diff --git a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java index abb01a661c798484e6c730623157356bb462a4a7..a0051e338b734f79953ee9110073a343596f5bd6 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java +++ b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java @@ -11994,7 +11994,9 @@ public List<ContentTag> getContentTagsByTagName(TagName tagName) throws TskCoreE } /** - * Gets content tags by tag name, for the given data source. + * Gets content tags by tag name, for the given data source. This includes + * looking up all Content objects that have entries in tsk_files, as well as + * all OsAccounts (which do not have entries in tsk_files). * * @param tagName The tag name of interest. * @param dsObjId data source object id @@ -12013,6 +12015,11 @@ public List<ContentTag> getContentTagsByTagName(TagName tagName, long dsObjId) t try { connection = connections.getConnection(); + // NOTE: Getting all content tags by tag name for a given data source includes + // looking up all Content objects that have entries in tsk_files, as well as + // all OsAccounts. OsAccounts do not have corresponding entries in tsk_files so we + // have to do a separate query to look them up, and then do a UNION of the results. + // "SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tag_names.tag_set_id, tsk_examiners.login_name " // + "FROM content_tags " // + "JOIN tsk_os_accounts acc ON content_tags.obj_id = acc.os_account_obj_id "