Truxton add triage file

This allows you to specify a file or folder to include in a Triage load. This will add a record to the [TriageFile] table.

Syntax

uint64_t truxton_add_triage_file(uint64_t truxton_handle, int64_t type, char const * name, char const * description, char const * why);

Parameters

truxton_handle

The handle created by the truxton_create call.

type

This tells Truxton what the meaning of the name parameter is. It can be one of the following values:

Value	Meaning
1	The name is the name of a file
2	The name is the name of a folder
5	The name is regular expression pattern for a file
6	The name is regular expression pattern for a folder

name

The name of the file or folder to include in a Triage load. This can be a regular expression.

description

More details about the file or folder.

why

Justification for including this in a Triage load.

Remarks

All regular expressions are treated as case insensitive.

Sample

void add_interesting_files( uint64_t truxton_handle )
{
   truxton_add_triage_file( truxton, 1, "bluetooth_device_map.xml", "Phonebook Access Permissions", "This is a source of MAC addresses" );
   truxton_add_triage_file( truxton, 2, "MySecrets", "MySecrets application data folder", "Things the user wants to be hidden" );
   truxton_add_triage_file( truxton, 5, "dumpstate-2.*\\.txt$", "Android Bug Report", "We can get SSIDs out of this file" );
   truxton_add_triage_file( truxton, 6, "ch.protonmail.android/databases.*", "Proton Mail", "Proton is a privacy oriented service" );
}