Latest revision as of 06:21, 20 February 2026

Truxton functionality is exposed to the C programming world as a DLL named TruxtonCAPI.dll in the C:\Program Files\Truxton\SDK folder. This DLL can be called from any programming language that has the ability to make operating system calls.

Philosophy

The API is considered to be "flat" in that only integers and ASCII character strings are used in the interface. This was chosen to make it easy for other languages to call the API. The coding convention is all lower case names with underscores separating words. Truxton is a member of the east const posse.

Preparing for Use

Truxton does not ship a linker library for TruxtonCAPI.dll in order to free the developer to use any particular compiler. If you want to link TruxtonCAPI.dll with your own C/C++ code, you will need to generate a linker library.

Alternatively, you can use a plugin pattern of calling LoadLibrary followed by many calls to GetProcAddress to get the function pointers. This is a lot of work and very prone to errors.

Generating a Linker Library for Microsoft Compilers

You can download a free Visual Studio from Microsoft. The steps to produce a LIB file from a DLL are:

Generate a module definition (DEF) file from TruxtonCAPI.dll.
Use the DEF file to create the linker library (LIB) file.

The following Powershell script will create the lib file for you.

$msvc = "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x64\"
$dumpbin = $msvc + "dumpbin.exe"
$lib = $msvc + "lib.exe"

$lines = (& $dumpbin /exports "C:\Program Files\Truxton\SDK\TruxtonCAPI.dll")

Add-Content TruxtonCAPI.def "EXPORTS"

foreach ( $line in $lines )
{
   if ( $line.Contains(" = ") -EQ $true )
   {
      Add-Content TruxtonCAPI.def $line.SubString($line.IndexOf(" = ") + 3)
   }
}

(& $lib /def:TruxtonCAPI.def /out:TruxtonCAPI.lib /machine:x64)

Remove-Item TruxtonCAPI.def, TruxtonCAPI.exp

In your project folder, execute the script from Powershell to create TruxtonCAPI.lib:

.\MakeDef.ps1

API Groups

The API is broken down into the different areas of Truxton.

Initialization

truxton_start - Initializes Truxton
truxton_stop - Uninitializes Truxton

Functions

truxton_carve_file - Sends a file to the carver
truxton_create - Creates a Truxton object
truxton_create_tag - Create a new type of tag
truxton_delete_tag - Removes a tag from the system
truxton_destroy - Frees a Truxton object
truxton_disable_route_update - Disables route updating when a poly file expander ETL is initializing.
truxton_enable_route_update - Enables route updating when a poly file expander ETL is initializing.
truxton_get_database_connection_string - Retrieves the connection string for accessing the Truxton database directly
truxton_get_device_id - Retrieves the BIOS Device identifier
truxton_get_etl_id - Retrieves the unique identifier for this ETL instance
truxton_get_machine_id - Retrieves the Windows Machine identifier
truxton_get_media_investigation - Retrieves the investigation identifier for a given piece of media
truxton_get_version - Retrieves the version of Truxton
truxton_parse_time - Parses a string was a date time value
truxton_route_message - Send a message to down-stream ETL processors
truxton_start_adding_files - Prepares Truxton to add files to the database
truxton_tag_hash - Tags files based on their MD5 hash
truxton_time_now - Returns the current time in FILETIME ticks
truxton_update_investigation_type - Change the type of an existing investigation
truxton_update_media_primary_photo_by_hash - Set the primary photograph of an existing piece of media
truxton_update_media_type - Change the type of an existing media

Maintenance

These functions are used to perform periodic maintenance tasks in Truxton. These will send messages to the maintenance ETL which will carry out the tasks.

truxton_clean_database - Will delete orphaned records from the database
truxton_consolidate_depots - This will start the length process of combining small depots into larger ones
truxton_delete_depots - This will delete depots that have been marked ToBeDeleted
truxton_delete_media - This will delete a piece of media from Truxton
truxton_optimize_database - This will update the query statistics in the Truxton database
truxton_reindex_media - This will resend all files in a piece of media for content indexing

Hash Sets

These functions handle the creation of hash set files

truxton_create_everything_hashset - This will create a hash set file from every unique hash value in Truxton
truxton_create_investigation_hashset - This will create a hash set file from every unique hash value in an investigation
truxton_create_media_hashset - This will create a hash set file from every unique hash value in a piece of media

Database Identification

truxton_add_database_id - Associates a table name with a file type for more accurately identifying databases
truxton_remove_database_id - Removes a table name to file type mapping

File Identification

truxton_get_details - Retrieves details about a file
truxton_get_details_size - Returns the size of the buffer required to hold details of a file
truxton_identify_bytes - Will return the type of the file in the given buffer

Triage Loads

truxton_add_triage_file - Adds a record to the [TriageFile] table to have a file or folder included in a Triage load
truxton_remove_triage_file - Removes a record from the [TriageFile] table

GUI Colors

truxton_set_artifact_type_color - Sets the color of an artifact when displayed in the desktop GUI.
truxton_set_event_type_color - Sets the color of an event when displayed in the desktop GUI.
truxton_set_file_type_color - Sets the color of an file type when displayed in the desktop GUI.
truxton_set_investigation_status_color - Sets the color of an investigation status when displayed in the desktop GUI.
truxton_set_investigation_type_color - Sets the color of an investigation type when displayed in the desktop GUI.
truxton_set_location_type_color - Sets the color of an location type when displayed in the desktop GUI.
truxton_set_message_type_color - Sets the color of a message type when displayed in the desktop GUI.
truxton_set_review_status_color - Sets the color of a review status when displayed in the desktop GUI.
truxton_set_review_type_color - Sets the color of a review type when displayed in the desktop GUI.
truxton_set_url_type_color - Sets the color of a URL type when displayed in the desktop GUI.

Artifacts

Artifacts are pieces of information that are also known as entities.

truxton_artifact_create - Creates a new artifact object
truxton_artifact_destroy - Destroys an existing artifact object
truxton_artifact_get_data_type - Retrieves the raw data type
truxton_artifact_get_file_id - Retrieves the identifier of the file the artifact was found in
truxton_artifact_get_id - After saving, retrieves the identifier of the artifact
truxton_artifact_get_length - Retrieves the number of bytes in the raw data that make up this artifact
truxton_artifact_get_media_id - Retrieves the identifier of the media this artifact is in
truxton_artifact_get_object_id - Retrieves the identifier of the object the artifact came from
truxton_artifact_get_object_type - Retrieves the type of object the artifact came from
truxton_artifact_get_offset - Retrieves the offset in the file where the artifact came from
truxton_artifact_get_type - Retrieves the type of artifact
truxton_artifact_get_value - Retrieves the value of the artifact
truxton_artifact_save - Saves the artifact to the [Entity] table in the database
truxton_artifact_set_data_type - Sets the raw data type
truxton_artifact_set_file_id - Sets the identifier of the file the artifact was found in
truxton_artifact_set_length - Sets the number of bytes in the raw data that make up this artifact
truxton_artifact_set_media_id - Sets the identifier of the media this artifact is in
truxton_artifact_set_object_id - Sets the identifier of the object the artifact came from
truxton_artifact_set_object_type - Sets the type of object the artifact came from
truxton_artifact_set_offset - Sets the offset in the file where the artifact came from
truxton_artifact_set_type - Sets the type of the artifact
truxton_artifact_set_value - Sets the value of the artifact

Derived Objects

The following APIs are used to create objects with an artifact as their parent.

truxton_artifact_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_artifact_tag - Associating a tag with this artifact. This data will be saved to the [Tagged] table.

Artifact Type

This API is used to create custom types of artifacts. If one of the default artifact types don't suite your purpose, you are free to create your own.

truxton_artifact_type_create - Creates a new artifact type object
truxton_artifact_type_destroy - Destroys an existing artifact type object
truxton_artifact_type_save - Saves the data in this object to the [EntityType] table
truxton_artifact_type_get_id - Retrieves the integer value for the type
truxton_artifact_type_set_id - Sets the integer value of the type
truxton_artifact_type_get_long_name - Gets the long human readable name of the artifact type
truxton_artifact_type_set_long_name - Sets the long human readable name of the artifact type
truxton_artifact_type_get_short_name - Gets the short human readable name of the artifact type
truxton_artifact_type_set_short_name - Sets the short human readable name of the artifact type
truxton_delete_artifact_type - Deletes an artifact type from Truxton

BOLOs

These are the APIs used to create a be-on-the-lookout alert criteria.

truxton_bolo_create - Creates a new BOLO object
truxton_bolo_destroy - Destroys a BOLO object
truxton_bolo_get_id - Retrieves the identifier of this object
truxton_bolo_set_id - Sets the identifier of this object
truxton_bolo_get_criteria - Retrieves the criteria of this object
truxton_bolo_set_criteria - Sets the criteria for this BOLO
truxton_bolo_save - Saves the BOLO to the database

Child Files

A child file is one that you have created and need to save in Truxton.

truxton_child_file_create - Create a file object to save to Truxton
truxton_child_file_destroy - Destroys a file object
truxton_child_file_clear - Returns a file object to an initial state of all zeroes
truxton_child_file_get_id - Retrieves the GUID of the child file
truxton_child_file_set_id - Sets the GUID of the child file
truxton_child_file_get_parent_id - Retrieves the GUID of the parent file
truxton_child_file_set_parent_id - Sets the GUID of the parent of the child
truxton_child_file_get_media_id - Retrieves the GUID of the media this child belongs to
truxton_child_file_set_media_id - Sets the GUID of the media this child belongs to
truxton_child_file_get_name - Retrieves the name of the file
truxton_child_file_set_name - Sets the name of the file
truxton_child_file_get_path - Retrieves the path of the file
truxton_child_file_set_path - Sets the path of the file
truxton_child_file_get_hash - Retrieves the MD5 hash (digital fingerprint) of the file's contents
truxton_child_file_get_number_of_children - Retrieves the number of child files of this file
truxton_child_file_set_number_of_children - Sets the number of child files of this file
truxton_child_file_get_created - Retrieves the date and time of when the file was created in FILETIME ticks
truxton_child_file_set_created - Sets the date and time of when the file was created in FILETIME ticks
truxton_child_file_get_accessed - Retrieves the date and time of when the file was accessed in FILETIME ticks
truxton_child_file_set_accessed - Sets the date and time of when the file was accessed in FILETIME ticks
truxton_child_file_get_modified - Retrieves the date and time of when the file was modified (last written to) in FILETIME ticks
truxton_child_file_set_modified - Sets the date and time of when the file was modified (last written to) in FILETIME ticks
truxton_child_file_get_size - Retrieves the size of the file, in bytes, as reported by the operating system
truxton_child_file_set_size - Sets the size of the file, in bytes, as reported by the operating system
truxton_child_file_get_origin - Retrieves the origin of the file
truxton_child_file_set_origin - Sets the origin of the file
truxton_child_file_get_content_status - Retrieves the status of the contents of the file
truxton_child_file_set_content_status - Sets the status of the contents of the file
truxton_child_file_get_truxton - Retrieves the instance of Truxton this child belongs to
truxton_child_file_begin_write - Prepares Truxton for writing contents to be associated with this file
truxton_child_file_end_write - Tells Truxton to finish writing contents
truxton_child_file_write - Gives Truxton bytes to store as the file contents
truxton_child_file_save - Commits data to the database
truxton_child_file_get_type - Retrieves the type of the file
truxton_child_file_set_type - Sets the type of the file
truxton_child_file_get_attributes - Retrieves the attributes of the file
truxton_child_file_set_attributes - Sets the attributes of the file
truxton_child_file_get_disk_offset - Retrieves the physical disk offset of the first byte of contents
truxton_child_file_set_disk_offset - Sets the physical disk offset of the first byte of contents
truxton_child_file_get_entropy - Retrieves the entropy of the file contents

Derived Objects

truxton_child_file_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_child_file_create_artifact - Creates and associates an artifact with this file. The artifact will be saved to the [Entity] table.
truxton_child_file_create_child - Creates another child file with this child file as its parent.
truxton_child_file_create_event - Creates and associates an event with this file. The event will be saved to the [Event] table.
truxton_child_file_create_exif - Creates and associates camera information with this file. The data will be saved to the [EXIF] table.
truxton_child_file_create_location - Creates and associates a geographic location with this file. The data will be saved to the [Location] table.
truxton_child_file_create_relation - Creates a relationship with this file as the source. The data will be saved to the [Relation] table.
truxton_child_file_create_url - Creates a website visit with this file as the source. This data will be saved to the [WebsiteVisit] table.
truxton_child_file_create_usb - Creates a USB device with this file as the source. This data will be saved to the[Entity] table.
truxton_child_file_new_child - Creates a child of this file.
truxton_child_file_tag - Creates a tag and puts it on this file. This data will be saved to the [Tagged] table.

