From 48240bef50f031057a5128e0925e3727b344e600 Mon Sep 17 00:00:00 2001 From: Kelly Kelly <kelly@basistech.com> Date: Tue, 12 Jan 2021 16:35:01 -0500 Subject: [PATCH] Change the TSK_RECENT_OBJECT time attribute --- bindings/java/doxygen/artifact_catalog.dox | 3 +-- .../java/src/org/sleuthkit/datamodel/TimelineEventType.java | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/bindings/java/doxygen/artifact_catalog.dox b/bindings/java/doxygen/artifact_catalog.dox index 076745959..945f94ac4 100644 --- a/bindings/java/doxygen/artifact_catalog.dox +++ b/bindings/java/doxygen/artifact_catalog.dox @@ -594,12 +594,11 @@ Indicates recently accessed content. Examples: Recent Documents or Recent Downlo ### REQUIRED ATTRIBUTES - TSK_PATH (Path to the recent object content in the data source) -- TSK_DATETIME_ACCESSED (Timestamp that the content was last accessed at, in seconds since 1970-01-01T00:00:00Z) ### OPTIONAL ATTRIBUTES +- TSK_DATETIME_ACCESSED (Timestamp that the content was last accessed at, in seconds since 1970-01-01T00:00:00Z) - TSK_PATH_ID (ID of the file instance in the data source) - TSK_PROG_NAME (Application or application extractor that stored this object as recent) -- TSK_DATETIME (A timestamp associated with the content, in seconds since 1970-01-01T00:00:00Z. Ex: creation time) - TSK_NAME (If found in the registry, the name of the attribute) - TSK_VALUE (If found in the registry, the value of the attribute) - TSK_COMMENT (What the source of the attribute may be) diff --git a/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java b/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java index 87c1d3426..efde1182e 100644 --- a/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java +++ b/bindings/java/src/org/sleuthkit/datamodel/TimelineEventType.java @@ -392,7 +392,7 @@ public int compare(TimelineEventType o1, TimelineEventType o2) { getBundle().getString("MiscTypes.recentDocuments.name"), // NON-NLS MISC_TYPES, new BlackboardArtifact.Type(TSK_RECENT_OBJECT), - new Type(TSK_DATETIME), + new Type(TSK_DATETIME_ACCESSED), new Type(TSK_PATH)); TimelineEventType INSTALLED_PROGRAM = new TimelineEventArtifactTypeImpl(19, -- GitLab