Python Sample Triage File - Revision history

Sam: /* Add to a Triage Load */

2024-12-10T20:24:06Z

Add to a Triage Load

Sam: /* Add to a Triage Load */

2024-09-11T20:52:58Z

Add to a Triage Load

Sam at 20:49, 11 September 2024

2024-09-11T20:49:58Z

Sam: Created page with "This sample shows how to add files and folders to be included in a Triage load. You can also see how to do this in C. =Add to a Triage..."

2024-02-09T10:50:32Z

Created page with "This sample shows how to add files and folders to be included in a Triage load. You can also see how to do this in C. =Add to a Triage..."

New page

This sample shows how to add files and folders to be included in a [[Triage]] load.
You can also see how to do this in [[Truxton_add_triage_file#Sample|C]].

=Add to a Triage Load=
This will add records to the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table.
It allows you to specify the files and folders where evidence may be found.

<source lang="python">
import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton

def main():
t = truxton.create()

t.addtriagefile( 1, "bluetooth_device_map.xml", "Phonebook Access Permissions", "This is a source of MAC addresses" );
t.addtriagefile( 2, "MySecrets", "MySecrets application data folder", "Things the user wants to be hidden" );
t.addtriagefile( 5, "dumpstate-2.*\\.txt$", "Android Bug Report", "We can get SSIDs out of this file" );
t.addtriagefile( 6, "ch.protonmail.android/databases.*", "Proton Mail", "Proton is a privacy oriented service" );

return None

if __name__ == "__main__":
sys.exit(main())
</source>

← Older revision		Revision as of 20:49, 11 September 2024
Line 24:		Line 24:
	sys.exit(main())		sys.exit(main())
	</source>		</source>
		+
		+	The magic values for the first parameter to <code>addtriagefile()</code> can be found [[TriageFile_Table#Type\|here]].

@@ Line 5: / Line 5: @@
 This will add records to the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table.
 It allows you to specify the files and folders where evidence may be found.
 <source lang="python">

@@ Line 11: / Line 11: @@
 import truxton
-def main():
+def main() -> None:
    t = truxton.create()