couple of real cases, and it has been useful so far.

@lfcnassif, what are your thoughts? Do you see other ways of achieving the requested goal with the existing features?

In a second step, I plan to add a way (through context menu) to add items from the secondary tables (like this new one, references and referenced by) to bookmark (and possibly remove from bookmarks).

The metadata and preview were added to single panel (together with list of items), so they would always be together, to avoid confusion with the "main" selected/displayed item.

A screenshot: image

lfcnassif commented 1 month ago

Hi @wladimirleite,

This kind of analysis should be enhanced for sure, I see current limitations.

What about adding sorting columns to current references panels (checkbox and name, maybe others) and a new button to the Viewer to return back to the previous viewed file/chat that also tracks and scrolls to the previous chat point?

It wouldn't be possible to view media details while viewing the chat context at the same time, that's the one limitation I see with this approach, but I think it would be intuitive for users and would keep the UI simple like today (I like simplicity, if it works of course). That would also avoid changing all current chat parsers. Thoughts?

About creating bookmarks from the auxiliary panels, that is an old must to have and I totally agree with it.

lfcnassif commented 1 month ago

I think the solution to be chosen could also be useful to analyze email attachments and other subitems too.

lfcnassif commented 1 month ago

And I also have already thought to offer the gallery view into the current auxiliary panels, but that is for a different purpose: make it easier to analyze all chat medias without missing current UI state.

wladimirleite commented 1 month ago

What about adding sorting columns to current references panels (checkbox and name, maybe others) and a new button to the Viewer to return back to the previous viewed file/chat that also tracks and scrolls to the previous chat point?

That seems a good option, but I am not sure if it would be intuitive and practical viewing media details and then returning to chat, as it would require a few steps like checking the media, finding it in the references tab, selecting it, swapping to metadata (e.g. if you want to copy its hash), then going back to the chat position (clicking the new button), perhaps selecting preview tab (could be automatic), and possibly unchecking the item (after looking at media details, perhaps checking it is not desired). Another less relevant detail would be how to deal with multiple referenced files (checking in the chat would check all items, which may not be the desired action). But I agree that if we can find a solution using the current panels it would be better.

Many users don't even know how to use the references tab. Not sure if they will figure out how to follow the steps to get the information they need and return to the chat. In the solution I thought about, their focus will continue in the chat preview, which they are comfortable with. They won't need to "interact with" the other tabs. Obviously that is my impression, which may not be the same for other users.

That would also avoid changing all current chat parsers.

Well, it is basically a one line change.

lfcnassif commented 1 month ago

I agree with all your points @wladimirleite.

Just another ideia trying to reuse current panels: what about adding those basic properties as more columns in the references tabs? Maybe the user could also customize the columns... And when clicking on the media in the chat (or on your new message button), select and scroll down to the media row in the references tab?

lfcnassif commented 1 month ago

And when clicking on the media in the chat (or on your new message button), select and scroll down to the media row in the references tab?

Sorry, I forgot there can be multiple items with the same hash...