Skip to content

verify.py "Match!" emission problematic #3

@ajnelson-nist

Description

@ajnelson-nist

The verifier.py script outputs "Match!" lines for good records. I think this is low-utility information, and possibly counter-productive. If a file is overwhelmingly good records, there are two problems:

  • Any problematic records of small inputs being visually inspected can get lost without filtering.
  • The processing time spent writing "Match!" to screen or log output is significant, and for a large-enough file (say, the 42 MB Plaso sample mft.xml), basically punishes the verification-runner for checking data.

I propose "Match!" not be emitted, except maybe in a "verbose" mode.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions