Truxton event set end - Revision history

Sam at 13:06, 10 February 2021

2021-02-10T13:06:59Z

Sam: /* Sample */

2020-12-22T15:35:24Z

Sample

Sam: Created page with "This sets the end of the event. This corresponds to the `[End]` column of the `[Event]` table. =Syntax..."

2020-11-13T07:45:07Z

Created page with "This sets the end of the event. This corresponds to the <code>[End]</code> column of the <code><nowiki>[</nowiki>Event<nowiki>]</nowiki></code> table. =Syntax..."

New page

This sets the end of the event.
This corresponds to the <code>[End]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.

=Syntax=
<source lang="C">
void truxton_event_set_end( uint64_t event_handle, uint64_t ticks );
</source>

=Parameters=
==<code>event_handle</code>==
The handle to an event created by the [[truxton_event_create]] call.

==<code>ticks</code>==
The date in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.

=Sample=
<source lang="C" highlight="8">
void initialize_investigation(uint64_t truxton, char const * media_id, char const * file_id)
{
uint64_t event_handle = truxton_event_create(truxton);

truxton_event_set_title( event_handle, "Phase 1" );
truxton_event_set_description( event_handle, "As described by SA Barnett" );
truxton_event_set_start( event_handle, get_ticks( "2016-07-31T12:00:00-05:00" ) );
truxton_event_set_end( event_handle, get_ticks( "2017-01-04T12:00:00-05:00" ) );
truxton_event_set_type( event_handle, EVENT_TYPE_ADDED_BY_ANALYST );
truxton_event_set_media_id( event_handle, media_id );
truxton_event_set_file_id( event_handle, file_id );

truxton_event_save( event_handle );

char id[ 65 ];

truxton_event_get_id( event_handle, id, sizeof( id ) );

printf( "Event ID is %s\n", id );

truxton_event_destroy(artifact);
}
</source>

@@ Line 16: / Line 16: @@
 =Sample=
 <source lang="C" highlight="8">
-void initialize_investigation(uint64_t truxton, char const * media_id, char const * file_id)
+void initialize_investigation( uint64_t truxton, char const * media_id, char const * file_id )
+{
-    uint64_t event_handle = truxton_event_create(truxton);
+    uint64_t event_handle = truxton_event_create( truxton );
     truxton_event_set_title( event_handle, "Phase 1" );

@@ Line 36: / Line 36: @@
     printf( "Event ID is %s\n", id );
-    truxton_event_destroy(artifact);
+    truxton_event_destroy( event_handle );
+}
 </source>

Truxton event set end - Revision history

Sam at 13:06, 10 February 2021

Sam: /* Sample */

Sam: Created page with "This sets the end of the event. This corresponds to the [End] column of the [Event] table. =Syntax..."

Sam: Created page with "This sets the end of the event. This corresponds to the `[End]` column of the `[Event]` table. =Syntax..."