Difference between revisions of "Truxton C API"

From truxwiki.com
Jump to navigation Jump to search
 
(296 intermediate revisions by the same user not shown)
Line 3: Line 3:
  
 
=Philosophy=
 
=Philosophy=
−
 
+
The API is considered to be "flat" in that only integers and ASCII character strings are used in the interface.
−
The API is considered to be "flat" in that only sixty-four bit integers and ASCII character strings are used in the interface.
+
This was chosen to make it easy for other languages to call the API.
−
This was chosen to make it easy for other languages to interface to.
 
 
The coding convention is all lower case names with underscores separating words.
 
The coding convention is all lower case names with underscores separating words.
 
Truxton is a member of the [https://www.youtube.com/watch?v=fv--IKZFVO8 east const posse.]
 
Truxton is a member of the [https://www.youtube.com/watch?v=fv--IKZFVO8 east const posse.]
 +
 +
=Preparing for Use=
 +
Truxton does not ship a linker library for <code>TruxtonCAPI.dll</code> in order to free the developer to use any particular compiler.
 +
If you want to link <code>TruxtonCAPI.dll</code> with your own C/C++ code, you will need to generate a linker library.
 +
 +
Alternatively, you can use a [https://docs.microsoft.com/en-us/windows/win32/dlls/using-run-time-dynamic-linking plugin pattern] of calling <code>[https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibrarya LoadLibrary]</code> followed by many calls to <code>[https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getprocaddress GetProcAddress]</code> to get the function pointers.
 +
This is a lot of work and very prone to errors.
 +
 +
==Generating a Linker Library for Microsoft Compilers==
 +
You can download a free [https://visualstudio.microsoft.com/downloads/ Visual Studio] from Microsoft.
 +
The steps to produce a LIB file from a DLL are:
 +
# Generate a module definition ([https://docs.microsoft.com/en-us/cpp/build/reference/module-definition-dot-def-files?view=msvc-160 DEF]) file from <code>TruxtonCAPI.dll</code>.
 +
# Use the DEF file to create the linker library (LIB) file.
 +
 +
The following [https://docs.microsoft.com/en-us/powershell/ Powershell] script will create the lib file for you.
 +
<source lang="Powershell">
 +
$msvc = "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x64\"
 +
$dumpbin = $msvc + "dumpbin.exe"
 +
$lib = $msvc + "lib.exe"
 +
 +
$lines = (& $dumpbin /exports "C:\Program Files\Truxton\SDK\TruxtonCAPI.dll")
 +
 +
Add-Content TruxtonCAPI.def "EXPORTS"
 +
 +
foreach ( $line in $lines )
 +
{
 +
  if ( $line.Contains(" = ") -EQ $true )
 +
  {
 +
      Add-Content TruxtonCAPI.def $line.SubString($line.IndexOf(" = ") + 3)
 +
  }
 +
}
 +
 +
(& $lib /def:TruxtonCAPI.def /out:TruxtonCAPI.lib /machine:x64)
 +
 +
Remove-Item TruxtonCAPI.def, TruxtonCAPI.exp
 +
</source>
 +
 +
In your project folder, execute the script from Powershell to create <code>TruxtonCAPI.lib</code>:
 +
<source lang="text">
 +
.\MakeDef.ps1
 +
</source>
  
 
=API Groups=
 
=API Groups=
Line 16: Line 56:
 
* [[truxton_stop]] - Uninitializes Truxton
 
* [[truxton_stop]] - Uninitializes Truxton
  
−
==ETL Functions==
+
==Functions==
−
 
+
* [[truxton_carve_file]] - Sends a file to the carver
 
* [[truxton_create]] - Creates a Truxton object
 
* [[truxton_create]] - Creates a Truxton object
 +
* [[truxton_create_tag]] - Create a new type of tag
 +
* [[truxton_delete_tag]] - Removes a tag from the system
 
