diff --git a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalFileObj.java b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalFileObj.java index 3d465c6e2bc6ad22f283156d9f382bd9b73abe3f..384d40a899b6d01283339bd8411339c6abb76a29 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/stix/EvalFileObj.java +++ b/Core/src/org/sleuthkit/autopsy/modules/stix/EvalFileObj.java @@ -171,7 +171,7 @@ public synchronized ObservableResult evaluate() { for (HashType h : obj.getHashes().getHashes()) { if (h.getSimpleHashValue() != null) { if (h.getType().getValue().equals("MD5")) { //NON-NLS - String newClause = "md5=\'" + h.getSimpleHashValue().getValue() + "\'"; //NON-NLS + String newClause = "md5=\'" + h.getSimpleHashValue().getValue().toString().toLowerCase() + "\'"; //NON-NLS whereClause = addClause(whereClause, newClause); } else { addWarning("Could not process hash type " + h.getType().getValue().toString()); //NON-NLS