Communications

These are the APIs that deal with humans communicating via email, SMS, chat, etc.

truxton_communication_create - Creates the communication object
truxton_communication_add_participant - Adds a participant to the message
truxton_communication_add_piece - Adds a piece (message body/attachment) to the message
truxton_communication_destroy - Destroys the communication object
truxton_communication_finished - Updates the database for this message
truxton_communication_get_file_id - Retrieves the identifier of the file this message came from
truxton_communication_set_file_id - Sets the identifier of the file this message came from
truxton_communication_get_id - Retrieves the identifier of this message
truxton_communication_get_media_id - Retrieves the identifier of the media this message came from
truxton_communication_set_media_id - Sets the identifier of the media this message came from
truxton_communication_get_received - Retrieves the time the message was received
truxton_communication_set_received - Sets the time the message was received
truxton_communication_get_sent - Retrieves the time the message was sent
truxton_communication_set_sent - Sets the time the message was sent
truxton_communication_get_subject - Retrieves the subject of the message
truxton_communication_set_subject - Sets the subject of the message
truxton_communication_get_type - Retrieves the type of message
truxton_communication_set_type - Sets the type of message
truxton_communication_save - Saves the object to the database

Derived Objects

truxton_communication_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_communication_tag - Tags the message. This data will be saved to the [Tagged] table.

Enumeration

This set of functions allow you to get things out of Truxton.

truxton_enumeration_create - Creates an enumeration
truxton_enumeration_destroy - Destroys the enumeration
truxton_enumeration_get_current_file - Retrieves the parent file of the current enumerated item
truxton_enumeration_get_current_investigation - Retrieves the parent investigation of the current enumerated item
truxton_enumeration_get_current_media - Retrieves the parent media of the current enumerated item
truxton_enumeration_get_double - Retrieves the floating point value at a desired column of a custom enumeration
truxton_enumeration_get_integer - Retrieves the integer value at a desired column of a custom enumeration
truxton_enumeration_get_next - Retrieves the next item in the enumeration
truxton_enumeration_get_scope - Retrieves the scope of the enumeration
truxton_enumeration_get_scope_id - Retrieves the specific item being enumerated
truxton_enumeration_get_string - Retrieves the string at a desired column of a custom enumeration
truxton_enumeration_get_time - Retrieves the time value at a desired column of a custom enumeration
truxton_enumeration_get_target - Retrieves what is being enumerated
truxton_enumeration_set_query - Sets SQL query to use with custom enumeration
truxton_enumeration_set_scope - Sets the scope of the enumeration
truxton_enumeration_set_scope_id - Sets the specific identifier of the scope
truxton_enumeration_set_target - Sets what you want to enumerate
truxton_enumeration_reset - Rewinds the enumeration to the beginning

ETL Application Creation

truxton_etl_add_command_line_argument - Adds a command line argument
truxton_etl_add_desired_file_type - Tells Truxton what types of files you want to process
truxton_etl_create - Creates a Truxton ETL object
truxton_etl_destroy - Destroys a Truxton ETL object
truxton_etl_get_application_name - Retrieves the name of your application
truxton_etl_get_description - Retrieves the human readable description of this exploitation process
truxton_get_etl_id - Retrieves the GUID of the ETL
truxton_etl_get_message - Halts the execution of your program until a message arrives from your message queue
truxton_etl_get_stage_number - Retreives the stage of this exploitation process
truxton_etl_set_application_name - Sets the name of your application
truxton_etl_set_depot_type - Sets the type of depot you want to use
truxton_etl_set_depot_type_name - Sets a seed name for the type of depot you want to use
truxton_etl_set_description - Sets a description that has meaning to another human about this exploitation process
truxton_etl_set_expander_identifier - Sets an identifier to use during reprocessing
truxton_etl_set_expander_version - Sets a custom version of your process
truxton_etl_set_mode - Sets the mode of the application
truxton_etl_set_poly_file_expander - Tells Truxton you are a file expander that needs multiple source files
truxton_etl_set_queue_name - Sets the name of the message queue for this process
truxton_etl_set_stage_number - Sets the stage at which this exploitation process should run
truxton_etl_set_thread_safe - Tells Truxton if it is safe to use your message handler in a multi-threaded fashion

Debugging

truxton_etl_send_me_file_id - Puts a message in your queue given a GUID that matches the [ID] column of the [File] table.
truxton_etl_send_me_files - Put a specified number messages in your queue of a particular file type.
truxton_etl_send_me_hash - Put one file that matches an MD5 hash.
truxton_etl_send_me_local_file - Put a specified file on your system into your message queue.
truxton_etl_send_me_message - Put a specified message into your message queue.

Event

If you need to save a significant place in time, use the following functions. The data structure these API encapsulate is similar to the one used in the event message. These will create a record in the [Event] table.

truxton_event_create - Creates a new event object
truxton_event_destroy - Destroys an existing event object
truxton_event_save - Saves the data in this object to the [Event] table
truxton_event_get_id - After saving, retrieves the GUID of the event.
truxton_event_get_title - Gets the short title of the event
truxton_event_set_title - Sets the short title of the event
truxton_event_get_description - Gets the long description of the event
truxton_event_set_description - Sets the long description of the event
truxton_event_get_start - Gets the beginning of the event in FILETIME ticks
truxton_event_set_start - Sets the beginning of the event in FILETIME ticks
truxton_event_get_end - Gets the end of the event in FILETIME ticks
truxton_event_set_end - Sets the end of the event in FILETIME ticks
truxton_event_get_type - Gets the type of event
truxton_event_set_type - Sets the type of event
truxton_event_get_file_id - Gets the GUID of the file this event came from
truxton_event_set_file_id - Sets the GUID of the file this event came from
truxton_event_get_media_id - Gets the GUID of the media this event belongs to
truxton_event_set_media_id - Sets the GUID of the media this event belongs to

Derived Objects

The following APIs are used to create objects with an event as their parent.

truxton_event_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_event_tag - Creates a tag and puts it on this event. This data will be saved to the [Tagged] table.

Event Type

This API is used to create custom types of events. If one of the default event types don't suite your purpose, you are free to create your own.

truxton_event_type_create - Creates a new event type object
truxton_event_type_destroy - Destroys an existing event type object
truxton_event_type_save - Saves the data in this object to the [EventType] table
truxton_event_type_get_id - Retrieves the integer value for the type
truxton_event_type_set_id - Sets the integer value of the type
truxton_event_type_get_name - Gets the human readable name of the event type
truxton_event_type_set_name - Sets the human readable name of the event type
truxton_delete_event_type - Deletes an event type from Truxton

EXIF (Camera Information)

This set if APIs deal with information from the EXIF section of files. The primary file types that contain EXIF are JPG and TIFF. Not all of the fields of this object are stored in the database. Internally, Truxton has one parser for EXIF and uses that information to perform other forensic tasks.

These functions give you access to a data structure equivalent to the one used in EXIF messages.

Persisted in Database

The following APIs deal with things that are stored in the database.

truxton_exif_create - Creates a new EXIF object
truxton_exif_destroy - Destroys an existing EXIF object
truxton_exif_save - Saves the data in this object to the [EXIF] table in the database
truxton_exif_get_id - Retrieves the object's GUID
truxton_exif_get_file_id - Retrieves the GUID of the file this object came from
truxton_exif_set_file_id - Sets GUID of the file this object came from
truxton_exif_get_media_id - Retrieves GUID of the media this object came from
truxton_exif_set_media_id - Sets the GUID of the media this object came from
truxton_exif_get_altitude - Retrieves the altitude, in meters, of the location
truxton_exif_set_altitude - Sets the altitude, in meters, of the location
truxton_exif_get_body_serial_number - Retrieves the serial number of the body of the imaging device
truxton_exif_set_body_serial_number - Sets the serial number of the body of the imaging device
truxton_exif_get_device_time - Retrieves the time, according to the imaging device, of when the image was taken in FILETIME ticks
truxton_exif_set_device_time - Sets the time, according to the imaging device, of when the image was taken in FILETIME ticks
truxton_exif_get_focal_length - Retrieves the 35mm focal length of the device
truxton_exif_set_focal_length - Sets the focal length of the device when the image was taken
truxton_exif_get_gps_time - Retrieves the time, according to the GPS in the imaging device, of when the image was taken in FILETIME ticks
truxton_exif_set_gps_time - Sets the time, according to the GPS in the imaging device, of when the image was taken in FILETIME ticks
truxton_exif_get_heading - Retrieves the direction the device was pointed when the image was taken
truxton_exif_set_heading - Sets the direction the device was pointed when the image was taken
truxton_exif_get_latitude - Retrieves the latitude portion of the WGS84 coordinates of the location where the image was taken
truxton_exif_set_latitude - Sets the latitude portion of the WGS84 coordinates of the location where the image was taken
truxton_exif_get_lens_serial_number - Retrieves the serial number of the lens attached to the imaging device
truxton_exif_set_lens_serial_number - Sets the serial number of the lens attached to the imaging device
truxton_exif_get_longitude - Retrieves the longitude portion of the WGS84 coordinates of the location where the image was taken
truxton_exif_set_longitude - Sets the longitude portion of the WGS84 coordinates of the location where the image was taken
truxton_exif_get_make - Retrieves the manufacturer of the imaging device
truxton_exif_set_make - Sets the manufacturer of the imaging device
truxton_exif_get_model - Retrieves the model of the imaging device
truxton_exif_set_model - Sets the model of the imaging device
truxton_exif_get_offset - Retrieves the offset into the parent file where the EXIF data block began.
truxton_exif_set_offset - Sets the offset into the parent file where the EXIF data block began.
truxton_exif_get_shutter_count - Retrieves the number of images taken by this device
truxton_exif_set_shutter_count - Sets the number of images taken by this device

Not in Database

The following APIs are useful for forensic processing but not saved in the database. Internally, when Truxton finds EXIF data, it will create and populate an object with that information. All forensic processing is performed on that object. The information presented here, while not stored in the database, was used by Truxton to exploit the camera information data.

truxton_exif_get_gps_time_offset - Retrieves the offset into the parent file where GPS time was found
truxton_exif_set_gps_time_offset - Sets the offset into the parent file where GPS time was found
truxton_exif_get_device_time_offset - Retrieves the offset into the parent file where the time from the device's internal clock was stored
truxton_exif_set_device_time_offset - Sets the offset into the parent file where the time from the device's internal clock is stored
truxton_exif_get_latitude_offset - Retrieves the offset into the parent file where the latitude value was stored
truxton_exif_set_latitude_offset - Sets the offset into the parent file where the latitude value is stored
truxton_exif_get_longitude_offset - Retrieved the offset into the parent file where the longitude value was stored
truxton_exif_set_longitude_offset - Sets the offset into the parent file where the longitude value is stored
truxton_exif_get_altitude_offset - Retrieves the offset into the parent file where the altitude value was stored
truxton_exif_set_altitude_offset - Sets the offset into the parent file where the altitude value is stored
truxton_exif_get_heading_offset - Retrieves the offset into the parent file where the heading value was stored
truxton_exif_set_heading_offset - Sets the offset into the parent file where the heading value is stored
truxton_exif_get_focal_length_offset - Retrieves the offset into the parent file where the focal length value was stored
truxton_exif_set_focal_length_offset - Sets the offset into the parent file where the focal length value is stored
truxton_exif_get_shutter_count_offset - Retrieves the offset into the parent file where the shutter count value was stored
truxton_exif_set_shutter_count_offset - Sets the offset into the parent file where the shutter count value is stored
truxton_exif_get_thumbnail_offset - Retrieves the offset into the parent file where the thumbnail data was stored
truxton_exif_set_thumbnail_offset - Sets the offset into the parent file where the thumbnail data is stored
truxton_exif_get_thumbnail_offset_offset - Retrieves the offset into the parent file where the offset to the thumbnail image was stored
truxton_exif_set_thumbnail_offset_offset - Sets the offset into the parent file where the thumbnail offset value is stored
truxton_exif_get_thumbnail_length - Retrieves the number of bytes in the thumbnail image
truxton_exif_set_thumbnail_length - Sets the number of bytes in the thumbnail image
truxton_exif_get_thumbnail_length_offset - Retrieves the offset into the parent file where the thumbnail length value was stored
truxton_exif_set_thumbnail_length_offset - Sets the offset into the parent file where the thumbnail length value is stored
truxton_exif_get_make_offset - Retrieves the offset into the parent file where the make value was stored
truxton_exif_set_make_offset - Sets the offset into the parent file where the make value is stored
truxton_exif_get_model_offset - Retrieves the offset into the parent file where the model value was stored
truxton_exif_set_model_offset - Sets the offset into the parent file where the model value is stored
truxton_exif_get_body_serial_number_offset - Retrieves the offset into the parent file where the body serial number value was stored
truxton_exif_set_body_serial_number_offset - Sets the offset into the parent file where the body serial number value is stored
truxton_exif_get_lens_serial_number_offset - Retrieves the offset into the parent file where the lens serial number value was stored
truxton_exif_set_lens_serial_number_offset - Sets the offset into the parent file where the lens serial number value is stored

Derived Objects

truxton_exif_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_exif_tag - Creates a tag and puts it on this EXIF object. This data will be saved to the [Tagged] table.