* [[truxton_destroy]] - Frees a Truxton object
 
* [[truxton_destroy]] - Frees a Truxton object
−
* [[truxton_get_device_id]] - Retrieves the Device identifier
+
* [[truxton_disable_route_update]] - Disables route updating when a [[Poly|poly file expander]] ETL is initializing.
−
* [[truxton_get_etl_id]] - Retrieves the identifier for this ETL process
+
* [[truxton_enable_route_update]] - Enables route updating when a [[Poly|poly file expander]] ETL is initializing.
−
* [[truxton_get_machine_id]] - Retrieves the machine identifier
+
* [[truxton_get_database_connection_string]] - Retrieves the connection string for accessing the Truxton database directly
 +
* [[truxton_get_device_id]] - Retrieves the [https://en.wikipedia.org/wiki/BIOS BIOS] Device identifier
 +
* [[truxton_get_etl_id]] - Retrieves the unique identifier for this ETL instance
 +
* [[truxton_get_machine_id]] - Retrieves the Windows Machine identifier
 +
* [[truxton_get_media_investigation]] - Retrieves the investigation identifier for a given piece of media
 
* [[truxton_get_version]] - Retrieves the version of Truxton
 
* [[truxton_get_version]] - Retrieves the version of Truxton
 +
* [[truxton_parse_time]] - Parses a string was a date time value
 +
* [[truxton_route_message]] - Send a message to down-stream ETL processors
 
