This class provides a writable file to add to Truxton.

IOBase Methods

From IOBase it implements:

close() - Flush and close this stream
closed - True if the stream is closed
fileno() - Truxton will return ERROR
flush() - Flush the write buffers of the stream if applicable
isatty() - Return True if the stream is interactive
readable() - Truxton always returns False
readline() - Do not use, will return ERROR
readlines() - Do not use, will return ERROR
seek() - Truxton will return ERROR
seekable() - Truxton always returns False
tell() - Return the current stream position
truncate() - Resize the stream
writable() - Truxton always returns True
writelines() - Write a list of lines to the stream

RawIOBase Methods

From RawIOBase it implements:

Truxton Methods

The above methods will let you read from a file in Truxton as if it were any other file in Python. The following methods are also present to make tasks of adding items extracted from a file easier.

Properties

`accessed: datetime`

When the file was last accessed. This value can be set with either a datetime value or an integer representing FILETIME ticks.

`attributes: int`

An integer value representing the attributes of the file. For a Microsoft filesystem, it can be a combination of the file attribute flags.

`created: datetime`

When the file was created. This value can be set with either a datetime value or an integer representing FILETIME ticks.

`diskoffset: int`

The offset, in bytes, of the first byte of the contents of the file on the physical disk.

`entropy: float`

Shannon's entropy of the contents of the file.

`hash: str`

The MD5 hash of the contents of the file.

`id: str`

The GUID of the file record. This is valid once save() has been called.

`mediaid: str`

The GUID of the media the child file came from.

`modified: datetime`

When the file was last written. This value can be set with either a datetime value or an integer representing FILETIME ticks.

`name: str`

The name of the file.

`origin: int`

Where the file came from. It should be one of the origin values.

`parentid: str`

The GUID of the parent of this file.

`save() -> true`

This will commit the information to the [File] table. It will return True if the record was saved to the database, False if there was an error.

`size: int`

The size, in bytes, of the file.

`status: int`

The status of the contents of the file. It should be one of the content status values.

`type: int`

The type of the file.

Sample

This will retrieve a file from Truxton, print the name and hash as stored in the database then calculate a hash on the contents and print that.

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton
import shutil
from pathlib import Path

def add_file(parent_truxton_file, filename):
  child = parent_truxton_file.newchild()
  with open(filename, "rb") as source_file:
    child.name = Path(filename).name
    shutil.copyfileobj(source_file, child)
  child.save()
  return child

def main():
  t = truxton.create()
  with t.getfileid("66e0fd95-aafe-b0a4-dade-fde000000065") as file:
    child = add_file(file, "C:/decrypts/PlainText.txt")

if __name__ == "__main__":
  sys.exit(main())

TruxtonChildFileIO

Contents