From 17680aa20b54030bff766149a00af9b25fb06c3f Mon Sep 17 00:00:00 2001
From: "eugene.livis" <elivis@basistech.com>
Date: Wed, 17 Jan 2024 10:26:05 -0500
Subject: [PATCH] Added comments
---
.../java/src/org/sleuthkit/datamodel/SleuthkitCase.java | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java
index abb01a661..a0051e338 100644
--- a/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java
+++ b/bindings/java/src/org/sleuthkit/datamodel/SleuthkitCase.java
@@ -11994,7 +11994,9 @@ public List<ContentTag> getContentTagsByTagName(TagName tagName) throws TskCoreE
}
/**
- * Gets content tags by tag name, for the given data source.
+ * Gets content tags by tag name, for the given data source. This includes
+ * looking up all Content objects that have entries in tsk_files, as well as
+ * all OsAccounts (which do not have entries in tsk_files).
*
* @param tagName The tag name of interest.
* @param dsObjId data source object id
@@ -12013,6 +12015,11 @@ public List<ContentTag> getContentTagsByTagName(TagName tagName, long dsObjId) t
try {
connection = connections.getConnection();
+ // NOTE: Getting all content tags by tag name for a given data source includes
+ // looking up all Content objects that have entries in tsk_files, as well as
+ // all OsAccounts. OsAccounts do not have corresponding entries in tsk_files so we
+ // have to do a separate query to look them up, and then do a UNION of the results.
+
// "SELECT content_tags.tag_id, content_tags.obj_id, content_tags.tag_name_id, content_tags.comment, content_tags.begin_byte_offset, content_tags.end_byte_offset, tag_names.display_name, tag_names.description, tag_names.color, tag_names.knownStatus, tag_names.tag_set_id, tsk_examiners.login_name "
// + "FROM content_tags "
// + "JOIN tsk_os_accounts acc ON content_tags.obj_id = acc.os_account_obj_id "
--
GitLab