turbinia
turbinia copied to clipboard
Filter out processing of some partitions
The number of Tasks executed for a given image is very high, especially if it contains a large number of partitions or docker containers. We can probably filter some of these out so that we don't have so many duplicates that execute during a given request.
Some ideas:
- Add some heuristics / thresholds for ignoring some partitions
- Filter file-systems that we won't be able to mount / process (e.g. swap)
- Very small partitions, ie. recover partitions can probably be ignored
Note that we should have these as options that can be overwritten by recipe config when we do want to process everything (e.g. might want to run strings/bulk_extractor on swap, etc).
FYI @dfjxs