File

File Actions

These are things your can do to a file. These are not data items stored in the database.

truxton_file_change_type - Allows you to change the type of the file
truxton_file_exists - Allows you to test if a file is in the database
truxton_file_get_details - Retrieves JSON with details of the file's contents
truxton_file_get_truxton - Retrieves the Truxton connection used to get this file

File IO

truxton_file_close - Closes the contents. You will no longer be able to read from the file.
truxton_file_free - Deallocates any resources allocated for this object. The file is no longer valid after this call.
truxton_file_is_closed - Tells you if the file has been closed or not.
truxton_file_length - Returns the number of bytes in the file's contents.
truxton_file_read - Reads bytes from the file.
truxton_file_readline - Reads a single line of text from the file.
truxton_file_seek - Changes the file pointer.
truxton_file_tell - Returns the current file pointer position.

File Record Fields

truxton_file_get_accessed - Reads the file's last access timestamp in FILETIME ticks
truxton_file_get_attributes - Reads the attributes of the file
truxton_file_get_content_status - Reads the status of the file's contents
truxton_file_get_created - Reads the file's creation timestamp in FILETIME ticks
truxton_file_get_depot_id - Reads the GUID of the depot holding the file's contents
truxton_file_get_depot_length - Reads the number of bytes in the depot taken by this file's contents
truxton_file_get_depot_name - Reads the file name of the depot holding this file's contents
truxton_file_get_depot_offset - The offset from the beginning of the depot where this file's contents begin
truxton_file_get_disk_offset - Reads physical offset of the first byte of the file's contents
truxton_file_get_entropy - Reads the entropy of the file's contents
truxton_file_get_hash - Reads the MD5 of the file's contents
truxton_file_get_id - Retrieves the file's GUID
truxton_file_get_is_eliminated - Tells you of the file's contents were discarded
truxton_file_get_is_resident - Tells you if the file's contents exist contiguously within its parent
truxton_file_get_media_id - Reads the GUID of the file's media
truxton_file_get_modified - Reads the file's last write timestamp in FILETIME ticks
truxton_file_get_name - Reads the name of the file
truxton_file_get_number_of_children - Returns the number of files that have this one as their parent
truxton_file_get_origin - Reads the origin of the file's contents
truxton_file_get_parent_id - Reads the GUID of the file's parent
truxton_file_get_size - Reads the size of the file as recorded in the directory entry for the file
truxton_file_get_signature - Gets the first four bytes of the contents as an integer
truxton_file_get_type - Reads the type of the file
truxton_file_path_exists - Determines if a file path exists in Truxton

Derived Objects

The following APIs are used to create objects with a file as their parent.

truxton_file_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_file_create_artifact - Creates and associates an artifact with this file. The artifact be saved to the [Entity] table.
truxton_file_create_child - For creating a file.
truxton_file_create_event - Creates and associates an event with this file. The event will be saved to the [Event] table.
truxton_file_create_exif - Creates and associates camera information with this file. The data will be saved to the [EXIF] table.
truxton_file_create_location - Creates and associates a geographic location with this file. The data will be saved to the [Location] table.
truxton_file_create_relation - Creates a relationship with this file as the source. The data will be saved to the [Relation] table.
truxton_file_create_url - Creates a website visit with this file as the source. This data will be saved to the [WebsiteVisit] table.
truxton_file_create_usb - Creates a USB device with this file as the source. This data will be saved to the [USBDevice] table.
truxton_file_open_id - Retrieves a particular file specified by the file's GUID.
truxton_file_open_md5 - Retrieves the first file in Truxton whose contents have the given MD5 hash.
truxton_file_open_path - Retrieves a particular file specified by an exact path.
truxton_file_tag - Creates a tag and puts it on this file. This data will be saved to the [Tagged] table.

File Export

truxton_file_export_create - Creates a new file export object
truxton_file_export_destroy - Destroys an existing file export object
truxton_file_export_execute - Exports the files based on the given criteria and options
truxton_file_export_add_criteria - Adds a criteria to the export
truxton_file_export_set_option - Sets options for the export
truxton_file_export_set_truxton - Sets the Truxton object for an export
truxton_file_export_where_clause - Retrieves the SQL WHERE clause of the current criteria

File Type

truxton_file_type_create - Creates a file type object.
truxton_file_type_open_id - Opens an existing a file type.
truxton_file_type_destroy - Frees any resources allocated for this file type object.
truxton_file_type_get_id - Retrieves the identifier you assigned to this file type.
truxton_file_type_set_id - Sets the unique identifier. This corresponds to the [ID] column of the [FileType] table.
truxton_file_type_get_parent_id - Retrieves the parent identifier you assigned to this file type.
truxton_file_type_set_parent_id - Sets the more generic type of the file. This corresponds to the [ParentFileTypeID] column of the [FileType] table.
truxton_file_type_get_short_name - Retrieves the short name you assigned to this file type.
truxton_file_type_set_short_name - Sets the short name to use for this file type. This corresponds to the [ShortName] column of the [FileType] table.
truxton_file_type_get_long_name - Retrieves the longer description you assigned to this file type.
truxton_file_type_set_long_name - Sets the longer description of the file type. This corresponds to the [LongName] column of the [FileType] table.
truxton_file_type_get_extension - Retrieves the file name extension you assigned to this object.
truxton_file_type_set_extension - Sets the file name extension for this file type.
truxton_file_type_get_mime_type - Retrieves the MIME type you assigned to this object. This corresponds to the [Extension] column of the [FileType] table.
truxton_file_type_set_mime_type - Sets the MIME type. This corresponds to the [MIME] column of the [FileType] table.
truxton_file_type_save - This will write the information in the object to the [FileType] table.
truxton_file_type_update_average_file_size - This will update the [AverageFileSize] column of the [FileType] table.
truxton_file_type_update_maximum_carve_file_size - This will update the [MaximumCarveFileSize] column of the [FileType] table.
truxton_file_type_update_minimum_carve_file_size - This will update the [MinimumCarveFileSize] column of the [FileType] table.

Group

A group is a collection of things scoped to an investigation and investigator. This is the technology behind marking things as Findings.

truxton_group_create - Creates a group
truxton_group_destroy - Destroys the group object
truxton_group_save - Saves the group to the [Group] table in the database
truxton_group_get_id - Gets the group GUID
truxton_group_set_id - Sets the group GUID
truxton_group_get_investigation_id - Gets the GUID of the investigation this group belongs to
truxton_group_set_investigation_id - Sets the GUID of the investigation this group belongs to
truxton_group_get_investigator_id - Gets the investigator's GUID
truxton_group_set_investigator_id - Sets the investigator's GUID
truxton_group_get_copy_id - Gets the GUID of the group this group was copied from
truxton_group_set_copy_id - Sets the GUID of the group this group was copied from
truxton_group_get_name - Gets the name of the group
truxton_group_set_name - Sets the name of the group
truxton_group_get_description - Gets the description of the group
truxton_group_set_description - Sets the description of the group
truxton_group_get_status - Gets the status of the group
truxton_group_set_status - Sets the status of the group
truxton_group_get_type - Gets the type of the group
truxton_group_set_type - Sets the type of the group
truxton_group_get_created - Gets the date time of the group creation in FILETIME ticks
truxton_group_set_created - Sets the date time of the group creation in FILETIME ticks
truxton_group_get_is_default - Tells you if this group is the default group for the investigation
truxton_group_set_is_default - Sets the group to be the default
truxton_group_get_is_deleted - Tells you if this group is deleted
truxton_group_set_is_deleted - Marks the group as deleted

Investigation

truxton_investigation_add_media - Adds media to the investigation
truxton_investigation_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_investigation_create - Creates an investigation object
truxton_investigation_create_group - Creates a group associated with this investigation
truxton_investigation_destroy - Destroys an investigation object
truxton_investigation_get_active_group_id - Retrieves the GUID of the investigation's active group
truxton_investigation_get_case_number - Retrieves the case number of the investigation
truxton_investigation_get_description - Retrieves the description of the investigation
truxton_investigation_get_id - Retrieves the investigation's GUID
truxton_investigation_get_jurisdiction - Retrieves the jurisdiction identifier of the investigation
truxton_investigation_get_name - Retrieves the name of the investigation
truxton_investigation_get_opened - Retrieves when the investigation was opened
truxton_investigation_get_status - Retrieves the status of the investigation
truxton_investigation_get_truxton - Retrieves the parent Truxton handle
truxton_investigation_get_type - Retrieves the type of the investigation
truxton_investigation_initialize_findings - Initializes the "My Findings" group for this investigation
truxton_investigation_open_id - Opens an existing investigation
truxton_investigation_remove_media - Removes media from the investigation
truxton_investigation_save - Saves the data in the object to the [Investigation] table
truxton_investigation_set_active_group_id - Sets the GUID of the group to be the default for the investigation
truxton_investigation_set_case_number - Sets the case number of the investigation
truxton_investigation_set_description - Sets the description of the investigation
truxton_investigation_set_id - Assigns a GUID to the investigation
truxton_investigation_set_jurisdiction - Sets the jurisdiction identifier of the investigation
truxton_investigation_set_name - Sets the name of the investigation
truxton_investigation_set_opened - Sets the date and time of when the investigation was opened in FILETIME ticks
truxton_investigation_set_status - Sets the status of the investigation
truxton_investigation_set_type - Sets the type of the investigation
truxton_delete_investigation_by_name - Deletes an investigation given only a name

Investigation Event

This set of API's allow you to add records to the [InvestigationEvent] table.

truxton_investigation_event_create - Creates an investigation event object
truxton_investigation_event_destroy - Destroys the investigation event object
truxton_investigation_event_get_id - Gets the event GUID
truxton_investigation_event_set_id - Sets the event GUID
truxton_investigation_event_get_investigation_id - Gets the investigation GUID
truxton_investigation_event_set_investigation_id - Sets the investigation GUID
truxton_investigation_event_get_color - Retrieves the color assigned to the event
truxton_investigation_event_set_color - Assigns a color to the event
truxton_investigation_event_get_text - Retrieves the text of the event
truxton_investigation_event_set_text - Sets the text of the event
truxton_investigation_event_get_status - Retrieves the status of the investigation
truxton_investigation_event_set_status - Sets the status of the investigation
truxton_investigation_event_get_type - Retrieves the type of the event
truxton_investigation_event_set_type - Sets the type of the event
truxton_investigation_event_get_when - Retrieves when the event took place in FILETIME ticks
truxton_investigation_event_set_when - Sets when the event took place in FILETIME ticks
truxton_investigation_event_save - Saves the investigation event object to the database

Jurisdiction

Jurisdictions is a way to keep track of work done on behalf of others. Say you're a regional forensics lab and your boss asks you, "How much work did we do for Mayberry last quarter?"

truxton_jurisdiction_create - This will create a new jurisdiction object
truxton_jurisdiction_destroy - This will destroy the jurisdiction object
truxton_jurisdiction_save - This will save the data in the object to the [Jurisdiction] table
truxton_jurisdiction_get_id - This will retrieve the id of the jurisdiction
truxton_jurisdiction_set_id - This will set the id of the jurisdiction
truxton_jurisdiction_get_description - This retrieves the description of the jurisdiction
truxton_jurisdiction_set_description - This sets the description of the jurisdiction
truxton_jurisdiction_get_name - This retrieves the name of the jurisdiction
truxton_jurisdiction_set_name - This sets the name of the jurisdiction

Geographic Location

truxton_location_create - Creates geographic location. The data will be saved to the [Location] table
truxton_location_destroy - Destroys the location object
truxton_location_save - Saves the information in the object to the [Location] table
truxton_location_get_id - After saving, retrieves the GUID of the event
truxton_location_get_file_id - Retrieves the GUID of the file the location came from
truxton_location_set_file_id - Sets the GUID of the file this location came from
truxton_location_get_media_id - Retrieves the GUID of the media this location came from
truxton_location_set_media_id - Sets the GUID of the media this location came from
truxton_location_get_altitude - Retrieves the altitude, in meters, of this location
truxton_location_set_altitude - Sets the altitude, in meters, of this location
truxton_location_get_label - Retrieves the short title of this location
truxton_location_set_label - Sets the short description of this location
truxton_location_get_latitude - Retrieves the latitude portion of the WGS84 coordinates of this location
truxton_location_set_latitude - Sets the latitude portion of the WGS84 coordinates of this location
truxton_location_get_longitude - Retrieves the longitude portion of the WGS84 coordinates of this location
truxton_location_set_longitude - Sets the longitude portion of the WGS84 coordinates of this location
truxton_location_get_type - Retrieves the type of the location
truxton_location_set_type - Sets the type of the location
truxton_location_get_when - Retrieves the date and time associated with this location in FILETIME ticks
truxton_location_set_when - Sets the date and time associated with this location in FILETIME ticks

Derived Objects

The following APIs are used to create objects with a location as their parent.

truxton_location_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_location_tag - Associating a tag with this media. This data will be saved to the [Tagged] table.