* [[truxton_start_adding_files]] - Prepares Truxton to add files to the database
 
* [[truxton_start_adding_files]] - Prepares Truxton to add files to the database
 +
* [[truxton_tag_hash]] - Tags files based on their [https://en.wikipedia.org/wiki/MD5 MD5] hash
 +
* [[truxton_time_now]] - Returns the current time in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_update_investigation_type]] - Change the [[Investigation Types|type]] of an existing investigation
 +
* [[truxton_update_media_primary_photo_by_hash]] - Set the primary photograph of an existing piece of media
 +
* [[truxton_update_media_type]] - Change the [[Media Types|type]] of an existing media
 +
 +
===Maintenance===
 +
These functions are used to perform periodic maintenance tasks in Truxton.
 +
These will send messages to the <code>maintenance</code> ETL which will carry out the tasks.
 +
 +
* [[truxton_clean_database]] - Will delete orphaned records from the database
 +
* [[truxton_consolidate_depots]] - This will start the length process of combining small depots into larger ones
 +
* [[truxton_delete_depots]] - This will delete depots that have been marked <code>ToBeDeleted</code>
 +
* [[truxton_delete_media]] - This will delete a piece of media from Truxton
 +
* [[truxton_optimize_database]] - This will update the query statistics in the Truxton database
 +
* [[truxton_reindex_media]] - This will resend all files in a piece of media for content indexing
 +
 +
===Hash Sets===
 +
These functions handle the creation of [[Hash Set|hash set]] files
 +
* [[truxton_create_everything_hashset]] - This will create a [[Hash Set|hash set]] file from every unique hash value in Truxton
 +
* [[truxton_create_investigation_hashset]] - This will create a [[Hash Set|hash set]] file from every unique hash value in an investigation
 +
* [[truxton_create_media_hashset]] - This will create a [[Hash Set|hash set]] file from every unique hash value in a piece of media
 +
 +
===Database Identification===
 +
* [[truxton_add_database_id]] - Associates a table name with a file type for more accurately [[Identifying Databases|identifying databases]]
 +
* [[truxton_remove_database_id]] - Removes a table name to file type mapping
 +
 +
===File Identification===
 +
* [[truxton_get_details]] - Retrieves [[Type_File_Details|details]] about a file
 +
* [[truxton_get_details_size]] - Returns the size of the buffer required to hold [[Type_File_Details|details]] of a file
 +
* [[truxton_identify_bytes]] - Will return the [[File_Types_Supported|type]] of the file in the given buffer
 +
 +
===Triage Loads===
 +
* [[truxton_add_triage_file]] - Adds a record to the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table to have a file or folder included in a [[Triage]] load
 +
* [[truxton_remove_triage_file]] - Removes a record from the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table
 +
 +
===GUI Colors===
 +
* [[truxton_set_artifact_type_color]] - Sets the color of an [[Entity Types|artifact]] when displayed in the desktop GUI.
 +
* [[truxton_set_event_type_color]] - Sets the color of an [[Event Types|event]] when displayed in the desktop GUI.
 +
* [[truxton_set_file_type_color]] - Sets the color of an [[File Types Supported|file type]] when displayed in the desktop GUI.
 +
* [[truxton_set_investigation_status_color]] - Sets the color of an [[Investigation Statuses|investigation status]] when displayed in the desktop GUI.
 +
* [[truxton_set_investigation_type_color]] - Sets the color of an [[Investigation_Types|investigation type]] when displayed in the desktop GUI.
 +
* [[truxton_set_location_type_color]] - Sets the color of an [[Location Types|location type]] when displayed in the desktop GUI.
 +
* [[truxton_set_message_type_color]] - Sets the color of a [[Message Types|message type]] when displayed in the desktop GUI.
 +
* [[truxton_set_review_status_color]] - Sets the color of a review status when displayed in the desktop GUI.
 +
* [[truxton_set_review_type_color]] - Sets the color of a review type when displayed in the desktop GUI.
 +
* [[truxton_set_url_type_color]] - Sets the color of a [[URL Types|URL type]] when displayed in the desktop GUI.
 +
 +
==Artifacts==
 +
Artifacts are pieces of information that are also known as entities.
 +
 +
* [[truxton_artifact_create]] - Creates a new artifact object
 +
* [[truxton_artifact_destroy]] - Destroys an existing artifact object
 +
* [[truxton_artifact_get_data_type]] - Retrieves the raw data [[DATA_TYPE|type]]
 +
* [[truxton_artifact_get_file_id]] - Retrieves the identifier of the file the artifact was found in
 +
* [[truxton_artifact_get_id]] - After saving, retrieves the identifier of the artifact
 +
* [[truxton_artifact_get_length]] - Retrieves the number of bytes in the raw data that make up this artifact
 +
* [[truxton_artifact_get_media_id]] - Retrieves the identifier of the media this artifact is in
 +
* [[truxton_artifact_get_object_id]] - Retrieves the identifier of the object the artifact came from
 +
* [[truxton_artifact_get_object_type]] - Retrieves the [[Object Types|type]] of object the artifact came from
 +
* [[truxton_artifact_get_offset]] - Retrieves the offset in the file where the artifact came from
 +
* [[truxton_artifact_get_type]] - Retrieves the [[Entity Types|type]] of artifact
 +
* [[truxton_artifact_get_value]] - Retrieves the value of the artifact
 +
* [[truxton_artifact_save]] - Saves the artifact to the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table in the database
 +
* [[truxton_artifact_set_data_type]] - Sets the raw data [[DATA_TYPE|type]]
 +
* [[truxton_artifact_set_file_id]] - Sets the identifier of the file the artifact was found in
 +
* [[truxton_artifact_set_length]] - Sets the number of bytes in the raw data that make up this artifact
 +
* [[truxton_artifact_set_media_id]] - Sets the identifier of the media this artifact is in
 +
* [[truxton_artifact_set_object_id]] - Sets the identifier of the object the artifact came from
 +
* [[truxton_artifact_set_object_type]] - Sets the [[Object Types|type]] of object the artifact came from
 +
* [[truxton_artifact_set_offset]] - Sets the offset in the file where the artifact came from
 +
* [[truxton_artifact_set_type]] - Sets the [[Entity Types|type]] of the artifact
 +
* [[truxton_artifact_set_value]] - Sets the value of the artifact
 +
 +
===Derived Objects===
 +
The following APIs are used to create objects with an artifact as their parent.
 +
* [[truxton_artifact_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 +
* [[truxton_artifact_tag]] - Associating a tag with this artifact. This data will be saved to the <code>[Tagged]</code> table.
 +
 +
==Artifact Type==
 +
This API is used to create custom types of artifacts.
 +
If one of the [[Entity Types|default artifact types]] don't suite your purpose, you are free to create your own.
 +
 +
* [[truxton_artifact_type_create]] - Creates a new artifact type object
 +
* [[truxton_artifact_type_destroy]] - Destroys an existing artifact type object
 +
* [[truxton_artifact_type_save]] - Saves the data in this object to the <code>[EntityType]</code> table
 +
* [[truxton_artifact_type_get_id]] - Retrieves the integer value for the type
 +
* [[truxton_artifact_type_set_id]] - Sets the integer value of the type
 +
* [[truxton_artifact_type_get_long_name]] - Gets the long human readable name of the artifact type
 +
* [[truxton_artifact_type_set_long_name]] - Sets the long human readable name of the artifact type
 +
* [[truxton_artifact_type_get_short_name]] - Gets the short human readable name of the artifact type
 +
* [[truxton_artifact_type_set_short_name]] - Sets the short human readable name of the artifact type
 +
* [[truxton_delete_artifact_type]] - Deletes an artifact type from Truxton
 +
 +
==BOLOs==
 +
These are the APIs used to create a [https://en.wikipedia.org/wiki/All-points_bulletin be-on-the-lookout] alert criteria.
 +
 +
* [[truxton_bolo_create]] - Creates a new BOLO object
 +
* [[truxton_bolo_destroy]] - Destroys a BOLO object
 +
* [[truxton_bolo_get_id]] - Retrieves the identifier of this object
 +
* [[truxton_bolo_set_id]] - Sets the identifier of this object
 +
* [[truxton_bolo_get_criteria]] - Retrieves the criteria of this object
 +
* [[truxton_bolo_set_criteria]] - Sets the criteria for this BOLO
 +
* [[truxton_bolo_save]] - Saves the BOLO to the database
  
