search

sleuthkit / autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
http://www.sleuthkit.org/autopsy/
2.41k stars 597 forks source link

Feature request: display list of ingest modules run on each disk image #2005

Open kefir- opened 8 years ago

kefir- commented 8 years ago

If this is easily available in Autopsy I've missed it, so here's a feature request:

When analyzing multiple disk images in one Autopsy case, it's easy to lose track of which ingest modules have been run on which disk image. It'd be very useful if there were a way to see which ingest modules have been run on an image. In a table, in a report, or perhaps by color coding the modules when running a new ingest.

I haven't tried the multi-user setup yet, but I'm guessing this would be useful for that too.

rcordovano commented 8 years ago

We have had several requests for this sort of feature. We did a little bit of preliminary design work a few weeks ago, but that work has been temporarily interrupted. A basic version of the feature is easy, but we are looking at whether or not we can include things in the design that will be a first step towards a ingest job recovery capability.