Boolean Search using Regex?

Autopsy Help
1

Friends,

Trying to figure out how to construct a boolean search in autopsy; there’s no inherent boolean option (Autopsy 4.18) – so it must be accomplished using regex. Trying to match items that contain: word1 AND word2 (e.g., jack and James)

I’ve tried to use the regex solution here: Regex to match string containing two names in any order - Stack Overflow

where it appears that the best option is:
^(?=.\bjack\b)(?=.\bjames\b).*$

When I try this syntax in autopsy, I get an error which says:

“Boundary characters ^ and $ do not match word boundaries. Consider replacing with an explicit list of boundary characters, such as [.,]”

So, anone successfully constructed a boolean search in autopsy? Hard to believe this is so difficult; someone must have accomplished this previously!

Any input appreciated.

Thank you!

2

@Joshh100, you need to use the Lucene regex syntax (you are querying Solr/Lucene under the covers). Maybe you already are using the correct syntax, I don’t know it off the top of my head, but I thought I’d throw this fact out there for your consideration. There should be a link to some Lucene documentation in the Autopsy User’s guide that you can access from the application Help menu.

3

Is there any regex example (matching words in free format text file) implementing Autopsy boolean search → word1 AND word2 (e.g., jack and james) ?

Using -,\ (?=.\bjames\b).[-,\ ] → Autopsy message is : “No result found”

Has anyone successfully implemented a boolean search in autopsy (via regex) ?
Any tips/suggestion is really very appreciated

4

Of course right regex used is :

[\-\,\ ](?=.*\bjack\b)(?=.*\bjames\b).*[\-\,\ ]