Media

These are the API's that allow you to add to the [Media] table in the database.

truxton_media_create - Creates a new media object
truxton_media_open_by_name - Opens an existing media in the database given the media's name.
truxton_media_open_id - Opens an existing media in the database given the media's GUID.
truxton_media_destroy - Frees any resources allocated to this object
truxton_media_get_id - Retrieves the GUID of the media
truxton_media_set_id - Sets the GUID of the media
truxton_media_get_name - Retrieves the name of the media
truxton_media_set_name - Sets the name of the media
truxton_media_get_description - Retrieves the longer description of the media
truxton_media_set_description - Sets the description of the media
truxton_media_get_case_number - Retrieves the case identifier of the media
truxton_media_set_case_number - Sets the case identifier of the media
truxton_media_get_originator - Retrieves who asked you to process the media
truxton_media_set_originator - Sets the origin of the media
truxton_media_get_evidence_bag - Retrieves the identifier of the evidence bag the media is being kept in
truxton_media_set_evidence_bag - Records the identifier of the evidence bag the media is stored in.
truxton_media_get_status - Retrieves the status of the media
truxton_media_set_status - Sets the status of the media
truxton_media_get_type - Retrieves the type of the media
truxton_media_set_type - Sets the type of the media
truxton_media_get_created - Retrieves when the media was created in FILETIME ticks
truxton_media_set_created - Sets when the media was created in FILETIME ticks
truxton_media_get_last_updated - Retrieves when the media was last updated in FILETIME ticks
truxton_media_set_last_updated - Sets when the media was last updated in FILETIME ticks
truxton_media_get_expires - Retrieves the expiration date of the media
truxton_media_set_expires - Sets the expiration date of the media
truxton_media_get_percent_complete - Retrieves the completeness the processing of this media
truxton_media_set_percent_complete - Sets the completeness the processing of this media
truxton_media_get_load_configuration_id - Retrieves the load configuration of this media
truxton_media_set_load_configuration_id - Sets the load configuration of this media
truxton_media_get_size - Retrieves the size, in bytes, of the original media
truxton_media_set_size - Sets the size, in bytes, of the original media
truxton_media_get_latitude - Retrieves the latitude portion of the WGS84 coordinates of where the media was seized.
truxton_media_set_latitude - Sets the latitude portion of the WGS84 coordinates of where the media was seized.
truxton_media_get_longitude - Retrieves the longitude portion of the WGS84 coordinates of where the media was seized.
truxton_media_set_longitude - Sets the longitude portion of the WGS84 coordinates of where the media was seized.
truxton_media_get_generated_files_folder_id - Retrieves the GUID of the "Generated Files" folder in the media
truxton_media_get_root_file_id - Retrieves the GUID of the top level file in the media
truxton_media_save - Saves the media information to the database
truxton_delete_media_by_name - Deletes a piece of media given only a name
truxton_media_set_calculated_size - Calculates the size of the media and updates the database

Derived Objects

The following APIs are used to create objects with a media as their parent.

truxton_media_add_child - Created a child file object belonging to this media.
truxton_media_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_media_tag - Associating a tag with this media. This data will be saved to the [Tagged] table.

Maintenance Functions

truxton_media_update_cache_file_counts - This will count the files in the different groups and cache them
truxton_media_update_child_count - This method updates the [NumberOfChildren] column of the [File] for this media
truxton_media_update_paths - This method updates the [FullPathID] column of the [File] for this media

Message

This is the message sent on the message bus between the ETL processes.

truxton_message_create - Creates a new message object
truxton_message_destroy - Destroys the message object
truxton_message_send - Sends a message to a particular queue
truxton_message_get_queue_is_empty - Tells you if the message queue is empty
truxton_message_set_queue_is_empty - Sets the empty-queue attribute
truxton_message_get_route_id - Retrieves the route this message is taking
truxton_message_set_route_id - Sets the route the message should take
truxton_message_get_priority - Retrieves the priority of the message
truxton_message_set_priority - Sets the priority of the message
truxton_message_get_file_id - Retrieves the identifier of the file
truxton_message_set_file_id - Sets the identifier of the file
truxton_message_get_parent_id - Retrieves the parent file identifier
truxton_message_set_parent_id - Sets the parent file identifier
truxton_message_get_media_id - Retrieves the media identifier
truxton_message_set_media_id - Sets the media identifier
truxton_message_get_depot_id - Retrieves the depot identifier
truxton_message_set_depot_id - Sets the depot identifier
truxton_message_get_depot_offset - Retrieves the offset into the depot of the first byte of the file's contents
truxton_message_set_depot_offset - Sets the offset into the depot of the first byte of the file's contents
truxton_message_get_depot_length - Retrieves the number of bytes in the depot for this file's contents
truxton_message_set_depot_length - Sets the number of bytes in the depot for this file's contents
truxton_message_get_hash - Retrieves the MD5 hash (digital fingerprint) of the file's contents
truxton_message_set_hash - Sets the MD5 hash (digital fingerprint) of the file's contents
truxton_message_get_signature - Retrieves the first four bytes of the contents as an integer
truxton_message_set_signature - Sets the first four bytes of the contents as an integer
truxton_message_get_file_type - Retrieves the type of the file
truxton_message_set_file_type - Sets the type of the file
truxton_message_get_depot_name - Retrieves the name of the file that stores this file's contents
truxton_message_set_depot_name - Sets the name of the file that stores this file's contents
truxton_message_get_dont_route - Retrieves the Don't Route flag
truxton_message_set_dont_route - Sets the Don't Route flag
truxton_message_get_truxton - Retrieves the Truxton handle
truxton_message_set_truxton - Sets the Truxton handle

Derived Objects

The following APIs are used to create objects from the given message.

truxton_message_get_file - Created a child file object belonging to this media.

Message Addresses

truxton_message_address_create - Creates a message address
truxton_message_address_destroy - Frees a message address
truxton_message_address_save - Saves the message address to the [MessageAddress] table
truxton_message_address_get_id - Retrieves the GUID of the message address
truxton_message_address_get_combined_id - Retrieves the combined identifier for the account and server
truxton_message_address_get_combined_guid - Retrieves the GUID of the combined identifier for the address
truxton_message_address_get_account - Retrieves the account part of the address
truxton_message_address_set_account - Sets the account part of the address
truxton_message_address_get_server - Retrieves the server part of the address
truxton_message_address_set_server - Sets the server part of the address
truxton_message_address_get_name - Retrieves the name associated with the address
truxton_message_address_set_name - Sets the name to associate with the address

Message Participant

This is basically a useless API. It is used internally during the enumeration of the participants of a communication.

truxton_message_participant_create - Creates a participant in a message
truxton_message_participant_destroy - Frees the participant object
truxton_message_participant_get_id - Retrieves he globally unique identifier of the participant
truxton_message_participant_set_id - Sets the globally unique identifier of the participant
truxton_message_participant_get_combined_id - Retrieves the combined id of the message address
truxton_message_participant_get_combined_guid - Retrieves the combined identifier as a globally unique identifier
truxton_message_participant_get_account - Retrieves the account portion of the message address
truxton_message_participant_set_account - Sets the account portion of the message address
truxton_message_participant_get_file_id - Retrieves the globally unique identifier of the file containing this participant
truxton_message_participant_set_file_id - Sets the globally unique identifier of the file containing this participant
truxton_message_participant_get_media_id - Retrieves the globally unique identifier of the media containing this participant
truxton_message_participant_set_media_id - Sets the globally unique identifier of the media containing this participant
truxton_message_participant_get_message_address_id - Retrieved the globally unique identifier of the message address
truxton_message_participant_set_message_address_id - Sets the globally unique identifier of the message address
truxton_message_participant_get_message_id - Retrieves the globally unique identifier for the participant
truxton_message_participant_set_message_id - Sets the globally unique identifier for the participant
truxton_message_participant_get_server - Retrieves the server portion of the participant address
truxton_message_participant_set_server - Sets the server portion of the participant address
truxton_message_participant_get_name - Retrieves the name portion of the participant address
truxton_message_participant_set_name - Sets the name portion of the participant address
truxton_message_participant_get_type - Gets the role this participant took in the message
truxton_message_participant_set_type - Sets the role this participant took in the message

Options

Truxton "options" are otherwise known as configuration settings, command line options, etc. They are configuration items that your program can use.

truxton_options_create - Creates the options object
truxton_options_destroy - Frees any resources allocated by the options
truxton_options_exists - Determines if a value can be read from the options object
truxton_options_get_boolean - Reads a named boolean value
truxton_options_get_integer - Reads a named integer value
truxton_options_get_string - Reads a named string value

Note

This set of API's allow you to add records to the [InvestigatorNote] table.

truxton_note_create - Creates a note
truxton_note_destroy - Frees a note
truxton_note_get_investigation_id - Retrieves the GUID of the investigation that this note belongs
truxton_note_set_investigation_id - Sets the investigation GUID of the note
truxton_note_get_object_id - Retrieves the identifier of the object that has the attached note
truxton_note_set_object_id - Sets the identifier of the object to attach the note to
truxton_note_get_object_type - Retrieves the type of the object id
truxton_note_set_object_type - Sets the type of the object id
truxton_note_get_text - Retrieves the contents of the investigator's note
truxton_note_set_text - Sets the contents of the investigator's note
truxton_note_save - Saves the note to the [InvestigatorNote] table in the database

Relation

These functions let you add to the [Relation] table in Truxton. This is how to establish some sort of relationship between items in Truxton to create a graph. Relations in Truxton adhere to the form of "A is a thing of B" Truxton is not focused on exploring graphs (cliques anyone?) but needed a way to establish simple relationships between objects.

truxton_relation_create - Creates a new relationship object
truxton_relation_destroy - Destroys an existing relationship object
truxton_relation_save - Saves the information in the object to the [Relation] table
truxton_relation_get_a_id - Retrieves the GUID of the A object
truxton_relation_set_a_id - Sets the GUID of the A object
truxton_relation_get_b_id - Retrieves the GUID of the B object
truxton_relation_set_b_id - Sets the GUID of the B object
truxton_relation_get_source_id - Retrieves the GUID of the object this relation came from
truxton_relation_set_source_id - Sets the GUID of the object this relation came from
truxton_relation_get_a_type - Gets the type of A's object id
truxton_relation_set_a_type - Sets the type of A's object id
truxton_relation_get_b_type - Gets the type of B's object id
truxton_relation_set_b_type - Sets the type of B's object id
truxton_relation_get_source_type - Gets the type of the source's object id
truxton_relation_set_source_type - Sets the type of the source's object id
truxton_relation_get_relation - Retrieves the type of the relation
truxton_relation_set_relation - Sets the type of the relation

Sensitive Site List

These are the API's that allow you to manipulate a sensitive site list for Truxton. These will add records to the [SensitiveSiteList] and [SensitiveSite] tables.

truxton_sensitive_site_list_create - Creates a new sensitive site list object
truxton_sensitive_site_list_open_id - Opens an existing sensitive site list object
truxton_sensitive_site_list_destroy - Destroys the sensitive site list object
truxton_sensitive_site_list_delete - Deletes the sensitive site list and entries from the [SensitiveSiteList] and [SensitiveSite] tables in the database
truxton_sensitive_site_list_get_id - Retrieves the GUID of the list
truxton_sensitive_site_list_set_id - Sets the GUID of the list
truxton_sensitive_site_list_get_name - Retrieves the name of the sensitive site list
truxton_sensitive_site_list_set_name - Sets the name of the sensitive site list
truxton_sensitive_site_list_get_description - Retrieves the description of the list
truxton_sensitive_site_list_set_description - Sets the description of the list
truxton_sensitive_site_list_save - Saves the data to the [SensitiveSiteList] table
truxton_sensitive_site_list_add - Adds a geographic point to the current sensitive site list. It writes to the [SensitiveSite] table.
truxton_sensitive_site_list_remove - Removes a geographic point from the current list. It deletes from the [SensitiveSite] table.

