diff --git a/test/script/tskdbdiff.py b/test/script/tskdbdiff.py index 9452b335d9..dcf75031ec 100644 --- a/test/script/tskdbdiff.py +++ b/test/script/tskdbdiff.py @@ -798,7 +798,7 @@ def build_id_accounts_table(db_cursor, isPostgreSQL): """ # for each row in the db, take the object id and account SID then creates a tuple in the dictionary # with the object id as the key and the OS Account's SID as the value - mapping = dict([(row[0], row[1]) for row in sql_select_execute(db_cursor, isPostgreSQL, "SELECT os_account_obj_id, unique_id FROM tsk_os_accounts")]) + mapping = dict([(row[0], row[1]) for row in sql_select_execute(db_cursor, isPostgreSQL, "SELECT os_account_obj_id, addr FROM tsk_os_accounts")]) return mapping def build_id_obj_path_table(files_table, objects_table, artifacts_table, reports_table, images_table, accounts_table): @@ -810,7 +810,7 @@ def build_id_obj_path_table(files_table, objects_table, artifacts_table, reports artifacts_table: obj_id, artifact_type_name reports_table: obj_id, path images_table: obj_id, name - accounts_table: obj_id, unique_id + accounts_table: obj_id, addr """ # make a copy of files_table and update it with new data from artifacts_table and reports_table mapping = files_table.copy() @@ -830,7 +830,7 @@ def build_id_obj_path_table(files_table, objects_table, artifacts_table, reports elif par_obj_id in images_table.keys(): path = images_table[par_obj_id] mapping[k] = path + "/" + artifacts_table[k] - elif k in accounts_table.keys(): # For an OS Account object ID we use its unique_id field which is the account SID + elif k in accounts_table.keys(): # For an OS Account object ID we use its addr field which is the account SID mapping[k] = accounts_table[k] elif v[0] not in mapping.keys(): if v[0] in artifacts_table.keys():