Solr / RegExp Update and Survey

classic Classic list List threaded Threaded
11 messages Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Solr / RegExp Update and Survey

Brian Carrier-2
I have an update Solr / Elastic / regular expression work and a question about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?  


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Solr / RegExp Update and Survey

Derrick Karpo
I'd be happy with either the first or second approach but would opt for no backwards compatibility, at least for the way we use it. Since each Autopsy version installs standalone in its own directory we typically keep multiple installs going and rarely upgrade mid-case. Once a case is started with a specific version we'll stick with it pending no major issues.

Derrick

On Tue, Dec 6, 2016 at 08:04 Brian Carrier <[hidden email]> wrote:
I have an update Solr / Elastic / regular expression work and a question about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Solr / RegExp Update and Survey

slo.sleuth@gmail.com
I second the motion. 

Sent from my iPhone

On Dec 6, 2016, at 07:22, Derrick Karpo <[hidden email]> wrote:

I'd be happy with either the first or second approach but would opt for no backwards compatibility, at least for the way we use it. Since each Autopsy version installs standalone in its own directory we typically keep multiple installs going and rarely upgrade mid-case. Once a case is started with a specific version we'll stick with it pending no major issues.

Derrick

On Tue, Dec 6, 2016 at 08:04 Brian Carrier <[hidden email]> wrote:
I have an update Solr / Elastic / regular expression work and a question about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Solr / RegExp Update and Survey

Danilo Marques
In reply to this post by Brian Carrier-2
Option 1.
Autopsy lets to keep earlier versions, so it wouldn't a big deal to open old cases up with proper old ones. 

Em 6 de dez de 2016 13:01, "Brian Carrier" <[hidden email]> escreveu:
I have an update Solr / Elastic / regular expression work and a question about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Solr / RegExp Update and Survey

MATT PIERCE
In reply to this post by Brian Carrier-2
Thank you for all the hard work you put in.  I am perfectly OK with breaking backwards compatibility.  I would hope that the tool recognizes older case types and warns the user of the issue.  It would be great if the user were able to create a new case based on the old case source data to fit the new capabilities.

-----Original Message-----
From: Brian Carrier [mailto:[hidden email]]
Sent: Tuesday, December 6, 2016 9:00 AM
To: [hidden email] users <[hidden email]>
Subject: [sleuthkit-users] Solr / RegExp Update and Survey

I have an update Solr / Elastic / regular expression work and a question about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?  


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi _______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Solr / RegExp Update and Survey

Hoyt Harness
In reply to this post by Brian Carrier-2
My vote is option 2 - Read Only. I think a minor incrementation shouldn't totally abandon work product from any release of the same major version, so no option 1. As long as it's clear that older v4 cases will be read-only and the previous minor release version should be retained (or re-downloaded), that should be fine. Option 3 is probably not worth the effort.

Hoyt

On Dec 6, 2016 9:04 AM, "Brian Carrier" <[hidden email]> wrote:
I have an update Solr / Elastic / regular expression work and a question about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

R: Solr / RegExp Update and Survey

Alessandro Fiorenzi
In reply to this post by Brian Carrier-2
Autopsy is big project and I really prefer to have improvement of
performance or new feature instead of having  backword compatibility.
So for me option 1 is good  if all old version wil still be available as
today on https://sourceforge.net/projects/autopsy/files/autopsy/


Dott. Alessandro Fiorenzi
www.studiofiorenzi.it
[hidden email] / +39 3487920172

Studio Fiorenzi  - Security & Forensics
Tel  0550351263
Vai Daniele Manin, 50 50019 Sesto Fiorentino
http://www.studiofiorenzi.it
IMPORTANTE: questa e-mail (inclusi tutti gli allegati) è inviata dallo
Studio Informatica Forense Fiorenzi Alessandro e può contenere informazioni
riservate soggette a segreto professionale. Essa può essere letta, copiata e
usata solo dal destinatario indicato e non deve essere ritrasmessa con
modifiche senza il nostro consenso. Se l'avete ricevuta per errore, Vi
preghiamo di contattarci per e-mail o telefono e, quindi, di distruggerla
senza mostrarla ad alcun estraneo. La sicurezza e l'affidabilità  delle
e-mail non è garantita. Noi adottiamo programmi anti virus, ma decliniamo
ogni responsabilità  in ordine alla prevenzione degli eventuali virus.


-----Messaggio originale-----
Da: Brian Carrier [mailto:[hidden email]]
Inviato: martedì 6 dicembre 2016 16.00
A: [hidden email] users
<[hidden email]>
Oggetto: [sleuthkit-users] Solr / RegExp Update and Survey

I have an update Solr / Elastic / regular expression work and a question
about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks
to use a different regular expression searching approach that gives us
better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have
three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing
4.2 cases.  Existing cases are not upgraded. We’d probably need to call this
release Autopsy 5 to make it clear what can open what. I’m not sure there
are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call
it 4.3), but only searched.  You can’t add new data sources to it and it
would have the old regular expression searching. If you need to add Data
Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive
process). You could open Autopsy cases originally created with 4.2 in 4.3
and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s
the least amount of work to provide some level of backward compatibility.
Historically, we have always upgraded cases to work with new versions of
Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear
that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: R: Solr / RegExp Update and Survey

Richard McCutcheon II
I vote for Option 2 (read-on), but would request that the new Autopsy
version be incremented a whole number (to 5.0) to make it easy to
ascertain which versions will be read-only.