Subject

These are the API's that allow you to add an investigative subject to Truxton. These will add records to the [Suspect] table.

truxton_subject_create - Creates a new investigative subject
truxton_subject_destroy - Destroys the subject
truxton_subject_get_id - Retrieves the GUID of the subject
truxton_subject_set_id - Sets the GUID of the subject
truxton_subject_get_name - Sets the name of the subject
truxton_subject_set_name - Retrieves the name of the subject
truxton_subject_get_description - Retrieves the description of the subject
truxton_subject_set_description - Sets the description of the subject
truxton_subject_get_picture - Retrieves the picture of the subject
truxton_subject_set_picture - Sets the picture of the subject
truxton_subject_get_custom - Retrieves the custom data of the subject
truxton_subject_set_custom - Sets the custom data of the subject
truxton_subject_get_birthday - Retrieves the birthday of the subject in FILETIME ticks
truxton_subject_set_birthday - Sets the birthday of the subject in FILETIME ticks
truxton_subject_save - Will commit the information in the subject object to the [Suspect] table.
truxton_delete_subject - Deletes a subject from the system

Derived Objects

The following APIs are used to create objects with a subject as their parent.

truxton_subject_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_subject_tag - Associating a tag with this subject. This data will be saved to the [Tagged] table.

Types

Truxton has many different types in it. They are generally integer values that have meanings. Here's how to get a list of them.

truxton_get_content_status_names - Retrieves mappings from the [ContentStatus] table
truxton_get_data_type_names - Retrieves mappings from the [DataType] table
truxton_get_depot_status_names - Retrieves mappings from the [DepotStatus] table
truxton_get_depot_type_names - Retrieves mappings from the [DepotType] table
truxton_get_entity_type_names - Retrieves mappings from the [EntityType] table
truxton_get_event_type_names - Retrieves mappings from the [EventType] table
truxton_get_file_type_names - Retrieves mappings from the [FileType] table
truxton_get_file_type_mime_types - Retrieves mappings from the [FileType] table
truxton_get_group_entry_type_names - Retrieves mappings from the [GroupEntryType] table
truxton_get_group_status_names - Retrieves mappings from the [GroupStatus] table
truxton_get_group_type_names - Retrieves mappings from the the [GroupType] table
truxton_get_investigation_status_names - Retrieves mappings from the [InvestigationStatus] table
truxton_get_investigation_type_names - Retrieves mappings from the [InvestigationType] table
truxton_get_location_type_names - Retrieves mappings from the [LocationType] table
truxton_get_media_status_names - Retrieves mappings from the [MediaStatus] table
truxton_get_media_type_names - Retrieves mappings from the [MediaType] table
truxton_get_message_address_type_names - Retrieves mappings from the [MessageAddressType] table
truxton_get_message_type_names - Retrieves mappings from the [MessageType] table
truxton_get_object_type_names - Retrieves mappings from the [ObjectType] table
truxton_get_origin_names - Retrieves mappings from the [Origin] table
truxton_get_relation_type_names - Retrieves mappings from the [RelationType] table
truxton_get_url_type_names - Retrieves mappings from the [URLType] table
truxton_get_website_method_names - Retrieves mappings from the [WebsiteMethod] table

URL

These functions encapsulate a data structure similar to the one used in the Website Visit message.

truxton_url_create - Creates a new URL object
truxton_url_destroy - Destroys an existing URL object
truxton_url_save - Saves the information in the object to the [WebsiteVisit] table
truxton_url_get_account - Retrieves the account in use when the URL was visited
truxton_url_set_account - Sets the account in use when the URL was visited
truxton_url_get_account_offset - Retrieves the offset into the parent file where the account was found
truxton_url_set_account_offset - Sets the offset into the parent file where the account was found
truxton_url_get_file_id - Retrieves the identifier of the file this URL came from
truxton_url_set_file_id - Sets the identifier of the file this URL came from
truxton_url_get_format - Retrieves the format of the URL
truxton_url_set_format - Sets the format of the URL
truxton_url_get_id - Retrieves the identifier of the URL after it has been saved
truxton_url_get_local_filename - Retrieves the name of the file the URL was cached to
truxton_url_set_local_filename - Sets the name of the file the URL was cached to
truxton_url_get_media_id - Retrieves the identifier of the media this URL belongs to
truxton_url_set_media_id - Sets the identifier of the media this URL belongs to
truxton_url_get_method - Retrieves the method used to visit the URL
truxton_url_set_method - Sets the method used to visit the URL
truxton_url_get_type - Retrieves the type of the URL
truxton_url_set_type - Sets the type of the URL
truxton_url_get_url - Retrieves the URL that was visited
truxton_url_set_url - Sets the URL that was visited
truxton_url_get_url_offset - Retrieves the offset into the parent file where the URL was found
truxton_url_set_url_offset - Sets the offset into the parent file where the URL was found
truxton_url_get_when - Retrieves the date and time of when the URL was visited in FILETIME ticks
truxton_url_set_when - Sets the date and time of when the URL was visited in FILETIME ticks

Derived Objects

The following APIs are used to create objects with an event as their parent.

truxton_url_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_url_tag - Creates a tag and puts it on this location. This data will be saved to the [Tagged] table.

USB Device

truxton_usb_create - Creates a new USB object
truxton_usb_destroy - Destroys an existing USB object
truxton_usb_save - Saves the information in the object to the [USBDevice] table
truxton_usb_get_device_id - Retrieves the identifier of the USB device as assigned by Windows
truxton_usb_set_device_id - Sets the identifier of the USB device as assigned by Windows
truxton_usb_get_device_type - Retrieves the type of the USB device
truxton_usb_set_device_type - Sets the type of the USB device
truxton_usb_get_file_id - Retrieves the identifier of the file this USB came from
truxton_usb_set_file_id - Sets the identifier of the file this USB came from
truxton_usb_get_id - Retrieves the identifier of the USB after it has been saved
truxton_usb_get_media_id - Retrieves the identifier of the media this USB belongs to
truxton_usb_set_media_id - Sets the identifier of the media this USB belongs to
truxton_usb_get_file_offset - Retrieves the offset into the parent file where the USB was found
truxton_usb_set_file_offset - Sets the offset into the parent file where the USB was found
truxton_usb_get_product_id - Retrieves the product identifier (PID) of the USB device
truxton_usb_set_product_id - Sets the product identifier (PID) of the USB device
truxton_usb_get_revision - Retrieves the revision number of the device
truxton_usb_set_revision - Sets the revision number of the device
truxton_usb_get_vendor_id - Retrieves the vendor identifier (VID) of the USB device
truxton_usb_set_vendor_id - Sets the vendor identifier (VID) of the USB device
truxton_usb_get_when - Retrieves the date and time of when the USB was seen in FILETIME ticks
truxton_usb_set_when - Sets the date and time of when the USB was seen in FILETIME ticks

Derived Objects

truxton_usb_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
truxton_usb_tag - Associate a tag with this USB device. This data will be saved to the [Tagged] table.

Debugging

truxton_dump_black_box - Dumps the black box of the given process id
truxton_set_black_box_activity - Sets the activity taking place at a location in the black box
truxton_set_black_box_source_code_location - Sets a location in the black box
truxton_set_black_box_thread_type - Sets type of the thread in the black box
truxton_set_black_box_value - Sets a debugging value in the black box

Samples

One time setup - Things that should be done before slinging code
Register a New File Type - Create your own type of file
ETL for File Identification - Identify new file types
ETL for File Exploitation - Exploit files
Export Videos - Export only unique videos from Truxton

