Python Sample Triage File

This sample shows how to add files and folders to be included in a Triage load. You can also see how to do this in C.

Add to a Triage Load

This will add records to the [TriageFile] table. It allows you to specify the files and folders where evidence may be found.

The first argument to addtriafefile can be one of the following:

Value	Meaning
1	The name is the name of a file
2	The name is the name of a folder
5	The name is regular expression pattern for a file
6	The name is regular expression pattern for a folder

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton

def main() -> None:
  t = truxton.create()

  t.addtriagefile( 1, "bluetooth_device_map.xml", "Phonebook Access Permissions", "This is a source of MAC addresses" );
  t.addtriagefile( 2, "MySecrets", "MySecrets application data folder", "Things the user wants to be hidden" );
  t.addtriagefile( 5, "dumpstate-2.*\\.txt$", "Android Bug Report", "We can get SSIDs out of this file" );
  t.addtriagefile( 6, "ch.protonmail.android/databases.*", "Proton Mail", "Proton is a privacy oriented service" );

  return None

if __name__ == "__main__":
    sys.exit(main())

The magic values for the first parameter to addtriagefile() can be found here.