diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/Bundle.properties-MERGED b/Core/src/org/sleuthkit/autopsy/centralrepository/Bundle.properties-MERGED index b2320b5408..b4f7f835ef 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/Bundle.properties-MERGED +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/Bundle.properties-MERGED @@ -5,7 +5,10 @@ CentralRepoCommentDialog.title.addEditCentralRepoComment=Add/Edit Central Reposi OpenIDE-Module-Name=Central Repository OpenIDE-Module-Display-Category=Ingest Module OpenIDE-Module-Short-Description=Central Repository Ingest Module -OpenIDE-Module-Long-Description=Central Repository ingest module and central database. \n\nThe Central Repository ingest module stores attributes of artifacts matching selected correlation types into a central database.\nStored attributes are used in future cases to correlate and analyzes files and artifacts during ingest. +OpenIDE-Module-Long-Description=\ + Central Repository ingest module and central database. \n\n\ + The Central Repository ingest module stores attributes of artifacts matching selected correlation types into a central database.\n\ + Stored attributes are used in future cases to correlate and analyzes files and artifacts during ingest. CentralRepoCommentDialog.commentLabel.text=Comment: CentralRepoCommentDialog.okButton.text=&OK CentralRepoCommentDialog.cancelButton.text=C&ancel diff --git a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java index 1d891b5db5..c15edbfd2d 100755 --- a/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java +++ b/Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/CorrelationAttributeUtil.java @@ -105,13 +105,39 @@ public class CorrelationAttributeUtil { public static List makeCorrAttrsToSave(Content content) { if (content instanceof DataArtifact) { return makeCorrAttrsToSave((DataArtifact) content); - } else if (!(content instanceof AnalysisResult)) { - return makeCorrAttrsForSearch(content); - } else { + } else if (content instanceof AnalysisResult) { + //AnalysisResults should already have the correlation attributes they are correlating on saved + //This check replaces the check explicitly excluding keyword hits and interesting items that existed prior to the AnalysisResult designation return new ArrayList<>(); + } else { + return makeCorrAttrsForSearch(content); } } + /** + * Makes zero to many correlation attribute instances from the attributes of + * content that have correlatable data. The intention of this method is to + * use the results to correlate with, not to save. If you want to save, + * please use makeCorrAttrsToSave. An artifact that can have correlatable + * data != An artifact that should be the source of data in the CR, so + * results may be too lenient. + * + * IMPORTANT: The correlation attribute instances are NOT added to the + * central repository by this method. + * + * TODO (Jira-6088): The methods in this low-level, utility class should + * throw exceptions instead of logging them. The reason for this is that the + * clients of the utility class, not the utility class itself, should be in + * charge of error handling policy, per the Autopsy Coding Standard. Note + * that clients of several of these methods currently cannot determine + * whether receiving a null return value is an error or not, plus null + * checking is easy to forget, while catching exceptions is enforced. + * + * @param Content A Content object. + * + * @return A list, possibly empty, of correlation attribute instances for + * the content. + */ public static List makeCorrAttrsForSearch(Content content) { if (content instanceof DataArtifact) { return makeCorrAttrsForSearch((DataArtifact) content); @@ -152,30 +178,6 @@ public class CorrelationAttributeUtil { return correlationAttrs; } - /** - * Makes zero to many correlation attribute instances from the attributes of - * artifacts that have correlatable data. The intention of this method is to - * use the results to correlate with, not to save. If you want to save, - * please use makeCorrAttrsToSave. An artifact that can have correlatable - * data != An artifact that should be the source of data in the CR, so - * results may be too lenient. - * - * IMPORTANT: The correlation attribute instances are NOT added to the - * central repository by this method. - * - * TODO (Jira-6088): The methods in this low-level, utility class should - * throw exceptions instead of logging them. The reason for this is that the - * clients of the utility class, not the utility class itself, should be in - * charge of error handling policy, per the Autopsy Coding Standard. Note - * that clients of several of these methods currently cannot determine - * whether receiving a null return value is an error or not, plus null - * checking is easy to forget, while catching exceptions is enforced. - * - * @param artifact An artifact. - * - * @return A list, possibly empty, of correlation attribute instances for - * the artifact. - */ private static List makeCorrAttrsForSearch(DataArtifact artifact) { List correlationAttrs = new ArrayList<>(); try {