Skip to content
Snippets Groups Projects
Commit 48240bef authored by Kelly Kelly's avatar Kelly Kelly
Browse files

Change the TSK_RECENT_OBJECT time attribute

parent 1f58a60f
No related branches found
No related tags found
No related merge requests found
......@@ -594,12 +594,11 @@ Indicates recently accessed content. Examples: Recent Documents or Recent Downlo
### REQUIRED ATTRIBUTES
- TSK_PATH (Path to the recent object content in the data source)
- TSK_DATETIME_ACCESSED (Timestamp that the content was last accessed at, in seconds since 1970-01-01T00:00:00Z)
### OPTIONAL ATTRIBUTES
- TSK_DATETIME_ACCESSED (Timestamp that the content was last accessed at, in seconds since 1970-01-01T00:00:00Z)
- TSK_PATH_ID (ID of the file instance in the data source)
- TSK_PROG_NAME (Application or application extractor that stored this object as recent)
- TSK_DATETIME (A timestamp associated with the content, in seconds since 1970-01-01T00:00:00Z. Ex: creation time)
- TSK_NAME (If found in the registry, the name of the attribute)
- TSK_VALUE (If found in the registry, the value of the attribute)
- TSK_COMMENT (What the source of the attribute may be)
......
......@@ -392,7 +392,7 @@ public int compare(TimelineEventType o1, TimelineEventType o2) {
getBundle().getString("MiscTypes.recentDocuments.name"), // NON-NLS
MISC_TYPES,
new BlackboardArtifact.Type(TSK_RECENT_OBJECT),
new Type(TSK_DATETIME),
new Type(TSK_DATETIME_ACCESSED),
new Type(TSK_PATH));
TimelineEventType INSTALLED_PROGRAM = new TimelineEventArtifactTypeImpl(19,
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment