Boolean Search using Regex?


Trying to figure out how to construct a boolean search in autopsy; there’s no inherent boolean option (Autopsy 4.18) – so it must be accomplished using regex. Trying to match items that contain: word1 AND word2 (e.g., jack and James)

I’ve tried to use the regex solution here: Regex to match string containing two names in any order - Stack Overflow

where it appears that the best option is:

When I try this syntax in autopsy, I get an error which says:

“Boundary characters ^ and $ do not match word boundaries. Consider replacing with an explicit list of boundary characters, such as [.,]”

So, anone successfully constructed a boolean search in autopsy? Hard to believe this is so difficult; someone must have accomplished this previously!

Any input appreciated.

Thank you!

@Joshh100, you need to use the Lucene regex syntax (you are querying Solr/Lucene under the covers). Maybe you already are using the correct syntax, I don’t know it off the top of my head, but I thought I’d throw this fact out there for your consideration. There should be a link to some Lucene documentation in the Autopsy User’s guide that you can access from the application Help menu.