 
==Child Files==
 
==Child Files==
Line 45: Line 197:
 
* [[truxton_child_file_get_number_of_children]] - Retrieves the number of child files of this file
 
* [[truxton_child_file_get_number_of_children]] - Retrieves the number of child files of this file
 
* [[truxton_child_file_set_number_of_children]] - Sets the number of child files of this file
 
* [[truxton_child_file_set_number_of_children]] - Sets the number of child files of this file
−
* [[truxton_child_file_get_created]] - Retrieves the date and time of when the file was created
+
* [[truxton_child_file_get_created]] - Retrieves the date and time of when the file was created in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
* [[truxton_child_file_set_created]] - Sets the date and time of when the file was created
+
* [[truxton_child_file_set_created]] - Sets the date and time of when the file was created in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
* [[truxton_child_file_get_accessed]] - Retrieves the date and time of when the file was accessed
+
* [[truxton_child_file_get_accessed]] - Retrieves the date and time of when the file was accessed in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
* [[truxton_child_file_set_accessed]] - Sets the date and time of when the file was accessed
+
* [[truxton_child_file_set_accessed]] - Sets the date and time of when the file was accessed in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
* [[truxton_child_file_get_modified]] - Retrieves the date and time of when the file was modified (last written to)
+
* [[truxton_child_file_get_modified]] - Retrieves the date and time of when the file was modified (last written to) in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
* [[truxton_child_file_set_modified]] - Sets the date and time of when the file was modified (last written to)
+
* [[truxton_child_file_set_modified]] - Sets the date and time of when the file was modified (last written to) in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 
* [[truxton_child_file_get_size]] - Retrieves the size of the file, in bytes, as reported by the operating system
 
* [[truxton_child_file_get_size]] - Retrieves the size of the file, in bytes, as reported by the operating system
 
* [[truxton_child_file_set_size]] - Sets the size of the file, in bytes, as reported by the operating system
 
* [[truxton_child_file_set_size]] - Sets the size of the file, in bytes, as reported by the operating system
 
* [[truxton_child_file_get_origin]] - Retrieves the [[Origin | origin]] of the file
 
* [[truxton_child_file_get_origin]] - Retrieves the [[Origin | origin]] of the file
 
* [[truxton_child_file_set_origin]] - Sets the [[Origin | origin]] of the file
 
* [[truxton_child_file_set_origin]] - Sets the [[Origin | origin]] of the file
−
* [[truxton_child_file_get_content_status]] - Retrieves the [[Content Status | status]] of the contents of the file
+
* [[truxton_child_file_get_content_status]] - Retrieves the [[Content Status|status]] of the contents of the file
−
* [[truxton_child_file_set_content_status]] - Sets the [[Content Status | status]] of the contents of the file
+
* [[truxton_child_file_set_content_status]] - Sets the [[Content Status|status]] of the contents of the file
 
* [[truxton_child_file_get_truxton]] - Retrieves the instance of Truxton this child belongs to
 
* [[truxton_child_file_get_truxton]] - Retrieves the instance of Truxton this child belongs to
 
* [[truxton_child_file_begin_write]] - Prepares Truxton for writing contents to be associated with this file
 
* [[truxton_child_file_begin_write]] - Prepares Truxton for writing contents to be associated with this file
Line 62: Line 214:
 
* [[truxton_child_file_write]] - Gives Truxton bytes to store as the file contents
 
* [[truxton_child_file_write]] - Gives Truxton bytes to store as the file contents
 
* [[truxton_child_file_save]] - Commits data to the database
 
* [[truxton_child_file_save]] - Commits data to the database
−
* [[truxton_child_file_set_type]] - Sets the [[File Types Supported | type]] of the file
+
* [[truxton_child_file_get_type]] - Retrieves the [[File Types Supported|type]] of the file
−
* [[truxton_child_file_get_type]] - Retrieves the [[File Types Supported | type]] of the file
+
* [[truxton_child_file_set_type]] - Sets the [[File Types Supported|type]] of the file
 +
* [[truxton_child_file_get_attributes]] - Retrieves the attributes of the file
 
