diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java index f51bcbd0f4..ba2b68ca9f 100644 --- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java +++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java @@ -61,6 +61,7 @@ import java.util.AbstractMap; import java.util.ArrayList; import java.util.List; import java.util.Collection; +import java.util.Collections; import java.util.Date; import java.util.HashMap; import java.util.Map; @@ -1105,6 +1106,7 @@ class ExtractRegistry extends Extract { String sid = optional.get(); Map userInfo = userInfoMap.remove(sid); if(userInfo != null) { + addAccountInstance(accountMgr, osAccount, (DataSource)dataSource); updateOsAccount(osAccount, userInfo, groupMap.get(sid), regAbstractFile); } } @@ -1999,9 +2001,10 @@ class ExtractRegistry extends Extract { accountMgr.newOsAccountInstance(osAccount, (DataSource)dataSource, OsAccountInstance.OsAccountInstanceType.LAUNCHED); } else { osAccount = optional.get(); - if (userName != null && !userName.isEmpty()) { + addAccountInstance(accountMgr, osAccount, (DataSource)dataSource); + if (userName != null && !userName.isEmpty()) { OsAccountUpdateResult updateResult= accountMgr.updateCoreWindowsOsAccountAttributes(osAccount, null, userName, domainName.isEmpty() ? null : domainName, host); - osAccount = updateResult.getUpdatedAccount().orElse(osAccount); + osAccount = updateResult.getUpdatedAccount().orElse(osAccount); } } @@ -2269,4 +2272,17 @@ class ExtractRegistry extends Extract { private OsAccountAttribute createOsAccountAttribute(BlackboardAttribute.ATTRIBUTE_TYPE type, Integer value, OsAccount osAccount, Host host, AbstractFile file) { return osAccount.new OsAccountAttribute(new BlackboardAttribute.Type(type), value, osAccount, host, file); } + + /** + * Adds an account instance for the given data source if one does not already + * exist. + * + * @param accountMgr + * @param osAccount + * @param dataSource + * @throws TskCoreException + */ + private void addAccountInstance(OsAccountManager accountMgr, OsAccount osAccount, DataSource dataSource) throws TskCoreException { + accountMgr.newOsAccountInstance(osAccount, dataSource, OsAccountInstance.OsAccountInstanceType.LAUNCHED); + } }