search

sleuthkit / autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.
http://www.sleuthkit.org/autopsy/
2.41k stars 597 forks source link

Integer attributes sort as strings #6458

Closed L-Andrade closed 3 years ago

L-Andrade commented 3 years ago

Hello,

When an artifact is added to the blackboard and it has an attribute of type Integer (BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE.INTEGER), tapping the column to sort it still sorts the column as if the attribute was a string (e.g. 10 -> 10000 -> 30 instead of 10 -> 30 -> 10000).

Is it necessary to do something else other than use the proper attribute type, or is it a bug?

Edit: I tested in Autopsy 4.15.0 and 4.17.0, and the result was the same.

Edit2: Image for more context: image

Thanks in advance.

rcordovano commented 3 years ago

This is a bug. Many attributes get loaded in BlackboardArtifactNode (artifact "model" class for tabular results views) by the following line of code (Line 985c of BlackboardArtifactNode.java) which converts the attribute value to a string:

map.put(attribute.getAttributeType().getDisplayName(), attribute.getDisplayString());

I will add this issue to our internal bug tracking system here at Basis Technology. Hopefully, we will be able to address it for the Autopsy 4.18.0 release scheduled for January.

rcordovano commented 3 years ago

@L-Andrade, the bug will definitely be fixed in the Autopsy 4.18.0 release scheduled for January (https://github.com/sleuthkit/autopsy/pull/6490).