Skip to content
Snippets Groups Projects
Commit 48240bef authored by Kelly Kelly's avatar Kelly Kelly
Browse files

Change the TSK_RECENT_OBJECT time attribute

parent 1f58a60f
No related branches found
No related tags found
No related merge requests found
...@@ -594,12 +594,11 @@ Indicates recently accessed content. Examples: Recent Documents or Recent Downlo ...@@ -594,12 +594,11 @@ Indicates recently accessed content. Examples: Recent Documents or Recent Downlo
### REQUIRED ATTRIBUTES ### REQUIRED ATTRIBUTES
- TSK_PATH (Path to the recent object content in the data source) - TSK_PATH (Path to the recent object content in the data source)
- TSK_DATETIME_ACCESSED (Timestamp that the content was last accessed at, in seconds since 1970-01-01T00:00:00Z)
### OPTIONAL ATTRIBUTES ### OPTIONAL ATTRIBUTES
- TSK_DATETIME_ACCESSED (Timestamp that the content was last accessed at, in seconds since 1970-01-01T00:00:00Z)
- TSK_PATH_ID (ID of the file instance in the data source) - TSK_PATH_ID (ID of the file instance in the data source)
- TSK_PROG_NAME (Application or application extractor that stored this object as recent) - TSK_PROG_NAME (Application or application extractor that stored this object as recent)
- TSK_DATETIME (A timestamp associated with the content, in seconds since 1970-01-01T00:00:00Z. Ex: creation time)
- TSK_NAME (If found in the registry, the name of the attribute) - TSK_NAME (If found in the registry, the name of the attribute)
- TSK_VALUE (If found in the registry, the value of the attribute) - TSK_VALUE (If found in the registry, the value of the attribute)
- TSK_COMMENT (What the source of the attribute may be) - TSK_COMMENT (What the source of the attribute may be)
......
...@@ -392,7 +392,7 @@ public int compare(TimelineEventType o1, TimelineEventType o2) { ...@@ -392,7 +392,7 @@ public int compare(TimelineEventType o1, TimelineEventType o2) {
getBundle().getString("MiscTypes.recentDocuments.name"), // NON-NLS getBundle().getString("MiscTypes.recentDocuments.name"), // NON-NLS
MISC_TYPES, MISC_TYPES,
new BlackboardArtifact.Type(TSK_RECENT_OBJECT), new BlackboardArtifact.Type(TSK_RECENT_OBJECT),
new Type(TSK_DATETIME), new Type(TSK_DATETIME_ACCESSED),
new Type(TSK_PATH)); new Type(TSK_PATH));
TimelineEventType INSTALLED_PROGRAM = new TimelineEventArtifactTypeImpl(19, TimelineEventType INSTALLED_PROGRAM = new TimelineEventArtifactTypeImpl(19,
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment