mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Better document which fields are used

Browse Source
This commit is contained in:
Brian Carrier 2019-08-16 19:22:47 -04:00
parent 51b695a6b4
commit 09fdfc91e4
2 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
KeywordSearch/solr/solr/configsets/AutopsyConfig/conf/schema.xml
View File

@ -561,10 +561,13 @@
leading wildcard queries. --> leading wildcard queries. -->
<!--<field name="text_rev" type="text_general_rev" indexed="true" stored="false" multiValued="true"/>--> <!--<field name="text_rev" type="text_general_rev" indexed="true" stored="false" multiValued="true"/>-->
<!-- field with white-space tokenized words for TermsComponent regex search (useful for fast search of IP addresses, URLs, certain phone numbers) <!-- field with white-space tokenized words for TermsComponent regex search.
also be useful for Lucene based queries containing special characters--> No longer being populated by Autopsy, but remains for backward compatability.
<!-- populated via copyField --> content_str is used instead to better deal with regex that have white space. -->
<field name="content_ws" type="text_ws" indexed="true" stored="false" multiValued="true" /> <field name="content_ws" type="text_ws" indexed="true" stored="false" multiValued="true" />
<!-- field that contains the raw string form of the chunk. Used for regular expression
matching. Populated by Autopsy using lower-case text and a copyField for file name. -->
<field name="content_str" type="string" indexed="true" stored="true" multiValued="true" /> <field name="content_str" type="string" indexed="true" stored="true" multiValued="true" />
<!-- Uncommenting the following will create a "timestamp" field using <!-- Uncommenting the following will create a "timestamp" field using

14
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Server.java
View File

@ -101,25 +101,29 @@ public class Server {
return "image_id"; //NON-NLS return "image_id"; //NON-NLS
} }
}, },
// This is not stored or index . it is copied to Text and Content_Ws // This is not stored or indexed. it is copied to text by the schema
CONTENT { CONTENT {
@Override @Override
public String toString() { public String toString() {
return "content"; //NON-NLS return "content"; //NON-NLS
} }
}, },
// String representation for regular expression searching
CONTENT_STR { CONTENT_STR {
@Override @Override
public String toString() { public String toString() {
return "content_str"; //NON-NLS return "content_str"; //NON-NLS
} }
}, },
// default search field. Populated by schema
TEXT { TEXT {
@Override @Override
public String toString() { public String toString() {
return "text"; //NON-NLS return "text"; //NON-NLS
} }
}, },
// no longer populated. Was used for regular expression searching.
// Should not be used.
CONTENT_WS { CONTENT_WS {
@Override @Override
public String toString() { public String toString() {
@ -132,28 +136,28 @@ public class Server {
return "file_name"; //NON-NLS return "file_name"; //NON-NLS
} }
}, },
// note that we no longer index this field // note that we no longer store or index this field
CTIME { CTIME {
@Override @Override
public String toString() { public String toString() {
return "ctime"; //NON-NLS return "ctime"; //NON-NLS
} }
}, },
// note that we no longer index this field // note that we no longer store or index this field
ATIME { ATIME {
@Override @Override
public String toString() { public String toString() {
return "atime"; //NON-NLS return "atime"; //NON-NLS
} }
}, },
// note that we no longer index this field // note that we no longer store or index this field
MTIME { MTIME {
@Override @Override
public String toString() { public String toString() {
return "mtime"; //NON-NLS return "mtime"; //NON-NLS
} }
}, },
// note that we no longer index this field // note that we no longer store or index this field
CRTIME { CRTIME {
@Override @Override
public String toString() { public String toString() {