Re: [sleuthkit-users] Regex in Keyword Lists
Brought to you by:
carrier
|
From: Brian C. <ca...@sl...> - 2014-10-16 03:17:44
|
Hi Josh,
That is a known bug that has been fixed. Thanks and sorry. There is no work around...
brian
On Oct 15, 2014, at 4:10 PM, Josh McCune <mc...@ks...> wrote:
> I must be missing something obvious, but I can’t seem to make regex based
> keyword searches work in Autopsy 3.1.0 (running on Windows 8). In the
> Advanced Keyword Search Configuration Dialog, the “Regular Expression”
> checkbox is greyed out and won’t allow you to select it. I tried to work
> around it by manually editing the the xml and then importing the list.
> When I do that, it shows up in the keyword list with the RegEx box
> checked, but it doesn’t seem to actually return any results. Granted, I’m
> trying to do a somewhat complicated query:
>
> Foo((\s{1,3}(?:[a-zA-Z\-\.]{1,} ?){0,2}\s)|\s{1,3})Bar
>
> …”Bar" within 3 words after “Foo”. But even simple regex entered in to
> the Keyword Search bar doesn’t seem to return results properly.
>
> Suggestions?
>
> Thanks,
> Josh
>
> ------------------------------------------------------------------------------
> Comprehensive Server Monitoring with Site24x7.
> Monitor 10 servers for $9/Month.
> Get alerted through email, SMS, voice calls or mobile push notifications.
> Take corrective actions from your mobile device.
> http://p.sf.net/sfu/Zoho
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
|