@@ Line 57: / Line 57: @@
 ==Functions==
+* [[truxton_carve_file]] - Sends a file to the carver
 * [[truxton_create]] - Creates a Truxton object
+* [[truxton_create_tag]] - Create a new type of tag
+* [[truxton_delete_tag]] - Removes a tag from the system
 * [[truxton_destroy]] - Frees a Truxton object
-* [[truxton_create_tag]] - Create a new type of tag
+* [[truxton_disable_route_update]] - Disables route updating when a [[Poly|poly file expander]] ETL is initializing.
+* [[truxton_enable_route_update]] - Enables route updating when a [[Poly|poly file expander]] ETL is initializing.
+* [[truxton_get_database_connection_string]] - Retrieves the connection string for accessing the Truxton database directly
 * [[truxton_get_device_id]] - Retrieves the [https://en.wikipedia.org/wiki/BIOS BIOS] Device identifier
+* [[truxton_get_etl_id]] - Retrieves the unique identifier for this ETL instance
 * [[truxton_get_machine_id]] - Retrieves the Windows Machine identifier
+* [[truxton_get_media_investigation]] - Retrieves the investigation identifier for a given piece of media
 * [[truxton_get_version]] - Retrieves the version of Truxton
+* [[truxton_parse_time]] - Parses a string was a date time value
 * [[truxton_route_message]] - Send a message to down-stream ETL processors
 * [[truxton_start_adding_files]] - Prepares Truxton to add files to the database
-* [[truxton_tag_hash]] -
+* [[truxton_tag_hash]] - Tags files based on their [https://en.wikipedia.org/wiki/MD5 MD5] hash
+* [[truxton_time_now]] - Returns the current time in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 * [[truxton_update_investigation_type]] - Change the [[Investigation Types|type]] of an existing investigation
+* [[truxton_update_media_primary_photo_by_hash]] - Set the primary photograph of an existing piece of media
 * [[truxton_update_media_type]] - Change the [[Media Types|type]] of an existing media
-* [[truxton_update_media_primary_photo_by_hash]] - Set the primary photograph of an existing piece of media
 ===Maintenance===
@@ Line 76: / Line 85: @@
 * [[truxton_clean_database]] - Will delete orphaned records from the database
 * [[truxton_consolidate_depots]] - This will start the length process of combining small depots into larger ones
-* [[truxton_delete_depots]] - This will delete depots that have been marked ToBeDeleted
+* [[truxton_delete_depots]] - This will delete depots that have been marked <code>ToBeDeleted</code>
 * [[truxton_delete_media]] - This will delete a piece of media from Truxton
 * [[truxton_optimize_database]] - This will update the query statistics in the Truxton database
@@ Line 90: / Line 99: @@
 * [[truxton_add_database_id]] - Associates a table name with a file type for more accurately [[Identifying Databases|identifying databases]]
 * [[truxton_remove_database_id]] - Removes a table name to file type mapping
+===File Identification===
+* [[truxton_get_details]] - Retrieves [[Type_File_Details|details]] about a file
+* [[truxton_get_details_size]] - Returns the size of the buffer required to hold [[Type_File_Details|details]] of a file
+* [[truxton_identify_bytes]] - Will return the [[File_Types_Supported|type]] of the file in the given buffer
+===Triage Loads===
+* [[truxton_add_triage_file]] - Adds a record to the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table to have a file or folder included in a [[Triage]] load
+* [[truxton_remove_triage_file]] - Removes a record from the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table
+===GUI Colors===
+* [[truxton_set_artifact_type_color]] - Sets the color of an [[Entity Types|artifact]] when displayed in the desktop GUI.
+* [[truxton_set_event_type_color]] - Sets the color of an [[Event Types|event]] when displayed in the desktop GUI.
+* [[truxton_set_file_type_color]] - Sets the color of an [[File Types Supported|file type]] when displayed in the desktop GUI.
+* [[truxton_set_investigation_status_color]] - Sets the color of an [[Investigation Statuses|investigation status]] when displayed in the desktop GUI.
+* [[truxton_set_investigation_type_color]] - Sets the color of an [[Investigation_Types|investigation type]] when displayed in the desktop GUI.
+* [[truxton_set_location_type_color]] - Sets the color of an [[Location Types|location type]] when displayed in the desktop GUI.
+* [[truxton_set_message_type_color]] - Sets the color of a [[Message Types|message type]] when displayed in the desktop GUI.
+* [[truxton_set_review_status_color]] - Sets the color of a review status when displayed in the desktop GUI.
+* [[truxton_set_review_type_color]] - Sets the color of a review type when displayed in the desktop GUI.
+* [[truxton_set_url_type_color]] - Sets the color of a [[URL Types|URL type]] when displayed in the desktop GUI.
 ==Artifacts==
@@ Line 96: / Line 126: @@
 * [[truxton_artifact_create]] - Creates a new artifact object
 * [[truxton_artifact_destroy]] - Destroys an existing artifact object
-* [[truxton_artifact_save]] - Saves the artifact to the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table in the database
 * [[truxton_artifact_get_data_type]] - Retrieves the raw data [[DATA_TYPE|type]]
-* [[truxton_artifact_set_data_type]] - Sets the raw data [[DATA_TYPE|type]]
 * [[truxton_artifact_get_file_id]] - Retrieves the identifier of the file the artifact was found in
-* [[truxton_artifact_set_file_id]] - Sets the identifier of the file the artifact was found in
 * [[truxton_artifact_get_id]] - After saving, retrieves the identifier of the artifact
 * [[truxton_artifact_get_length]] - Retrieves the number of bytes in the raw data that make up this artifact
+* [[truxton_artifact_get_media_id]] - Retrieves the identifier of the media this artifact is in
+* [[truxton_artifact_get_object_id]] - Retrieves the identifier of the object the artifact came from
+* [[truxton_artifact_get_object_type]] - Retrieves the [[Object Types|type]] of object the artifact came from
+* [[truxton_artifact_get_offset]] - Retrieves the offset in the file where the artifact came from
+* [[truxton_artifact_get_type]] - Retrieves the [[Entity Types|type]] of artifact
+* [[truxton_artifact_get_value]] - Retrieves the value of the artifact
+* [[truxton_artifact_save]] - Saves the artifact to the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table in the database
+* [[truxton_artifact_set_data_type]] - Sets the raw data [[DATA_TYPE|type]]
+* [[truxton_artifact_set_file_id]] - Sets the identifier of the file the artifact was found in
 * [[truxton_artifact_set_length]] - Sets the number of bytes in the raw data that make up this artifact
-* [[truxton_artifact_get_media_id]] - Retrieves the identifier of the media this artifact is in
 * [[truxton_artifact_set_media_id]] - Sets the identifier of the media this artifact is in
-* [[truxton_artifact_get_object_id]] - Retrieves the identifier of the object the artifact came from
 * [[truxton_artifact_set_object_id]] - Sets the identifier of the object the artifact came from
-* [[truxton_artifact_get_object_type]] - Retrieves the [[Object Types|type]] of object the artifact came from
 * [[truxton_artifact_set_object_type]] - Sets the [[Object Types|type]] of object the artifact came from
-* [[truxton_artifact_get_offset]] - Retrieves the offset in the file where the artifact came from
 * [[truxton_artifact_set_offset]] - Sets the offset in the file where the artifact came from
-* [[truxton_artifact_get_type]] - Retrieves the [[Entity Types|type]] of artifact
 * [[truxton_artifact_set_type]] - Sets the [[Entity Types|type]] of the artifact
-* [[truxton_artifact_get_value]] - Retrieves the value of the artifact
 * [[truxton_artifact_set_value]] - Sets the value of the artifact
 ===Derived Objects===
 The following APIs are used to create objects with an artifact as their parent.
+* [[truxton_artifact_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_artifact_tag]] - Associating a tag with this artifact. This data will be saved to the <code>[Tagged]</code> table.
 ==Artifact Type==
 This API is used to create custom types of artifacts.
-If one of the [[Event Types|default event types]] don't suite your purpose, you are free to create your own.
+If one of the [[Entity Types|default artifact types]] don't suite your purpose, you are free to create your own.
 * [[truxton_artifact_type_create]] - Creates a new artifact type object
@@ Line 134: / Line 165: @@
 * [[truxton_artifact_type_get_short_name]] - Gets the short human readable name of the artifact type
 * [[truxton_artifact_type_set_short_name]] - Sets the short human readable name of the artifact type
+* [[truxton_delete_artifact_type]] - Deletes an artifact type from Truxton
 ==BOLOs==
@@ Line 191: / Line 223: @@
 ===Derived Objects===
+* [[truxton_child_file_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_child_file_create_artifact]] - Creates and associates an artifact with this file. The artifact will be saved to the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table.
 * [[truxton_child_file_create_child]] - Creates another child file with this child file as its parent.
@@ Line 205: / Line 238: @@
 These are the APIs that deal with humans communicating via email, SMS, chat, etc.
-* [[truxton_communication_create]] -
+* [[truxton_communication_create]] - Creates the communication object
-* [[truxton_communication_add_participant]] -
+* [[truxton_communication_add_participant]] - Adds a participant to the message
-* [[truxton_communication_add_piece]] -
+* [[truxton_communication_add_piece]] - Adds a piece (message body/attachment) to the message
-* [[truxton_communication_destroy]] -
+* [[truxton_communication_destroy]] - Destroys the communication object
-* [[truxton_communication_finished]] -
+* [[truxton_communication_finished]] - Updates the database for this message
-* [[truxton_communication_get_file_id]] -
+* [[truxton_communication_get_file_id]] - Retrieves the identifier of the file this message came from
-* [[truxton_communication_set_file_id]] -
+* [[truxton_communication_set_file_id]] - Sets the identifier of the file this message came from
-* [[truxton_communication_get_id]] -
+* [[truxton_communication_get_id]] - Retrieves the identifier of this message
-* [[truxton_communication_get_media_id]] -
+* [[truxton_communication_get_media_id]] - Retrieves the identifier of the media this message came from
-* [[truxton_communication_set_media_id]] -
+* [[truxton_communication_set_media_id]] - Sets the identifier of the media this message came from
-* [[truxton_communication_get_received]] -
+* [[truxton_communication_get_received]] - Retrieves the time the message was received
-* [[truxton_communication_set_received]] -
+* [[truxton_communication_set_received]] - Sets the time the message was received
-* [[truxton_communication_get_sent]] -
+* [[truxton_communication_get_sent]] - Retrieves the time the message was sent
-* [[truxton_communication_set_sent]] -
+* [[truxton_communication_set_sent]] - Sets the time the message was sent
-* [[truxton_communication_get_subject]] -
+* [[truxton_communication_get_subject]] - Retrieves the subject of the message
-* [[truxton_communication_set_subject]] -
+* [[truxton_communication_set_subject]] - Sets the subject of the message
-* [[truxton_communication_get_type]] -
+* [[truxton_communication_get_type]] - Retrieves the [[Message Types|type]] of message
-* [[truxton_communication_set_type]] -
+* [[truxton_communication_set_type]] - Sets the [[Message Types|type]] of message
-* [[truxton_communication_save]] -
+* [[truxton_communication_save]] - Saves the object to the database
 ===Derived Objects===
-* [[truxton_communication_tag]] -
+* [[truxton_communication_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
+* [[truxton_communication_tag]] - Tags the message. This data will be saved to the <code>[Tagged]</code> table.
+==Enumeration==
+This set of functions allow you to get things out of Truxton.
+* [[truxton_enumeration_create]] - Creates an enumeration
+* [[truxton_enumeration_destroy]] - Destroys the enumeration
+* [[truxton_enumeration_get_current_file]] - Retrieves the parent file of the current enumerated item
+* [[truxton_enumeration_get_current_investigation]] - Retrieves the parent investigation of the current enumerated item
+* [[truxton_enumeration_get_current_media]] - Retrieves the parent media of the current enumerated item
+* [[truxton_enumeration_get_double]] - Retrieves the floating point value at a desired column of a custom enumeration
+* [[truxton_enumeration_get_integer]] - Retrieves the integer value at a desired column of a custom enumeration
+* [[truxton_enumeration_get_next]] - Retrieves the next item in the enumeration
+* [[truxton_enumeration_get_scope]] - Retrieves the scope of the enumeration
+* [[truxton_enumeration_get_scope_id]] - Retrieves the specific item being enumerated
+* [[truxton_enumeration_get_string]] - Retrieves the string at a desired column of a custom enumeration
+* [[truxton_enumeration_get_time]] - Retrieves the time value at a desired column of a custom enumeration
+* [[truxton_enumeration_get_target]] - Retrieves what is being enumerated
+* [[truxton_enumeration_set_query]] - Sets SQL query to use with custom enumeration
+* [[truxton_enumeration_set_scope]] - Sets the scope of the enumeration
+* [[truxton_enumeration_set_scope_id]] - Sets the specific identifier of the scope
+* [[truxton_enumeration_set_target]] - Sets what you want to enumerate
+* [[truxton_enumeration_reset]] - Rewinds the enumeration to the beginning
 ==ETL Application Creation==
+* [[truxton_etl_add_command_line_argument]] - Adds a command line argument
+* [[truxton_etl_add_desired_file_type]] - Tells Truxton what types of files you want to process
 * [[truxton_etl_create]] - Creates a Truxton ETL object
 * [[truxton_etl_destroy]] - Destroys a Truxton ETL object
-* [[truxton_etl_add_command_line_argument]] - Adds a command line argument
-* [[truxton_etl_add_desired_file_type]] - Tells Truxton what types of files you want to process
 * [[truxton_etl_get_application_name]] - Retrieves the name of your application
+* [[truxton_etl_get_description]] - Retrieves the human readable description of this exploitation process
+* [[truxton_get_etl_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the ETL
+* [[truxton_etl_get_message]] - Halts the execution of your program until a message arrives from your message queue
+* [[truxton_etl_get_stage_number]] - Retreives the [[ETL Stages|stage]] of this exploitation process
 * [[truxton_etl_set_application_name]] - Sets the name of your application
 * [[truxton_etl_set_depot_type]] - Sets the type of depot you want to use
 * [[truxton_etl_set_depot_type_name]] - Sets a seed name for the type of depot you want to use
-* [[truxton_etl_get_description]] - Retrieves the human readable description of this exploitation process
 * [[truxton_etl_set_description]] - Sets a description that has meaning to another human about this exploitation process
 * [[truxton_etl_set_expander_identifier]] - Sets an identifier to use during reprocessing
 * [[truxton_etl_set_expander_version]] - Sets a custom version of your process
-* [[truxton_get_etl_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the ETL
-* [[truxton_etl_get_message]] - Halts the execution of your program until a message arrives from your message queue
