Joins: Inner, Outer and none

By default, Rekall creates queries over multiple tables using inner joins. However, you can change the join type between two tables to either right outer or left outer by right-clicking on the link. This brings up a dialog box as shown below. In this example, the join is left-outer.

If the join expression tab is selected, as shown in the next image, then you can enter a completely arbitrary join expression (and the columns selected in the A = B tab are not relevant). On saving, if the A = B tab is selected, then the join condition will be assembled from selected columns; if the join expression tab is selected, then that expression will be used. On either case, the join type selection still applies.

This dialog can also be used to delete a join. Note that if you attempt to save a query which has tables that are not connected, then Rekall will warn you and ask if the query should be saved anyway. You might want to do this if you really do want the query to return all row combinations from two (or more) queries, or it may be that the join condition is much more complicated and is defined as an explicit where expression (but if this is the case, Rekall cannot deduce any structure and queries will always be executed "flat"