From 16c4fc857d0e4a82b12f826ab83e349d66d48c46 Mon Sep 17 00:00:00 2001
From: Greg DiCristofaro <gregd@basistech.com>
Date: Tue, 5 Apr 2022 09:11:43 -0400
Subject: [PATCH] logic update

---
 .../autopsy/modules/interestingitems/FilesSet.java     | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java
index 2b3ac6164c..e515225478 100644
--- a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java
+++ b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java
@@ -215,8 +215,16 @@ public final class FilesSet implements Serializable {
 
         String ruleName;
         if (inclusiveRules.isEmpty()) {
-            ruleName = Bundle.FileSet_fileIsMemberOf_noInclusiveRules_ruleName();
+            // in the event there are no rules, return null for no match
+            if (exclusiveRules.isEmpty()) {
+                return null;
+            // in the event there are exclusion rules, rely on those
+            } else {
+                ruleName = Bundle.FileSet_fileIsMemberOf_noInclusiveRules_ruleName();
+            }
+            
         } else {
+            // if there are inclusive rules, at least one should be matched
             ruleName = null;
             for (Rule rule : inclusiveRules.values()) {
                 if (rule.isSatisfied(file)) {