bulk_extractor icon indicating copy to clipboard operation
bulk_extractor copied to clipboard

allow feature files to include ?arg=val in forensic path.

Open simsong opened this issue 12 years ago • 0 comments

The idea is to tack on these fields to the forensic path as URL query string parameters, e.g., ?re=foo&enc=UTF-8. We'd obviously need to work out the details about escaping, etc., but there are a few things to like about this. First, URLs are cool and one can easily imagine some future web service for exposing bulk_extractor output, and that's not a bad way to integrate disparate enterprise systems. Second, the scheme is idempotent, so if you ran a slightly different set of patterns at a later time, the patterns that remained the same would generate the same forensic paths. Third, the query parameters act as annotations to the location of the data.

The main cons are that it reads kind of ugly, and will be a bit harder to deal with in quick-and-dirty scripts.

simsong avatar Jul 25 '13 02:07 simsong