Re: [sleuthkit-developers] Branching BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT?

[Richard C. <rco...@ba...>]

Sorry, Rajmund, there is currently no way to create the sort of hierarchy
of interesting file set definitions you are envisioning.

The code that shows interesting file hits in the "Interesting Items" tree
groups the file hit results (artifacts) by file set name, and every file
hit artifact has a single set name attribute. You could add separators to
your set names, but that would only define new set names - the set names
are not parsed to discover additional structure.

On Fri, Nov 28, 2014 at 2:56 AM, Rajmund <ra...@4e...> wrote:

> Hi Team,
>
>
>
> I was wondering if there is a way to branch/create child items for the BlackboardArtifact.ARTIFACT_TYPE.TSK_INTERESTING_FILE_HIT
> in order to group them together?
>
>
>
> The goal would be that it would be shown in Autopsy as:
>
>
>
> Interesting Items
>
>               SetNameA
>
>                              SetNameAB
>
>                              SetNameAC
>
>               SetNameB
>
>
>
> Is there a separator to be used in TSK_SET_NAME? Or do I somehow have to
> add the children to the parent artifact?
>
>
>
> Is there another artefact type which allows the above if this one does not?
>
>
>
> Thanks
>
>
>
> Rajmund
>
>
> ------------------------------------------------------------------------------
> Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
> from Actuate! Instantly Supercharge Your Business Reports and Dashboards
> with Interactivity, Sharing, Native Excel Exports, App Integration & more
> Get technology previously reserved for billion-dollar corporations, FREE
>
> http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
>
>