Adding a New Keyword to Keyword List; Re-Run Ingest?

Autopsy Help
1

I’m just looking for some clarification, was not clear in the docs to me and trying to avoid cluttering up the case keyword searches with duplicates:

  1. I create a keyword list and select it to be processed during ingest. Ingest completes. I add a word to the keyword list later on in the case.
    a. Do I need to rerun the search on the list for the new keyword to be processed and appear in results?
    b. If so, will this create duplicate results for all the previously existing keywords?
  2. I search for a keyword while ingest is happening, which per the docs and warnings gives me an incomplete search.
    a. Will that search and its results be updated as ingest continues (maybe that’s what “periodic keyword search” does?)
    b. Or will I need to run a search on the keyword again after ingest is complete?
    c. If so, will this result in duplicate results from the previous search conducted during ingest?

Perhaps there’s a best practice I’m missing for adding a keyword later to a case keyword search.

Thanks.

2

1a. Yes you need to re-run the search
1b. Unfortunately, yes, you’ll now see duplicates

2ab. I don’t believe the results for an ad-hoc search will be updated as ingest continues. I think the periodic search is only the ingest module running. So yes, you’d need to run again after ingest completes.
2c. Yes you’re going to see duplicates again

We tried to de-dupe the keyword hit artifacts a while back but ran into difficulties (I don’t remember the specifics).

One thing you could do for the ad-hoc search case is deselect the “Save search results” checkbox when searching during ingest. This will show you the results but they won’t be saved. Then you could run the search again after ingest is complete.

3

Thanks for the answer, I appreciate it.

Big bummer about the duplicates; I’ll check into the Github to see if there’s anything I can do starting with the pull requests section to see what work and attempts have already been done.

Is there any way to delete existing search results before re-running the search? Right-clicking on the tree only shows “Collapse All” and right-clicking the result in the Listing tab only shows “Properties”, so I’m guessing not.

I suppose this is not too common of an issue as I imagine most people just start ingesting and come back when it’s all done and work with the full dataset from there. That is what I eventually ended up doing.

4

No it is a common request, and we did work to prevent duplicates in many of the other artifact types. Keyword Hits however have their own special challenges in determining what exactly a duplicate is. This is the PR we had to revert. It was causing a slowdown and I believe was excluding artifacts that it should not have been. I think it also doesn’t de-dupe substring searches?

I don’t really recommend trying to fix it.

And no, there is no way to delete results from a case.