On Tue, Dec 6, 2016 at 5:07 PM, Alessandro Fiorenzi
<[hidden email]> wrote:

> Autopsy is big project and I really prefer to have improvement of
> performance or new feature instead of having  backword compatibility.
> So for me option 1 is good  if all old version wil still be available as
> today on https://sourceforge.net/projects/autopsy/files/autopsy/
>
>
> Dott. Alessandro Fiorenzi
> www.studiofiorenzi.it
> [hidden email] / +39 3487920172
>
> Studio Fiorenzi  - Security & Forensics
> Tel  0550351263
> Vai Daniele Manin, 50 50019 Sesto Fiorentino
> http://www.studiofiorenzi.it
> IMPORTANTE: questa e-mail (inclusi tutti gli allegati) è inviata dallo
> Studio Informatica Forense Fiorenzi Alessandro e può contenere informazioni
> riservate soggette a segreto professionale. Essa può essere letta, copiata e
> usata solo dal destinatario indicato e non deve essere ritrasmessa con
> modifiche senza il nostro consenso. Se l'avete ricevuta per errore, Vi
> preghiamo di contattarci per e-mail o telefono e, quindi, di distruggerla
> senza mostrarla ad alcun estraneo. La sicurezza e l'affidabilità  delle
> e-mail non è garantita. Noi adottiamo programmi anti virus, ma decliniamo
> ogni responsabilità  in ordine alla prevenzione degli eventuali virus.
>
>
> -----Messaggio originale-----
> Da: Brian Carrier [mailto:[hidden email]]
> Inviato: martedì 6 dicembre 2016 16.00
> A: [hidden email] users
> <[hidden email]>
> Oggetto: [sleuthkit-users] Solr / RegExp Update and Survey
>
> I have an update Solr / Elastic / regular expression work and a question
> about backward compatibility.
>
> Update: We’re sticking with Solr and will be breaking text into 32KB chunks
> to use a different regular expression searching approach that gives us
> better results. It is actually faster than before!
>
> Question: How much backward compatibility are people expecting? We have
> three general options:
> - no backward compatibility: You need to have  Autopsy 4.2 to open existing
> 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this
> release Autopsy 5 to make it clear what can open what. I’m not sure there
> are enough new features to justify such a major version increase.
> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call
> it 4.3), but only searched.  You can’t add new data sources to it and it
> would have the old regular expression searching. If you need to add Data
> Sources, open the case up in 4.2.
> - fully: Autopsy converts the old schema to the new schema (a time intensive
> process). You could open Autopsy cases originally created with 4.2 in 4.3
> and add to them.
>
> I’ll bias this thread by saying my preference is the read-only approach. It’s
> the least amount of work to provide some level of backward compatibility.
> Historically, we have always upgraded cases to work with new versions of
> Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear
> that there is a lot of value in doing it.
>
> Who would be sad if we did the read-only approach?
>
>
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
> Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: R: Solr / RegExp Update and Survey

Alessandro De Vito
For me, option 1 is good.
Like Alessandro Fiorenzi, I'd like to download the 4.2 release if needed.

Alessandro

On 12/08/2016 06:11 PM, Richard McCutcheon wrote:

