From 88a2f37a5ec33adb574311eecc7106cea7cba86f Mon Sep 17 00:00:00 2001 From: Richard Cordovano Date: Wed, 27 Jan 2016 17:37:54 -0500 Subject: [PATCH] Make tskdbdiff.py handle bb-attr value types correctly --- test/script/tskdbdiff.py | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/test/script/tskdbdiff.py b/test/script/tskdbdiff.py index 9db3aeb863..0cc6907a56 100755 --- a/test/script/tskdbdiff.py +++ b/test/script/tskdbdiff.py @@ -220,7 +220,6 @@ class TskDbDiff(object): src = attributes[0][0] for attr in attributes: - attr_value_index = 3 + attr["value_type"] numvals = 0 for x in range(3, 6): if(attr[x] != None): @@ -232,7 +231,20 @@ class TskDbDiff(object): msg = "There were inconsistent sources for artifact with id #" + str(row["artifact_id"]) + ".\n" try: - attr_value_as_string = str(attr[attr_value_index]) + if attr["value_type"] == 0: + attr_value_as_string = str(attr["value_text"]) + elif attr["value_type"] == 1: + attr_value_as_string = str(attr["value_int32"]) + elif attr["value_type"] == 2: + attr_value_as_string = str(attr["value_int64"]) + elif attr["value_type"] == 3: + attr_value_as_string = str(attr["value_double"]) + elif attr["value_type"] == 4: + attr_value_as_string = "bytes" + elif attr["value_type"] == 5: + attr_value_as_string = str(attr["value_int64"]) + if attr["display_name"] == "Associated Artifact": + attr_value_as_string = getAssociatedArtifactType(db_file, attr_value_as_string) if attr["display_name"] == "Associated Artifact": attr_value_as_string = getAssociatedArtifactType(db_file, attr_value_as_string) #if((type(attr_value_as_string) != 'unicode') or (type(attr_value_as_string) != 'str')):