(PYTHON) get all tagged files

Autopsy Development
1

Hi Guys,

I am trying to process files that have been tagged in the UI.

Using this

tags = tagManager.getTagNamesInUse()
for tag in tags:
            self.log(Level.INFO, 'Name => %s :: %s' % (tag.getDisplayName()))

getNamesInUse returns a org.sleuthkit.datamodel.TagName but then it gets a bit confusing I can get an idea on what tags there are in a case using getDisplayName() but I cannot work out from the documentation how to attribute that to a file and then process that file using FileManager()

I can see that I can call getContentTag which I have tried

_content = tagManager.getContentTagsByTagName(tag)
self.log(Level.INFO, 'TAG_DETAIL => %s' % _content)

And that returns a contentTag but I am unsure what this is. The docs state I can call getContent but is this calling the file or is this another pointer?

2

I have partially worked this out now. So hopefully this will help other users

you need to retrive the contentTag for the tagged object first then you can retrieve the metadata associated with it.

so something like

tags = tagManager.getTagNamesInUse()
for tag in tags:
     self.log(Level.INFO, 'Tag => %s' % (tag.getDisplayName())) #retrieves Notable etc
     _content = tagManager.getContentTagsByTagName(tag) #retrieve contentTag
    #Content
    fileName = _content[0].getContent().getName()
    fileId = _content[0].getContent().getId()
    fileArtifacts = _content[0].getContent().getAllArtifacts()
    filePath = _content[0].getContent().getUniquePath()
    self.log(Level.INFO, 'File_Name => %s' % fileName)
    self.log(Level.INFO, 'File_ID => %s' % fileId)
    self.log(Level.INFO, 'File_Path => %s' % filePath)
    self.log(Level.INFO, 'File_Meta => %s' % fileArtifacts)