mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-20 03:24:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '8276-addendum' of https://github.com/gdicristofaro/autopsy into REALLY_delete_kws_8276

Browse Source
This commit is contained in:
Eugene Livis 2022-01-31 09:06:00 -05:00
commit 04468e3f01
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Core/src/org/sleuthkit/autopsy/mainui/datamodel/AnalysisResultDAO.java
View File

@ -396,7 +396,7 @@ public class AnalysisResultDAO extends BlackboardArtifactDAO {
+ "FROM\n"
+ "(SELECT \n"
+ " art.artifact_type_id\n"
+ " ,CASE WHEN ar.configuration IS NOT NULL AND LENGTH(ar.configuration) > 0 THEN 1 ELSE 0 END AS has_configuration\n"
+ " ,CASE WHEN ar.configuration IS NOT NULL AND ar.configuration <> '' THEN 1 ELSE 0 END AS has_configuration\n"
+ "FROM blackboard_artifacts art\n"
+ "INNER JOIN blackboard_artifact_types types ON types.category_type = 1 AND art.artifact_type_id = types.artifact_type_id\n"
+ "LEFT JOIN tsk_analysis_results ar ON art.artifact_obj_id = ar.artifact_obj_id\n"
@ -590,6 +590,8 @@ public class AnalysisResultDAO extends BlackboardArtifactDAO {
throw new ExecutionException("An error occurred while fetching keyword set hits.", ex);
}
Collections.sort(allSets, (a,b) -> compareStrings(a.getSearchParams().getSetName(), b.getSearchParams().getSetName()));
return new TreeResultsDTO<>(allSets);
}
@ -1172,7 +1174,8 @@ public class AnalysisResultDAO extends BlackboardArtifactDAO {
+ " WHERE attr.artifact_id = art.artifact_id "
+ " AND attr.attribute_type_id = " + BlackboardAttribute.Type.TSK_SET_NAME.getTypeID()
+ " AND attr.value_text IS NOT NULL "
+ " AND LENGTH(attr.value_text) > 0) = 0"
+ " AND attr.value_text <> '' "
+ " LIMIT 1) = 0 "
// otherwise, see if the set name attribute matches expected value
: "? IN (SELECT attr.value_text FROM blackboard_attributes attr "
+ " WHERE attr.artifact_id = art.artifact_id "