 * [[truxton_etl_set_mode]] - Sets the mode of the application
 * [[truxton_etl_set_poly_file_expander]] - Tells Truxton you are a file expander that needs multiple source files
 * [[truxton_etl_set_queue_name]] - Sets the name of the message queue for this process
-* [[truxton_etl_get_stage_number]] - Retreives the [[ETL Stages|stage]] of this exploitation process
 * [[truxton_etl_set_stage_number]] - Sets the [[ETL Stages|stage]] at which this exploitation process should run
 * [[truxton_etl_set_thread_safe]] - Tells Truxton if it is safe to use your message handler in a multi-threaded fashion
@@ Line 282: / Line 338: @@
 ===Derived Objects===
 The following APIs are used to create objects with an event as their parent.
+* [[truxton_event_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_event_tag]] - Creates a tag and puts it on this event. This data will be saved to the <code>[Tagged]</code> table.
@@ Line 295: / Line 352: @@
 * [[truxton_event_type_get_name]] - Gets the human readable name of the event type
 * [[truxton_event_type_set_name]] - Sets the human readable name of the event type
+* [[truxton_delete_event_type]] - Deletes an event type from Truxton
 ==EXIF (Camera Information)==
@@ Line 381: / Line 439: @@
 ===Derived Objects===
+* [[truxton_exif_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_exif_tag]] - Creates a tag and puts it on this EXIF object. This data will be saved to the <code>[Tagged]</code> table.
@@ Line 426: / Line 485: @@
 * [[truxton_file_get_signature]] - Gets the first four bytes of the contents as an integer
 * [[truxton_file_get_type]] - Reads the [[File Types Supported|type]] of the file
+* [[truxton_file_path_exists]] - Determines if a file path exists in Truxton
 ===Derived Objects===
 The following APIs are used to create objects with a file as their parent.
+* [[truxton_file_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_file_create_artifact]] - Creates and associates an artifact with this file. The artifact be saved to the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table.
 * [[truxton_file_create_child]] - For creating a file.
@@ Line 439: / Line 500: @@
 * [[truxton_file_open_id]] - Retrieves a particular file specified by the file's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].
 * [[truxton_file_open_md5]] - Retrieves the first file in Truxton whose contents have the given [https://en.wikipedia.org/wiki/MD5 MD5] hash.
+* [[truxton_file_open_path]] - Retrieves a particular file specified by an exact path.
 * [[truxton_file_tag]] - Creates a tag and puts it on this file. This data will be saved to the <code>[Tagged]</code> table.
@@ Line 447: / Line 509: @@
 * [[truxton_file_export_add_criteria]] - Adds a criteria to the export
 * [[truxton_file_export_set_option]] - Sets options for the export
-* [[truxton_file_export_set_truxton]] -
+* [[truxton_file_export_set_truxton]] - Sets the Truxton object for an export
 * [[truxton_file_export_where_clause]] - Retrieves the [https://en.wikipedia.org/wiki/SQL SQL] <code>WHERE</code> clause of the current criteria
 ==File Type==
 * [[truxton_file_type_create]] - Creates a file type object.
-* [[truxton_file_type_destroy]] - Deallocates any resources assigned to the file object.
+* [[truxton_file_type_open_id]] - Opens an existing a file type.
-* [[truxton_file_type_get_id]] - Retrieves the identifier you assigned to this object.
+* [[truxton_file_type_destroy]] - Frees any resources allocated for this file type object.
-* [[truxton_file_type_set_id]] - Sets the unique identifier. This corresponds to the <code>[ID]</code> column of the <code>[FileType]</code> table.
+* [[truxton_file_type_get_id]] - Retrieves the identifier you assigned to this file type.
-* [[truxton_file_type_get_parent_id]] - Retrieves the parent identifier you assigned to this object.
+* [[truxton_file_type_set_id]] - Sets the unique identifier. This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
-* [[truxton_file_type_set_parent_id]] - Sets the more generic type of the file. This corresponds to the <code>[ParentFileTypeID]</code> column of the <code>[FileType]</code> table.
+* [[truxton_file_type_get_parent_id]] - Retrieves the parent identifier you assigned to this file type.
-* [[truxton_file_type_get_short_name]] - Retrieves the short name you assigned to this object.
+* [[truxton_file_type_set_parent_id]] - Sets the more generic type of the file. This corresponds to the <code>[ParentFileTypeID]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
-* [[truxton_file_type_set_short_name]] - Sets the short name to use for this file type. This corresponds to the <code>[ShortName]</code> column of the <code>[FileType]</code> table.
+* [[truxton_file_type_get_short_name]] - Retrieves the short name you assigned to this file type.
-* [[truxton_file_type_get_long_name]] - Retrieves the longer description you assigned to this object.
+* [[truxton_file_type_set_short_name]] - Sets the short name to use for this file type. This corresponds to the <code>[ShortName]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
-* [[truxton_file_type_set_long_name]] - Sets the longer description of the file type. This corresponds to the <code>[LongName]</code> column of the <code>[FileType]</code> table.
+* [[truxton_file_type_get_long_name]] - Retrieves the longer description you assigned to this file type.
+* [[truxton_file_type_set_long_name]] - Sets the longer description of the file type. This corresponds to the <code>[LongName]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
 * [[truxton_file_type_get_extension]] - Retrieves the [https://en.wikipedia.org/wiki/Filename_extension file name extension] you assigned to this object.
-* [[truxton_file_type_set_extension]] - Sets the [https://en.wikipedia.org/wiki/Filename_extension file name extension] for this object.
+* [[truxton_file_type_set_extension]] - Sets the [https://en.wikipedia.org/wiki/Filename_extension file name extension] for this file type.
-* [[truxton_file_type_get_mime_type]] - Retrieves the [https://en.wikipedia.org/wiki/Media_type MIME type] you assigned to this object. This corresponds to the <code>[Extension]</code> column of the <code>[FileType]</code> table.
+* [[truxton_file_type_get_mime_type]] - Retrieves the [https://en.wikipedia.org/wiki/Media_type MIME type] you assigned to this object. This corresponds to the <code>[Extension]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
-* [[truxton_file_type_set_mime_type]] - Sets the [https://en.wikipedia.org/wiki/Media_type MIME type]. This corresponds to the <code>[MIME]</code> column of the <code>[FileType]</code> table.
+* [[truxton_file_type_set_mime_type]] - Sets the [https://en.wikipedia.org/wiki/Media_type MIME type]. This corresponds to the <code>[MIME]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
-* [[truxton_file_type_save]] - This will write the information in the object to the <code>[FileType]</code> table.
+* [[truxton_file_type_save]] - This will write the information in the object to the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
+* [[truxton_file_type_update_average_file_size]] - This will update the <code>[AverageFileSize]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
+* [[truxton_file_type_update_maximum_carve_file_size]] - This will update the <code>[MaximumCarveFileSize]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
+* [[truxton_file_type_update_minimum_carve_file_size]] - This will update the <code>[MinimumCarveFileSize]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
+==Group==
+A group is a collection of things scoped to an investigation and investigator.
+This is the technology behind marking things as Findings.
+* [[truxton_group_create]] - Creates a group
+* [[truxton_group_destroy]] - Destroys the group object
+* [[truxton_group_save]] - Saves the group to the <code>[Group]</code> table in the database
+* [[truxton_group_get_id]] - Gets the group [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
+* [[truxton_group_set_id]] - Sets the group [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
+* [[truxton_group_get_investigation_id]] - Gets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation this group belongs to
+* [[truxton_group_set_investigation_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation this group belongs to
+* [[truxton_group_get_investigator_id]] - Gets the investigator's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
+* [[truxton_group_set_investigator_id]] - Sets the investigator's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
+* [[truxton_group_get_copy_id]] - Gets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the group this group was copied from
+* [[truxton_group_set_copy_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the group this group was copied from
+* [[truxton_group_get_name]] - Gets the name of the group
+* [[truxton_group_set_name]] - Sets the name of the group
+* [[truxton_group_get_description]] - Gets the description of the group
+* [[truxton_group_set_description]] - Sets the description of the group
+* [[truxton_group_get_status]] - Gets the [[Group Status|status]] of the group
+* [[truxton_group_set_status]] - Sets the [[Group Status|status]] of the group
+* [[truxton_group_get_type]] - Gets the [[Group Types|type]] of the group
+* [[truxton_group_set_type]] - Sets the [[Group Types|type]] of the group
+* [[truxton_group_get_created]] - Gets the date time of the group creation in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
+* [[truxton_group_set_created]] - Sets the date time of the group creation in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
+* [[truxton_group_get_is_default]] - Tells you if this group is the default group for the investigation
+* [[truxton_group_set_is_default]] - Sets the group to be the default
+* [[truxton_group_get_is_deleted]] - Tells you if this group is deleted
+* [[truxton_group_set_is_deleted]] - Marks the group as deleted
 ==Investigation==
+* [[truxton_investigation_add_media]] - Adds media to the investigation
+* [[truxton_investigation_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_investigation_create]] - Creates an investigation object
+* [[truxton_investigation_create_group]] - Creates a group associated with this investigation
 * [[truxton_investigation_destroy]] - Destroys an investigation object
+* [[truxton_investigation_get_active_group_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation's active group
+* [[truxton_investigation_get_case_number]] - Retrieves the case number of the investigation
+* [[truxton_investigation_get_description]] - Retrieves the description of the investigation
 * [[truxton_investigation_get_id]] - Retrieves the investigation's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
+* [[truxton_investigation_get_jurisdiction]] - Retrieves the jurisdiction identifier of the investigation
+* [[truxton_investigation_get_name]] - Retrieves the name of the investigation
+* [[truxton_investigation_get_opened]] - Retrieves when the investigation was opened
+* [[truxton_investigation_get_status]] - Retrieves the [[Investigation Statuses|status]] of the investigation
+* [[truxton_investigation_get_truxton]] - Retrieves the parent Truxton handle
+* [[truxton_investigation_get_type]] - Retrieves the [[Investigation Types|type]] of the investigation
+* [[truxton_investigation_initialize_findings]] - Initializes the "My Findings" group for this investigation
+* [[truxton_investigation_open_id]] - Opens an existing investigation
+* [[truxton_investigation_remove_media]] - Removes media from the investigation
+* [[truxton_investigation_save]] - Saves the data in the object to the <code>[Investigation]</code> table
+* [[truxton_investigation_set_active_group_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the group to be the default for the investigation
+* [[truxton_investigation_set_case_number]] - Sets the case number of the investigation
+* [[truxton_investigation_set_description]] - Sets the description of the investigation
 * [[truxton_investigation_set_id]] - Assigns a [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] to the investigation
-* [[truxton_investigation_get_name]] - Retrieves the name of the investigation
+* [[truxton_investigation_set_jurisdiction]] - Sets the jurisdiction identifier of the investigation
 * [[truxton_investigation_set_name]] - Sets the name of the investigation
-* [[truxton_investigation_get_description]] - Retrieves the description of the investigation
+* [[truxton_investigation_set_opened]] - Sets the date and time of when the investigation was opened in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
-* [[truxton_investigation_set_description]] - Sets the description of the investigation
-* [[truxton_investigation_get_case_number]] - Retrieves the case number of the investigation
-* [[truxton_investigation_set_case_number]] - Sets the case number of the investigation
-* [[truxton_investigation_get_status]] - Retrieves the [[Investigation Statuses|status]] of the investigation
 * [[truxton_investigation_set_status]] - Sets the [[Investigation Statuses|status]] of the investigation
-* [[truxton_investigation_get_jurisdiction]] - Retrieves the jurisdiction identifier of the investigation
-* [[truxton_investigation_set_jurisdiction]] - Sets the jurisdiction identifier of the investigation
-* [[truxton_investigation_get_type]] - Retrieves the [[Investigation Types|type]] of the investigation
 * [[truxton_investigation_set_type]] - Sets the [[Investigation Types|type]] of the investigation
-* [[truxton_investigation_save]] - Saves the data in the object to the <code>[Investigation]</code> table
+* [[truxton_delete_investigation_by_name]] - Deletes an investigation given only a name
-* [[truxton_investigation_add_media]] - Adds media to the investigation
-* [[truxton_investigation_remove_media]] - Removes media from the investigation
+==Investigation Event==
+This set of API's allow you to add records to the <code>[InvestigationEvent]</code> table.
+* [[truxton_investigation_event_create]] - Creates an investigation event object
+* [[truxton_investigation_event_destroy]] - Destroys the investigation event object
+* [[truxton_investigation_event_get_id]] - Gets the event [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
+* [[truxton_investigation_event_set_id]] - Sets the event [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
+* [[truxton_investigation_event_get_investigation_id]] - Gets the investigation [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
+* [[truxton_investigation_event_set_investigation_id]] - Sets the investigation [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
+* [[truxton_investigation_event_get_color]] - Retrieves the color assigned to the event
+* [[truxton_investigation_event_set_color]] - Assigns a color to the event
+* [[truxton_investigation_event_get_text]] - Retrieves the text of the event
+* [[truxton_investigation_event_set_text]] - Sets the text of the event
+* [[truxton_investigation_event_get_status]] - Retrieves the [[Investigation Statuses|status]] of the investigation
+* [[truxton_investigation_event_set_status]] - Sets the [[Investigation Statuses|status]] of the investigation
+* [[truxton_investigation_event_get_type]] - Retrieves the [[Investigation Event Types|type]] of the event
