How to control whether the last processed evidence can be affected by these arguments: --append, --continue and --restart?

[mcquadenc]

--append, --continue and --restart :
Many times the process had an error, but it was not inserted in the index, even with the use of the append, and ended the process before that.

I am afraid to run --restart and it will replace the last evidence that is actually saved in the index by --append and concluded successfully, even when in the last processing the IPED reported an error, as when it does not recognize a valid E01 image.

Doubt, what errors(Exceptions) actually allow me to use --restart without changing the (last) evidence saved correctly in the case?

Idea: Perhaps, it would be interesting to have an argument that allows you to list the evidence of the case successfully completed (append) and those that contain error. Highlighting which ones can be affected by --append, --restart or --continue. It will greatly facilitate the management of hundreds of combined experiences in a single case.

[lfcnassif]

--restart goal is to delete the last (partial) commit point after some processing error, so you can start the processing from the beginning if you want, instead of resuming it with --continue.
If you use --restart on a processing that finished, it will remove the last processed evidence (with errors or not).

--continue and --restart purpose was to resume/restart some processing after OutOfMemoryErrors, user cancelation, system restarting or abrupt power off. It is also possible to workaround some error in some module disabling the module and resuming.

--append will never touch the processed evidences, with errors or not, its goal is to add a new evidence to the case.

A common scenario is using --restart/--continue with --append after some error appending a new evidence to an existing case, so you can restart/resume the processing of the evidence being appended.

Recently some bug was fixed with --restart option. If you are afraid of the result, do a case backup.

[lfcnassif]

In a future release it will be possible to remove a non last processed evidence with processing error, see #293. Currently you can just resume its processing with --continue. --restart always removes the last evidence.

[lfcnassif]

just reopened #413