Photos.sqlite-A-Asset_Basic_Data [Ph1.1-Asset Basic Data-PhDaPsql | Ph1BasicAssetData.py] = Browser runs out of memory

[InfiniteBSOD]

Hello,

Just now I ran iLEAPP 2.0.4 with the Photos.sqlite-A-Asset_Basic_Data [Ph1.1-Asset Basic Data-PhDaPsql | Ph1BasicAssetData.py] parser and it totally parsed 63942 records.

When I navigated to the results for that parser I noticed that it doesn't have the option which most (?) of the other parsers have that defaults (?) to showing 15 entries. It also allows the user to change from 15 entries (default?) to 50, 100 or "All" to show all entries.

The results of trying to load all 63942 records on one page were so RAM-intensive that after a while when Edge hits around 5GB of RAM-utilization I get:
"This page is having a problem. Try coming back to it later. Error code: Out of Memory."

Now I do have 128GB of RAM but currently utilizing 75% (opening the iLEAPP report not included) so I guess I simply hit a ceiling so my RAM won't swap onto disk.

Anyway it would be nice to have the "default" filtering for all "photos.sqlite"-modules enabled and set to "15" with the possibility to set it to "50", "100" or "All" as the other parsers have.

@ScottKjr3347 Mentioning you since I know you developed the parsers.
I love them and your photos.sqlite-scripts btw so extremely grateful for your blog and the amount you give back to the community.
Also (naturally) a shout-out to the maintainers of the tool - iLEAPP - itself. Legends all.

Best Regards

[stark4n6]

@InfiniteBSOD this is a known issue with HTML trying to load too much data, I would suggest opening the TSV in something like TimelineExplorer or Excel. In the future once our new report viewer LAVA is released this should fix this issue.

[InfiniteBSOD]

@InfiniteBSOD this is a known issue with HTML trying to load too much data, I would suggest opening the TSV in something like TimelineExplorer or Excel. In the future once our new report viewer LAVA is released this should fix this issue.

Appreciate the fast reply and suggestion.
I'll try Timeline Explorer.

Don't want to take up another issue but just a quick question:

Any plans to implement a search window in the iLEAPP GUI (where you select the parsers you want and before the report is created) so the user can filter for parsers?

[stark4n6]

@InfiniteBSOD there are checkboxes to not parse certain artifacts, are you saying to add a search box for easier filtering on those checkboxes?

[InfiniteBSOD]

@InfiniteBSOD there are checkboxes to not parse certain artifacts, are you saying to add a search box for easier filtering on those checkboxes?

Yes, in addition of having the option to either press "Select All" or "Deselect All" (which are great) to have a field where you can enter text and to filter the list of parsers shown depending on what the entered text matches.

So if I only want notifications parsed I can enter "notification" to see a filtered out view of all parsers that matches "notification".

[stark4n6]

@InfiniteBSOD I think we are at the mercy of Tkinter in the GUI unfortunately, it's not dynamic like that so I don't think it's feasible at this time unless we switch to some other type of frontend

[InfiniteBSOD]

@InfiniteBSOD I think we are at the mercy of Tkinter in the GUI unfortunately, it's not dynamic like that so I don't think it's feasible at this time unless we switch to some other type of frontend

Ah gotcha.
Appreciate the quick and helpful replies.

[stark4n6]

@InfiniteBSOD because @Johann-PLW is the man, he found a way to filter in the GUI, check out the latest release https://github.com/abrignoni/iLEAPP/releases/tag/v2.1.0