Boolean Search using Regex?


Trying to figure out how to construct a boolean search in autopsy; there’s no inherent boolean option (Autopsy 4.18) – so it must be accomplished using regex. Trying to match items that contain: word1 AND word2 (e.g., jack and James)

I’ve tried to use the regex solution here: Regex to match string containing two names in any order - Stack Overflow

where it appears that the best option is:

When I try this syntax in autopsy, I get an error which says:

“Boundary characters ^ and $ do not match word boundaries. Consider replacing with an explicit list of boundary characters, such as [.,]”

So, anone successfully constructed a boolean search in autopsy? Hard to believe this is so difficult; someone must have accomplished this previously!

Any input appreciated.

Thank you!

@Joshh100, you need to use the Lucene regex syntax (you are querying Solr/Lucene under the covers). Maybe you already are using the correct syntax, I don’t know it off the top of my head, but I thought I’d throw this fact out there for your consideration. There should be a link to some Lucene documentation in the Autopsy User’s guide that you can access from the application Help menu.

Is there any regex example (matching words in free format text file) implementing Autopsy boolean search → word1 AND word2 (e.g., jack and james) ?

Using -,\ (?=.\bjames\b).[-,\ ] → Autopsy message is : “No result found”

Has anyone successfully implemented a boolean search in autopsy (via regex) ?
Any tips/suggestion is really very appreciated

Of course right regex used is :

[\-\,\ ](?=.*\bjack\b)(?=.*\bjames\b).*[\-\,\ ]