Aaron Peterson
Aaron Peterson
We hash files with the Plaso task and it doesn't seem like there is a lot of interest in either of these hashing methods/tools so I'm going to close this...
These are now aggregated in the status view (when full details are not being shown).
IMO it's a "nice to have" in the user readable output, but not a very high priority.
This data now shows up in the report by default. Closing this out.
Should we just add a `sudo` to the execution?
(cc: @jleaniz since he brought this up initially and @wajihyassine for OSDFIR-infrastructure implications)
What else is needed for this again? Is there a bug/issue tracking this? IIRC we still need some sleuthkit deps in the GIFT repo?
Sounds good, thanks! @berggren FYI
One option we talked about here is since we run into some complex loop/disk/partition handling related issues from time to time is to have a debug method that dumps lots...
Assigning to @jleaniz for triage.