* [[truxton_child_file_set_attributes]] - Sets the attributes of the file
 
* [[truxton_child_file_set_attributes]] - Sets the attributes of the file
−
* [[truxton_child_file_get_attributes]] - Retrieves the attributes of the file
+
* [[truxton_child_file_get_disk_offset]] - Retrieves the physical disk offset of the first byte of contents
 
* [[truxton_child_file_set_disk_offset]] - Sets the physical disk offset of the first byte of contents
 
* [[truxton_child_file_set_disk_offset]] - Sets the physical disk offset of the first byte of contents
−
* [[truxton_child_file_get_disk_offset]] - Retrieves the physical disk offset of the first byte of contents
 
 
* [[truxton_child_file_get_entropy]] - Retrieves the [https://en.wikipedia.org/wiki/Entropy_(information_theory) entropy] of the file contents
 
* [[truxton_child_file_get_entropy]] - Retrieves the [https://en.wikipedia.org/wiki/Entropy_(information_theory) entropy] of the file contents
  
−
==File IO==
+
===Derived Objects===
−
* [[truxton_file_open_id( uint64_t truxton_handle, const char * guid );
+
* [[truxton_child_file_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
−
* [[truxton_file_open_md5( uint64_t truxton_handle, const char * guid );
+
* [[truxton_child_file_create_artifact]] - Creates and associates an artifact with this file. The artifact will be saved to the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table.
−
* [[truxton_file_close( uint64_t file_handle );
+
* [[truxton_child_file_create_child]] - Creates another child file with this child file as its parent.
−
* [[truxton_file_free( uint64_t file_handle );
+
* [[truxton_child_file_create_event]] - Creates and associates an event with this file. The event will be saved to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
−
* [[truxton_file_tell( uint64_t file_handle );
+
* [[truxton_child_file_create_exif]] - Creates and associates camera information with this file. The data will be saved to the <code><nowiki>[</nowiki>[[EXIF Table|EXIF]]<nowiki>]</nowiki></code> table.
−
* [[truxton_file_length( uint64_t file_handle );
+
* [[truxton_child_file_create_location]] - Creates and associates a geographic location with this file. The data will be saved to the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.
−
* [[truxton_file_is_closed( uint64_t file_handle );
+
* [[truxton_child_file_create_relation]] - Creates a relationship with this file as the source. The data will be saved to the <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> table.
−
* [[truxton_file_seek( uint64_t file_handle, int64_t distance, int origin );
+
* [[truxton_child_file_create_url]] - Creates a website visit with this file as the source. This data will be saved to the <code><nowiki>[</nowiki>[[WebsiteVisit Table|WebsiteVisit]]<nowiki>]</nowiki></code> table.
−
* [[truxton_file_readline( uint64_t file_handle, uint8_t * buffer, size_t buffer_size, int64_t limit );
+
* [[truxton_child_file_create_usb]] - Creates a USB device with this file as the source. This data will be saved to the<code><nowiki>[</nowiki>[[USBDevice Table|Entity]]<nowiki>]</nowiki></code> table.
−
* [[truxton_file_read( uint64_t file_handle, uint8_t * buffer, size_t buffer_size );
+
* [[truxton_child_file_new_child]] - Creates a child of this file.
 +
* [[truxton_child_file_tag]] - Creates a tag and puts it on this file. This data will be saved to the <code>[Tagged]</code> table.
  
−
==File Record Fields==
+
==Communications==
−
* [[truxton_file_get_id( uint64_t file_handle, char * destination_string, size_t max_size);
+
These are the APIs that deal with humans communicating via email, SMS, chat, etc.
−
* [[truxton_file_get_media_id( uint64_t file_handle, char * destination_string, size_t max_size);
 
−
* [[truxton_file_get_parent_id( uint64_t file_handle, char * destination_string, size_t max_size);
 
−
* [[truxton_file_get_number_of_children( uint64_t file_handle );
 
−
* [[truxton_file_get_is_resident]]
 
−
* [[truxton_file_get_created]]
 
−
* [[truxton_file_get_accessed]]
 
−
* [[truxton_file_get_modified]]
 
−
* [[truxton_file_get_name]]
 
−
* [[truxton_file_get_attributes]]
 
−
* [[truxton_file_get_size]]
 