> I vote for Option 2 (read-on), but would request that the new Autopsy
> version be incremented a whole number (to 5.0) to make it easy to
> ascertain which versions will be read-only.
>
> On Tue, Dec 6, 2016 at 5:07 PM, Alessandro Fiorenzi
> <[hidden email]> wrote:
>> Autopsy is big project and I really prefer to have improvement of
>> performance or new feature instead of having  backword compatibility.
>> So for me option 1 is good  if all old version wil still be available as
>> today on https://sourceforge.net/projects/autopsy/files/autopsy/
>>
>>
>> Dott. Alessandro Fiorenzi
>> www.studiofiorenzi.it
>> [hidden email] / +39 3487920172
>>
>> Studio Fiorenzi  - Security & Forensics
>> Tel  0550351263
>> Vai Daniele Manin, 50 50019 Sesto Fiorentino
>> http://www.studiofiorenzi.it
>> IMPORTANTE: questa e-mail (inclusi tutti gli allegati) è inviata dallo
>> Studio Informatica Forense Fiorenzi Alessandro e può contenere informazioni
>> riservate soggette a segreto professionale. Essa può essere letta, copiata e
>> usata solo dal destinatario indicato e non deve essere ritrasmessa con
>> modifiche senza il nostro consenso. Se l'avete ricevuta per errore, Vi
>> preghiamo di contattarci per e-mail o telefono e, quindi, di distruggerla
>> senza mostrarla ad alcun estraneo. La sicurezza e l'affidabilità  delle
>> e-mail non è garantita. Noi adottiamo programmi anti virus, ma decliniamo
>> ogni responsabilità  in ordine alla prevenzione degli eventuali virus.
>>
>>
>> -----Messaggio originale-----
>> Da: Brian Carrier [mailto:[hidden email]]
>> Inviato: martedì 6 dicembre 2016 16.00
>> A: [hidden email] users
>> <[hidden email]>
>> Oggetto: [sleuthkit-users] Solr / RegExp Update and Survey
>>
>> I have an update Solr / Elastic / regular expression work and a question
>> about backward compatibility.
>>
>> Update: We’re sticking with Solr and will be breaking text into 32KB chunks
>> to use a different regular expression searching approach that gives us
>> better results. It is actually faster than before!
>>
>> Question: How much backward compatibility are people expecting? We have
>> three general options:
>> - no backward compatibility: You need to have  Autopsy 4.2 to open existing
>> 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this
>> release Autopsy 5 to make it clear what can open what. I’m not sure there
>> are enough new features to justify such a major version increase.
>> - read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call
>> it 4.3), but only searched.  You can’t add new data sources to it and it
>> would have the old regular expression searching. If you need to add Data
>> Sources, open the case up in 4.2.
>> - fully: Autopsy converts the old schema to the new schema (a time intensive
>> process). You could open Autopsy cases originally created with 4.2 in 4.3
>> and add to them.
>>
>> I’ll bias this thread by saying my preference is the read-only approach. It’s
>> the least amount of work to provide some level of backward compatibility.
>> Historically, we have always upgraded cases to work with new versions of
>> Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear
>> that there is a lot of value in doing it.
>>
>> Who would be sad if we did the read-only approach?
>>
>>
>> ------------------------------------------------------------------------------
>> Developer Access Program for Intel Xeon Phi Processors Access to Intel Xeon
>> Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/xeonphi
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>>
>> ------------------------------------------------------------------------------
>> Developer Access Program for Intel Xeon Phi Processors
>> Access to Intel Xeon Phi processor-based developer platforms.
>> With one year of Intel Parallel Studio XE.
>> Training and support from Colfax.
>> Order your platform today.http://sdm.link/xeonphi
>> _______________________________________________
>> sleuthkit-users mailing list
>> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
>> http://www.sleuthkit.org
>
> ------------------------------------------------------------------------------
> Developer Access Program for Intel Xeon Phi Processors
> Access to Intel Xeon Phi processor-based developer platforms.
> With one year of Intel Parallel Studio XE.
> Training and support from Colfax.
> Order your platform today.http://sdm.link/xeonphi
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>


--
Alessandro

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Solr / RegExp Update and Survey

bolo dev
In reply to this post by Brian Carrier-2
Option 1 for a major version number
Option 2 (read-only) could start the road to bloat.

On Tue, Dec 6, 2016 at 2:59 PM, Brian Carrier <[hidden email]> wrote:
I have an update Solr / Elastic / regular expression work and a question about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

Re: Solr / RegExp Update and Survey

Nanni Bassetti
Option1 for sure! :)

2016-12-09 12:19 GMT+01:00 bolo dev <[hidden email]>:
Option 1 for a major version number
Option 2 (read-only) could start the road to bloat.

On Tue, Dec 6, 2016 at 2:59 PM, Brian Carrier <[hidden email]> wrote:
I have an update Solr / Elastic / regular expression work and a question about backward compatibility.

Update: We’re sticking with Solr and will be breaking text into 32KB chunks to use a different regular expression searching approach that gives us better results. It is actually faster than before!

Question: How much backward compatibility are people expecting? We have three general options:
- no backward compatibility: You need to have  Autopsy 4.2 to open existing 4.2 cases.  Existing cases are not upgraded. We’d probably need to call this release Autopsy 5 to make it clear what can open what. I’m not sure there are enough new features to justify such a major version increase.
- read-only: Autopsy 4.2 cases can be opened in the new Autopsy (let’s call it 4.3), but only searched.  You can’t add new data sources to it and it would have the old regular expression searching. If you need to add Data Sources, open the case up in 4.2.
- fully: Autopsy converts the old schema to the new schema (a time intensive process). You could open Autopsy cases originally created with 4.2 in 4.3 and add to them.

I’ll bias this thread by saying my preference is the read-only approach. It’s the least amount of work to provide some level of backward compatibility.  Historically, we have always upgraded cases to work with new versions of Autopsy.  This is just a lot of work to fully upgrade and it isn’t clear that there is a lot of value in doing it.

Who would be sad if we did the read-only approach?


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org


------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org




--
Dott. Nanni Bassetti
CAINE project manager - http://www.caine-live.net

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/xeonphi
_______________________________________________
sleuthkit-users mailing list
https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
http://www.sleuthkit.org
Loading...