Skip to content

verify.py "Match!" emission problematic #3

@ajnelson-nist

Description

@ajnelson-nist

The verifier.py script outputs "Match!" lines for good records. I think this is low-utility information, and possibly counter-productive. If a file is overwhelmingly good records, there are two problems:

  • Any problematic records of small inputs being visually inspected can get lost without filtering.
  • The processing time spent writing "Match!" to screen or log output is significant, and for a large-enough file (say, the 42 MB Plaso sample mft.xml), basically punishes the verification-runner for checking data.

I propose "Match!" not be emitted, except maybe in a "verbose" mode.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions