From 1640fbf7935d66df8eccba548f710c41228fa9b1 Mon Sep 17 00:00:00 2001
From: Kelly Kelly <kelly@basistech.com>
Date: Wed, 7 Apr 2021 15:07:20 -0400
Subject: [PATCH] Changed RA to use TSK_DELETED_PROG artifact for unistalled
 programs

---
 .../org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java
index ad5c1e9ed4..3330e6181a 100644
--- a/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java
+++ b/RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java
@@ -803,7 +803,7 @@ class ExtractRegistry extends Extract {
                                         try {
                                             bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_PROG_NAME, parentModuleName, value));
                                             bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, parentModuleName, itemMtime));
-                                            BlackboardArtifact bbart = regFile.newArtifact(ARTIFACT_TYPE.TSK_INSTALLED_PROG);
+                                            BlackboardArtifact bbart = regFile.newArtifact(ARTIFACT_TYPE.TSK_DELETED_PROG);
                                             bbart.addAttributes(bbattributes);
 
                                             newArtifacts.add(bbart);