−
* [[truxton_file_get_origin]]
 
−
* [[truxton_file_get_content_status]]
 
−
* [[truxton_file_get_type]]
 
−
* [[truxton_file_get_hash]]
 
−
* [[truxton_file_get_entropy]]
 
−
* [[truxton_file_get_disk_offset]]
 
−
* [[truxton_file_get_is_eliminated]]
 
−
* [[truxton_file_get_depot_name]]
 
−
* [[truxton_file_get_depot_offset]]
 
−
* [[truxton_file_get_depot_length]]
 
−
* [[truxton_file_create_child]]
 
−
* [[truxton_file_get_details]]
 
−
* [[truxton_file_get_truxton]]
 
  
−
==Meta Data from File==
+
* [[truxton_communication_create]] - Creates the communication object
−
* [[truxton_file_create_artifact]]
+
* [[truxton_communication_add_participant]] - Adds a participant to the message
−
* [[truxton_file_create_event]]
+
* [[truxton_communication_add_piece]] - Adds a piece (message body/attachment) to the message
−
* [[truxton_file_create_exif]]
+
* [[truxton_communication_destroy]] - Destroys the communication object
−
* [[truxton_file_create_location]]
+
* [[truxton_communication_finished]] - Updates the database for this message
−
* [[truxton_file_create_relation]]
+
* [[truxton_communication_get_file_id]] - Retrieves the identifier of the file this message came from
−
* [[truxton_file_create_url]]
+
* [[truxton_communication_set_file_id]] - Sets the identifier of the file this message came from
−
* [[truxton_file_create_usb]]
+
* [[truxton_communication_get_id]] - Retrieves the identifier of this message
 +
* [[truxton_communication_get_media_id]] - Retrieves the identifier of the media this message came from
 +
* [[truxton_communication_set_media_id]] - Sets the identifier of the media this message came from
 +
* [[truxton_communication_get_received]] - Retrieves the time the message was received
 +
* [[truxton_communication_set_received]] - Sets the time the message was received
 +
* [[truxton_communication_get_sent]] - Retrieves the time the message was sent
 +
* [[truxton_communication_set_sent]] - Sets the time the message was sent
 +
* [[truxton_communication_get_subject]] - Retrieves the subject of the message
 +
* [[truxton_communication_set_subject]] - Sets the subject of the message
 +
* [[truxton_communication_get_type]] - Retrieves the [[Message Types|type]] of message
 +
* [[truxton_communication_set_type]] - Sets the [[Message Types|type]] of message
 +
* [[truxton_communication_save]] - Saves the object to the database
  
−
==ETL Creation==
+
===Derived Objects===
−
* [[truxton_etl_add_command_line_argument]]
+
* [[truxton_communication_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
−
* [[truxton_etl_add_desired_file_type]]
+
* [[truxton_communication_tag]] - Tags the message. This data will be saved to the <code>[Tagged]</code> table.
−
* [[truxton_etl_create]]
 
−
* [[truxton_etl_destroy]]
 
−
* [[truxton_etl_get_description]]
 
−
* [[truxton_etl_get_id]]
 
−
* [[truxton_etl_get_message]]
 
−
* [[truxton_etl_get_stage_number]]
 
−
* [[truxton_etl_set_application_name]]
 
−
* [[truxton_etl_set_depot_type]]
 
−
* [[truxton_etl_set_depot_type_name]]
 
−
* [[truxton_etl_set_description]]
 
−
* [[truxton_etl_set_expander_identifier]]
 
−
* [[truxton_etl_set_expander_version]]
 
−
* [[truxton_etl_set_queue_name]]
 
−
* [[truxton_etl_set_stage_number]]
 
−
* [[truxton_etl_set_thread_safe]]
 
−
* [[truxton_etl_set_poly_file_expander]]
 
  
−
==Debugging==
+
==Enumeration==
−
* [[truxton_etl_send_me_file_id]]
+
This set of functions allow you to get things out of Truxton.
−
* [[truxton_etl_send_me_files]]
+
 
