mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Make tskdbdiff.py handle bb-attr value types correctly

Browse Source
This commit is contained in:
Richard Cordovano 2016-01-27 17:37:54 -05:00
parent 06b499f7af
commit 88a2f37a5e
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
test/script/tskdbdiff.py
View File

@ -220,7 +220,6 @@ class TskDbDiff(object):
src = attributes[0][0] src = attributes[0][0]
for attr in attributes: for attr in attributes:
attr_value_index = 3 + attr["value_type"]
numvals = 0 numvals = 0
for x in range(3, 6): for x in range(3, 6):
if(attr[x] != None): if(attr[x] != None):
@ -232,7 +231,20 @@ class TskDbDiff(object):
msg = "There were inconsistent sources for artifact with id #" + str(row["artifact_id"]) + ".\n" msg = "There were inconsistent sources for artifact with id #" + str(row["artifact_id"]) + ".\n"
try: try:
attr_value_as_string = str(attr[attr_value_index]) if attr["value_type"] == 0:
attr_value_as_string = str(attr["value_text"])
elif attr["value_type"] == 1:
attr_value_as_string = str(attr["value_int32"])
elif attr["value_type"] == 2:
attr_value_as_string = str(attr["value_int64"])
elif attr["value_type"] == 3:
attr_value_as_string = str(attr["value_double"])
elif attr["value_type"] == 4:
attr_value_as_string = "bytes"
elif attr["value_type"] == 5:
attr_value_as_string = str(attr["value_int64"])
if attr["display_name"] == "Associated Artifact":
attr_value_as_string = getAssociatedArtifactType(db_file, attr_value_as_string)
if attr["display_name"] == "Associated Artifact": if attr["display_name"] == "Associated Artifact":
attr_value_as_string = getAssociatedArtifactType(db_file, attr_value_as_string) attr_value_as_string = getAssociatedArtifactType(db_file, attr_value_as_string)
#if((type(attr_value_as_string) != 'unicode') or (type(attr_value_as_string) != 'str')): #if((type(attr_value_as_string) != 'unicode') or (type(attr_value_as_string) != 'str')):