Implement a view and export of all findings about iped HOT 5 OPEN

With "findings" do you mean all keyword search hits from all files? I already have thought about displaying a new column for first hit in each file, that would be generated on demand for current rendered table rows. Exporting all hits from all files currently would be slow, because we do not store indexed text and it will need to be reparsed from a lot of files. Storing indexed text is possible, with the drawback of increasing index size about 3 to 4 times.

from iped.

Hi @lfcnassif, I am not sure what you mean by "storing indexed text". Do you mean in lucene?
Let me explain my use case.
I am searching for specific term and get a file list where the term is found. Now, to check the findings, I need to go to every file, open "hits" tab and go through the findings in every file.
I would like to have all strings with findings listed so, that I can easily find the outliers.
In such case, even if the process is slow, it should be done, Otherwise, it will need to be done manually.
Maybe, you could implement the option for storing indexed text for those of us who needs it.
But, in any case give the possibility to to view/copy/export the list of findings. For example, a list: filename string with the finding
Thank you.
Tolik

from iped.

Yes, I mean storing text into lucene. I thought you meant displaying first "hit fragment" (first line from Hits tab) for each file, that may need whole text stored into lucene. But now I understood you mean all different keyword hit strings for the searched expression, maybe one with wildcards that can match different strings. Looks useful. I think it does not need text stored in lucene to work fast.

from iped.

@MariasStory other things took priority over this, sorry. Could you clarify if you meant 1. first text fragment(s) with highlighted hits (all fragments wouldn't be possible to display in table view, just exporting) or 2. just matched strings e.g. user searches for joh* and that matches john, johnathan... so just those matches would be listed on table?

from iped.

Hi @lfcnassif, thanks for following this request.
I find both scenarios extremely useful.

At the moment, I would put a priority to the second task:
Just matched strings e.g. user searches for joh* and that matches john, johnathan... so just those matches would be listed on table. Additional information, like number of hits and number of files that the hits are found in, can also be shown.

The first option would be also nice to have:
Text fragment(s) with highlighted hits. Show limited amounts of hit fragments (maybe paginated) in table view with possibility of exporting.

from iped.