Sam: /* Sample */

2024-02-09T10:48:13Z

Sample

Sam: Created page with "This allows you to specify a file or folder to include in a Triage load. This will add a record to the [TriageFile] 2024-02-09T10:33:01Z Created page with "This allows you to specify a file or folder to include in a Triage load. This will add a record to the <code><nowiki>[</nowiki>TriageFile<nowiki>]</no..." New page This allows you to specify a file or folder to include in a [[Triage]] load. This will add a record to the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table. =Syntax= <source lang="C"> uint64_t truxton_add_triage_file(uint64_t truxton_handle, int64_t type, char const * name, char const * description, char const * why); </source> =Parameters= ==<code>truxton_handle</code>== The handle created by the [[truxton_create]] call. ==<code>type</code>== This tells Truxton what the meaning of the <code>name</code> parameter is. It can be one of the following values: {| class="wikitable" ! Value ! Meaning |- | style="text-align:center;" | 1 | The <code>name</code> is the name of a file |- | style="text-align:center;" | 2 | The <code>name</code> is the name of a folder |- | style="text-align:center;" | 5 | The <code>name</code> is [https://en.wikipedia.org/wiki/Regular_expression regular expression] pattern for a file |- | style="text-align:center;" | 6 | The <code>name</code> is [https://en.wikipedia.org/wiki/Regular_expression regular expression] pattern for a folder |} ==<code>name</code>== The name of the file or folder to include in a [[Triage]] load. This can be a [https://en.wikipedia.org/wiki/Regular_expression regular expression]. ==<code>description</code>== More details about the file or folder. ==<code>why</code>== Justification for including this in a [[Triage]] load. =Remarks= All [https://en.wikipedia.org/wiki/Regular_expression regular expressions] are treated as case insensitive. =Sample= <source lang="C" highlight="3-6"> void add_interesting_files( uint64_t truxton_handle ) { truxton_add_triage_file( truxton, 1, "bluetooth_device_map.xml", "Phonebook Access Permissions", "This is a source of MAC addresses" ); truxton_add_database_id( truxton, 2, "MySecrets", "MySecrets application data folder", "Things the user wants to be hidden" ); truxton_add_database_id( truxton, 5, "dumpstate-2.\\.txt$", "Android Bug Report", "We can get SSIDs out of this file" ); truxton_add_database_id( truxton, 6, "ch.protonmail.android/databases.", "Proton Mail", "Proton is a privacy oriented service" ); } </source>

@@ Line 49: / Line 49: @@
+{
     truxton_add_triage_file( truxton, 1, "bluetooth_device_map.xml", "Phonebook Access Permissions", "This is a source of MAC addresses" );
-    truxton_add_database_id( truxton, 2, "MySecrets", "MySecrets application data folder", "Things the user wants to be hidden" );
+    truxton_add_triage_file( truxton, 2, "MySecrets", "MySecrets application data folder", "Things the user wants to be hidden" );
-    truxton_add_database_id( truxton, 5, "dumpstate-2.*\\.txt$", "Android Bug Report", "We can get SSIDs out of this file" );
+    truxton_add_triage_file( truxton, 5, "dumpstate-2.*\\.txt$", "Android Bug Report", "We can get SSIDs out of this file" );
-    truxton_add_database_id( truxton, 6, "ch.protonmail.android/databases.*", "Proton Mail", "Proton is a privacy oriented service" );
+    truxton_add_triage_file( truxton, 6, "ch.protonmail.android/databases.*", "Proton Mail", "Proton is a privacy oriented service" );
+}
 </source>