−
* [[truxton_etl_send_me_hash]]
+
* [[truxton_enumeration_create]] - Creates an enumeration
−
* [[truxton_etl_send_me_local_file]]
+
* [[truxton_enumeration_destroy]] - Destroys the enumeration
 +
* [[truxton_enumeration_get_current_file]] - Retrieves the parent file of the current enumerated item
 +
* [[truxton_enumeration_get_current_investigation]] - Retrieves the parent investigation of the current enumerated item
 +
* [[truxton_enumeration_get_current_media]] - Retrieves the parent media of the current enumerated item
 +
* [[truxton_enumeration_get_double]] - Retrieves the floating point value at a desired column of a custom enumeration
 +
* [[truxton_enumeration_get_integer]] - Retrieves the integer value at a desired column of a custom enumeration
 +
* [[truxton_enumeration_get_next]] - Retrieves the next item in the enumeration
 +
* [[truxton_enumeration_get_scope]] - Retrieves the scope of the enumeration
 +
* [[truxton_enumeration_get_scope_id]] - Retrieves the specific item being enumerated
 +
* [[truxton_enumeration_get_string]] - Retrieves the string at a desired column of a custom enumeration
 +
* [[truxton_enumeration_get_time]] - Retrieves the time value at a desired column of a custom enumeration
 +
* [[truxton_enumeration_get_target]] - Retrieves what is being enumerated
 +
* [[truxton_enumeration_set_query]] - Sets SQL query to use with custom enumeration
 +
* [[truxton_enumeration_set_scope]] - Sets the scope of the enumeration
 +
* [[truxton_enumeration_set_scope_id]] - Sets the specific identifier of the scope
 +
* [[truxton_enumeration_set_target]] - Sets what you want to enumerate
 +
* [[truxton_enumeration_reset]] - Rewinds the enumeration to the beginning
 +
 
 +
==ETL Application Creation==
 +
* [[truxton_etl_add_command_line_argument]] - Adds a command line argument
 +
* [[truxton_etl_add_desired_file_type]] - Tells Truxton what types of files you want to process
 +
* [[truxton_etl_create]] - Creates a Truxton ETL object
 +
* [[truxton_etl_destroy]] - Destroys a Truxton ETL object
 +
* [[truxton_etl_get_application_name]] - Retrieves the name of your application
 +
* [[truxton_etl_get_description]] - Retrieves the human readable description of this exploitation process
 +
* [[truxton_get_etl_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the ETL
 +
* [[truxton_etl_get_message]] - Halts the execution of your program until a message arrives from your message queue
 +
* [[truxton_etl_get_stage_number]] - Retreives the [[ETL Stages|stage]] of this exploitation process
 +
* [[truxton_etl_set_application_name]] - Sets the name of your application
 +
* [[truxton_etl_set_depot_type]] - Sets the type of depot you want to use
 +
* [[truxton_etl_set_depot_type_name]] - Sets a seed name for the type of depot you want to use
 +
* [[truxton_etl_set_description]] - Sets a description that has meaning to another human about this exploitation process
 +
* [[truxton_etl_set_expander_identifier]] - Sets an identifier to use during reprocessing
 +
* [[truxton_etl_set_expander_version]] - Sets a custom version of your process
 +
* [[truxton_etl_set_mode]] - Sets the mode of the application
 +
* [[truxton_etl_set_poly_file_expander]] - Tells Truxton you are a file expander that needs multiple source files
 +
* [[truxton_etl_set_queue_name]] - Sets the name of the message queue for this process
 +
* [[truxton_etl_set_stage_number]] - Sets the [[ETL Stages|stage]] at which this exploitation process should run
 +
* [[truxton_etl_set_thread_safe]] - Tells Truxton if it is safe to use your message handler in a multi-threaded fashion
 +
 
 +
===Debugging===
 +
* [[truxton_etl_send_me_file_id]] - Puts a message in your queue given a [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] that matches the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
 +
* [[truxton_etl_send_me_files]] - Put a specified number messages in your queue of a particular [[File Types Supported|file type.]]  
 +
* [[truxton_etl_send_me_hash]] - Put one file that matches an [https://en.wikipedia.org/wiki/MD5 MD5] hash.
 +
* [[truxton_etl_send_me_local_file]] - Put a specified file on your system into your message queue.
 +
* [[truxton_etl_send_me_message]] - Put a specified message into your message queue.
 +
 