+* [[truxton_investigation_event_set_type]] - Sets the [[Investigation Event Types|type]] of the event
+* [[truxton_investigation_event_get_when]] - Retrieves when the event took place in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
+* [[truxton_investigation_event_set_when]] - Sets when the event took place in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
+* [[truxton_investigation_event_save]] - Saves the investigation event object to the database
 ==Jurisdiction==
 Jurisdictions is a way to keep track of work done on behalf of others.
-Say you're a regional forensics lab and your boss asks you, "How much work did we do for Mayberry last quarter?"
+Say you're a regional forensics lab and your boss asks you, "How much work did we do for [https://en.wikipedia.org/wiki/Mayberry Mayberry] last quarter?"
 * [[truxton_jurisdiction_create]] - This will create a new jurisdiction object
@@ Line 526: / Line 653: @@
 ===Derived Objects===
 The following APIs are used to create objects with a location as their parent.
+* [[truxton_location_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_location_tag]] - Associating a tag with this media. This data will be saved to the <code>[Tagged]</code> table.
 ==Media==
-These are the API's that allow you to add to the Media table in the database.
+These are the API's that allow you to add to the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table in the database.
 * [[truxton_media_create]] - Creates a new media object
+* [[truxton_media_open_by_name]] - Opens an existing media in the database given the media's name.
 * [[truxton_media_open_id]] - Opens an existing media in the database given the media's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].
 * [[truxton_media_destroy]] - Frees any resources allocated to this object
@@ Line 565: / Line 694: @@
 * [[truxton_media_get_longitude]] - Retrieves the [https://en.wikipedia.org/wiki/Longitude longitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of where the media was seized.
 * [[truxton_media_set_longitude]] - Sets the [https://en.wikipedia.org/wiki/Longitude longitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of where the media was seized.
-* [[truxton_media_get_generated_files_folder_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the Generated Files folder in the media
+* [[truxton_media_get_generated_files_folder_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the "Generated Files" folder in the media
 * [[truxton_media_get_root_file_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the top level file in the media
 * [[truxton_media_save]] - Saves the media information to the database
+* [[truxton_delete_media_by_name]] - Deletes a piece of media given only a name
+* [[truxton_media_set_calculated_size]] - Calculates the size of the media and updates the database
 ===Derived Objects===
 The following APIs are used to create objects with a media as their parent.
 * [[truxton_media_add_child]] - Created a child file object belonging to this media.
+* [[truxton_media_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_media_tag]] - Associating a tag with this media. This data will be saved to the <code>[Tagged]</code> table.
 ===Maintenance Functions===
-* [[truxton_media_update_cache_file_counts]] -
+* [[truxton_media_update_cache_file_counts]] - This will count the files in the different groups and cache them
-* [[truxton_media_update_child_count]] -
+* [[truxton_media_update_child_count]] - This method updates the <code>[NumberOfChildren]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> for this media
-* [[truxton_media_update_paths]] -
+* [[truxton_media_update_paths]] - This method updates the <code>[FullPathID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> for this media
 ==Message==
@@ Line 620: / Line 752: @@
 ==Message Addresses==
-* [[truxton_message_address_create]] -
+* [[truxton_message_address_create]] - Creates a message address
-* [[truxton_message_address_destroy]] -
+* [[truxton_message_address_destroy]] - Frees a message address
-* [[truxton_message_address_save]] -
+* [[truxton_message_address_save]] - Saves the message address to the <code>[MessageAddress]</code> table
-* [[truxton_message_address_get_id]] -
+* [[truxton_message_address_get_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the message address
-* [[truxton_message_address_get_combined_id]] -
+* [[truxton_message_address_get_combined_id]] - Retrieves the combined identifier for the account and server
-* [[truxton_message_address_get_combined_guid]] -
+* [[truxton_message_address_get_combined_guid]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the combined identifier for the address
-* [[truxton_message_address_get_account]] -
+* [[truxton_message_address_get_account]] - Retrieves the account part of the address
-* [[truxton_message_address_set_account]] -
+* [[truxton_message_address_set_account]] - Sets the account part of the address
-* [[truxton_message_address_get_server]] -
+* [[truxton_message_address_get_server]] - Retrieves the server part of the address
-* [[truxton_message_address_set_server]] -
+* [[truxton_message_address_set_server]] - Sets the server part of the address
-* [[truxton_message_address_get_name]] -
+* [[truxton_message_address_get_name]] - Retrieves the name associated with the address
-* [[truxton_message_address_set_name]] -
+* [[truxton_message_address_set_name]] - Sets the name to associate with the address
+==Message Participant==
+This is basically a useless API.
+It is used internally during the enumeration of the participants of a communication.
+* [[truxton_message_participant_create]] - Creates a participant in a message
+* [[truxton_message_participant_destroy]] - Frees the participant object
+* [[truxton_message_participant_get_id]] - Retrieves he globally unique identifier of the participant
+* [[truxton_message_participant_set_id]] - Sets the globally unique identifier of the participant
+* [[truxton_message_participant_get_combined_id]] - Retrieves the combined id of the message address
+* [[truxton_message_participant_get_combined_guid]] - Retrieves the combined identifier as a globally unique identifier
+* [[truxton_message_participant_get_account]] - Retrieves the account portion of the message address
+* [[truxton_message_participant_set_account]] - Sets the account portion of the message address
+* [[truxton_message_participant_get_file_id]] - Retrieves the globally unique identifier of the file containing this participant
+* [[truxton_message_participant_set_file_id]] - Sets the globally unique identifier of the file containing this participant
+* [[truxton_message_participant_get_media_id]] - Retrieves the globally unique identifier of the media containing this participant
+* [[truxton_message_participant_set_media_id]] - Sets the globally unique identifier of the media containing this participant
+* [[truxton_message_participant_get_message_address_id]] - Retrieved the globally unique identifier of the message address
+* [[truxton_message_participant_set_message_address_id]] - Sets the globally unique identifier of the message address
+* [[truxton_message_participant_get_message_id]] - Retrieves the globally unique identifier for the participant
+* [[truxton_message_participant_set_message_id]] - Sets the globally unique identifier for the participant
+* [[truxton_message_participant_get_server]] - Retrieves the server portion of the participant address
+* [[truxton_message_participant_set_server]] - Sets the server portion of the participant address
+* [[truxton_message_participant_get_name]] - Retrieves the name portion of the participant address
+* [[truxton_message_participant_set_name]] - Sets the name portion of the participant address
+* [[truxton_message_participant_get_type]] - Gets the [[Message Participants|role]] this participant took in the message
+* [[truxton_message_participant_set_type]] - Sets the [[Message Participants|role]] this participant took in the message
 ==Options==
@@ Line 643: / Line 802: @@
 * [[truxton_option_get_integer|truxton_options_get_integer]] - Reads a named integer value
 * [[truxton_option_get_string|truxton_options_get_string]] - Reads a named string value
+==Note==
+This set of API's allow you to add records to the <code>[InvestigatorNote]</code> table.
+* [[truxton_note_create]] - Creates a note
+* [[truxton_note_destroy]] - Frees a note
+* [[truxton_note_get_investigation_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation that this note belongs
+* [[truxton_note_set_investigation_id]] - Sets the investigation [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the note
+* [[truxton_note_get_object_id]] - Retrieves the identifier of the object that has the attached note
+* [[truxton_note_set_object_id]] - Sets the identifier of the object to attach the note to
+* [[truxton_note_get_object_type]] - Retrieves the [[Object Types|type]] of the object id
+* [[truxton_note_set_object_type]] - Sets the [[Object Types|type]] of the object id
+* [[truxton_note_get_text]] - Retrieves the contents of the investigator's note
+* [[truxton_note_set_text]] - Sets the contents of the investigator's note
+* [[truxton_note_save]] - Saves the note to the <code>[InvestigatorNote]</code> table in the database
 ==Relation==
 These functions let you add to the <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> table in Truxton.
 This is how to establish some sort of [[Relation Types|relationship]] between items in Truxton to create a [https://en.wikipedia.org/wiki/Graph_(discrete_mathematics) graph.]
-Relations in Truxton adhere to the form of "A is a [[Relation Types|XXX]] of B"
+Relations in Truxton adhere to the form of "A is a [[Relation Types|thing]] of B"
 Truxton is not focused on exploring graphs ([https://en.wikipedia.org/wiki/Clique_(graph_theory) cliques] anyone?) but needed a way to establish simple relationships between objects.
@@ Line 705: / Line 879: @@
 * [[truxton_subject_set_birthday]] - Sets the birthday of the subject in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 * [[truxton_subject_save]] - Will commit the information in the subject object to the <code>[Suspect]</code> table.
+* [[truxton_delete_subject]] - Deletes a subject from the system
 ===Derived Objects===
 The following APIs are used to create objects with a subject as their parent.
+* [[truxton_subject_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_subject_tag]] - Associating a tag with this subject. This data will be saved to the <code>[Tagged]</code> table.
+==Types==
+Truxton has many different [[Developer's_Guide#Data_Types|types]] in it.
+They are generally integer values that have meanings.
+Here's how to get a list of them.
+* [[truxton_get_content_status_names]] - Retrieves mappings from the <code>[ContentStatus]</code> table
+* [[truxton_get_data_type_names]] - Retrieves mappings from the <code>[DataType]</code> table
+* [[truxton_get_depot_status_names]] - Retrieves mappings from the <code>[DepotStatus]</code> table
+* [[truxton_get_depot_type_names]] - Retrieves mappings from the <code>[DepotType]</code> table
+* [[truxton_get_entity_type_names]] - Retrieves mappings from the <code>[EntityType]</code> table
+* [[truxton_get_event_type_names]] - Retrieves mappings from the <code>[EventType]</code> table
+* [[truxton_get_file_type_names]] - Retrieves mappings from the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code>  table
+* [[truxton_get_file_type_mime_types]] - Retrieves mappings from the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code>  table
+* [[truxton_get_group_entry_type_names]] - Retrieves mappings from the <code>[GroupEntryType]</code> table
+* [[truxton_get_group_status_names]] - Retrieves mappings from the <code>[GroupStatus]</code> table
+* [[truxton_get_group_type_names]] - Retrieves mappings from the the <code>[GroupType]</code> table
+* [[truxton_get_investigation_status_names]] - Retrieves mappings from the <code>[InvestigationStatus]</code> table
+* [[truxton_get_investigation_type_names]] - Retrieves mappings from the <code>[InvestigationType]</code> table
+* [[truxton_get_location_type_names]] - Retrieves mappings from the <code>[LocationType]</code> table
+* [[truxton_get_media_status_names]] - Retrieves mappings from the <code>[MediaStatus]</code> table
+* [[truxton_get_media_type_names]] - Retrieves mappings from the <code>[MediaType]</code> table
+* [[truxton_get_message_address_type_names]] - Retrieves mappings from the <code>[MessageAddressType]</code> table
+* [[truxton_get_message_type_names]] - Retrieves mappings from the <code>[MessageType]</code> table
+* [[truxton_get_object_type_names]] - Retrieves mappings from the <code>[ObjectType]</code> table
+* [[truxton_get_origin_names]] - Retrieves mappings from the <code>[Origin]</code> table
+* [[truxton_get_relation_type_names]] - Retrieves mappings from the <code>[RelationType]</code> table
+* [[truxton_get_url_type_names]] - Retrieves mappings from the <code>[URLType]</code> table
+* [[truxton_get_website_method_names]] - Retrieves mappings from the <code>[WebsiteMethod]</code> table
 ==URL==
@@ Line 741: / Line 946: @@
 ===Derived Objects===
 The following APIs are used to create objects with an event as their parent.
+* [[truxton_url_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_url_tag]] - Creates a tag and puts it on this location. This data will be saved to the <code>[Tagged]</code> table.
@@ Line 768: / Line 974: @@
 ===Derived Objects===
+* [[truxton_usb_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 * [[truxton_usb_tag]] - Associate a tag with this USB device. This data will be saved to the <code>[Tagged]</code> table.
+==Debugging==
+* [[truxton_dump_black_box]] - Dumps the [[Black Box|black box]] of the given process id
+* [[truxton_set_black_box_activity]] - Sets the activity taking place at a location in the [[Black Box|black box]]
+* [[truxton_set_black_box_source_code_location]] - Sets a location in the [[Black Box|black box]]
+* [[truxton_set_black_box_thread_type]] - Sets type of the thread in the [[Black Box|black box]]
+* [[truxton_set_black_box_value]] - Sets a debugging value in the [[Black Box|black box]]
 =Samples=

Difference between revisions of "Truxton C API"

Latest revision as of 06:21, 20 February 2026

Contents

Philosophy

Preparing for Use

Generating a Linker Library for Microsoft Compilers

API Groups

Initialization

Functions

Maintenance

Hash Sets

Database Identification

File Identification

Triage Loads

GUI Colors

Artifacts

Derived Objects

Artifact Type

BOLOs

Child Files

Derived Objects

Communications

Derived Objects

Enumeration

ETL Application Creation

Debugging

Event

Derived Objects

Event Type

EXIF (Camera Information)

Persisted in Database

Not in Database

Derived Objects

File

File Actions

File IO

File Record Fields

Derived Objects

File Export

File Type

Group

Investigation

Investigation Event

Jurisdiction

Geographic Location

Derived Objects

Media

Derived Objects

Maintenance Functions

Message

Derived Objects

Message Addresses

Message Participant

Options

Note

Relation

Sensitive Site List

Subject

Derived Objects

Types

URL

Derived Objects

USB Device

Derived Objects

Debugging

Samples

Navigation menu

Search