Merge pull request #3303 from APriestman/3302_regexHelp

Improved regex documentation.
This commit is contained in:
Richard Cordovano 2017-12-12 12:42:33 -05:00 committed by GitHub
commit 2214f80689
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
5 changed files with 9 additions and 10 deletions

View File

@ -1610,11 +1610,8 @@ public class Case {
* will be created if it doesn't already exist; if it
* exists, it is ASSUMED it was created by calling
* createCaseDirectory.
* @param caseDisplayName The display name of case, which may be changed
* later by the user.
* @param caseNumber The case number, can be the empty string.
* @param examiner The examiner to associate with the case, can be
* the empty string.
* @param caseDetails Contains details of the case, such as examiner, display name, etc
*
*/
private Case(CaseType caseType, String caseDir, CaseDetails caseDetails) {
metadata = new CaseMetadata(caseType, caseDir, displayNameToUniqueName(caseDetails.getCaseDisplayName()), caseDetails);

View File

@ -75,6 +75,7 @@ public class EamGlobalSet {
* @param version
* @param knownStatus
* @param isReadOnly
* @param type
*/
public EamGlobalSet(
int orgID,
@ -164,7 +165,7 @@ public class EamGlobalSet {
}
/**
* @param knownStatus the known status to set
* @param fileKnownStatus the known status to set
*/
public void setFileKnownStatus(TskData.FileKnown fileKnownStatus) {
this.fileKnownStatus = fileKnownStatus;

View File

@ -645,8 +645,9 @@ public class SqliteEamDb extends AbstractSqlEamDb {
/**
* Check if the given hash is in a specific reference set
* @param hash
* @param value
* @param referenceSetID
* @param correlationTypeID
* @return true if the hash is found in the reference set
*/
@Override

View File

@ -37,9 +37,9 @@ Substring match should be used where the search term is just part of a word, or
## Regex match
Regex match can be used to search for a specific pattern. Regular expressions are supported using Lucene Regex Syntax which is documented here: https://lucene.apache.org/core/6_4_0/core/org/apache/lucene/util/automaton/RegExp.html. .* is automatically added to the beginning and end of the regular expressions to ensure all matches are found. Additionally, the resulting hits are split on common token separator boundaries (e.g. space, newline, colon, exclamation point etc.) to make the resulting keyword hit more amenable to highlighting.
Regex match can be used to search for a specific pattern. Regular expressions are supported using Lucene Regex Syntax which is documented here: https://www.elastic.co/guide/en/elasticsearch/reference/1.6/query-dsl-regexp-query.html#regexp-syntax. Wildcards are automatically added to the beginning and end of the regular expressions to ensure all matches are found. Additionally, the resulting hits are split on common token separator boundaries (e.g. space, newline, colon, exclamation point etc.) to make the resulting keyword hit more amenable to highlighting.
There is some validation on the regex but it's best to test on a sample image to make sure your regexes are correct and working as expected.
There is some validation on the regex but it's best to test on a sample image to make sure your regexes are correct and working as expected. One simple way to test is by creating a sample text file that your expression should match, ingesting it as a \ref ds_log "Logical File Set" and then running the regex query.
> In the year 1885 in an article titled Current Notes, the quick brown fox first jumped over the lazy dog.

View File

@ -368,7 +368,7 @@ public final class ThunderbirdMboxFileIngestModule implements FileIngestModule {
*
* @param input - input string, like the To/CC line from an email header
*
* @param Set<String>: set of email addresses found in the input string
* @return Set<String>: set of email addresses found in the input string
*/
private Set<String> findEmailAddresess(String input) {
Pattern p = Pattern.compile("\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,4}\\b",