autopsy

autopsy copied to clipboard

It would be nice to be able to filter listings by their respective columns. An example use case would be to filter artifacts by time to limit the items to investigate to a notable time frame or e.g. filter by "enabled" attribute in some plugin generated artifacts to hide all uninteresting output.

Can we assume that you have noticed that in the tabular results view you can sort columns in ascending or descending order? This might provide a sort of work around. Note that you can also search in this table by selecting any row and typing what you want to find - a search widget will appear in the lower left hand corner of the view with a text box for the text you are entering.

Something else that might provide a workaround is the Timeline tool (Tools => Timeline on the main application menu). You can filter on many artifact types and of course on time ranges, then select the List view to see a tabular results view.

Yes, of course I know sorting and the timeline view. Sometimes plugins generate output that is not time based but could benefit greatly from filtering. Exporting to CSV to filter in excel is not the greatest experience.

I second the request for filtering on columns.