 +
==Event==
 +
If you need to save a significant place in time, use the following functions.
 +
The data structure these API encapsulate is similar to the one used in the [[Message Bus Messages#Event|event message.]]
 +
These will create a record in the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
 +
* [[truxton_event_create]] - Creates a new event object
 +
* [[truxton_event_destroy]] - Destroys an existing event object
 +
* [[truxton_event_save]] - Saves the data in this object to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table
 +
* [[truxton_event_get_id]] - After saving, retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the event.
 +
* [[truxton_event_get_title]] - Gets the short title of the event
 +
* [[truxton_event_set_title]] - Sets the short title of the event
 +
* [[truxton_event_get_description]] - Gets the long description of the event
 +
* [[truxton_event_set_description]] - Sets the long description of the event
 +
* [[truxton_event_get_start]] - Gets the beginning of the event in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_event_set_start]] - Sets the beginning of the event in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_event_get_end]] - Gets the end of the event in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_event_set_end]] - Sets the end of the event in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_event_get_type]] - Gets the [[Event Types|type]] of event
 +
* [[truxton_event_set_type]] - Sets the [[Event Types|type]] of event
 +
* [[truxton_event_get_file_id]] - Gets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this event came from
 +
* [[truxton_event_set_file_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this event came from
 +
* [[truxton_event_get_media_id]] - Gets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this event belongs to
 +
* [[truxton_event_set_media_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this event belongs to
 +
 
 +
===Derived Objects===
 +
The following APIs are used to create objects with an event as their parent.
 +
* [[truxton_event_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 +
* [[truxton_event_tag]] - Creates a tag and puts it on this event. This data will be saved to the <code>[Tagged]</code> table.
 +
 
 +
==Event Type==
 +
This API is used to create custom types of events.
 +
If one of the [[Event Types|default event types]] don't suite your purpose, you are free to create your own.
 +
 
 +
* [[truxton_event_type_create]] - Creates a new event type object
 +
* [[truxton_event_type_destroy]] - Destroys an existing event type object
 +
* [[truxton_event_type_save]] - Saves the data in this object to the <code>[EventType]</code> table
 +
* [[truxton_event_type_get_id]] - Retrieves the integer value for the type
 +
* [[truxton_event_type_set_id]] - Sets the integer value of the type
 +
* [[truxton_event_type_get_name]] - Gets the human readable name of the event type
 +
* [[truxton_event_type_set_name]] - Sets the human readable name of the event type
 +
* [[truxton_delete_event_type]] - Deletes an event type from Truxton
 +
 
 +
==EXIF (Camera Information)==
 +
This set if APIs deal with information from the [https://en.wikipedia.org/wiki/Exif EXIF] section of files.
 +
The primary file types that contain EXIF are [[Type_JPEGWithExif|JPG]] and [[Type_TIFFWithExif|TIFF]].
 +
Not all of the fields of this object are stored in the database.
 +
Internally, Truxton has one parser for EXIF and uses that information to perform other forensic tasks.
 +
 
 +
These functions give you access to a data structure equivalent to the one used in [[Message Bus Messages#Camera Information (EXIF)|EXIF messages.]]
 +
 
 +
===Persisted in Database===
 +
The following APIs deal with things that are stored in the database.
 +
 
 +
* [[truxton_exif_create]] - Creates a new EXIF object
 +
* [[truxton_exif_destroy]] - Destroys an existing EXIF object
 +
* [[truxton_exif_save]] - Saves the data in this object to the <code><nowiki>[</nowiki>[[EXIF Table|EXIF]]<nowiki>]</nowiki></code> table in the database
 +
* [[truxton_exif_get_id]] - Retrieves the object's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
 +
* [[truxton_exif_get_file_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this object came from
 +
* [[truxton_exif_set_file_id]] - Sets [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this object came from
 +
* [[truxton_exif_get_media_id]] - Retrieves [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this object came from
 +
* [[truxton_exif_set_media_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this object came from
 +
* [[truxton_exif_get_altitude]] - Retrieves the altitude, in meters, of the location
 +
* [[truxton_exif_set_altitude]] - Sets the altitude, in meters, of the location
 +
* [[truxton_exif_get_body_serial_number]] - Retrieves the serial number of the body of the imaging device
 +
* [[truxton_exif_set_body_serial_number]] - Sets the serial number of the body of the imaging device
 +
* [[truxton_exif_get_device_time]] - Retrieves the time, according to the imaging device, of when the image was taken in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_exif_set_device_time]] - Sets the time, according to the imaging device, of when the image was taken in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_exif_get_focal_length]] - Retrieves the 35mm [https://en.wikipedia.org/wiki/Focal_length focal length] of the device
 +
* [[truxton_exif_set_focal_length]] - Sets the [https://en.wikipedia.org/wiki/Focal_length focal length] of the device when the image was taken
 +
* [[truxton_exif_get_gps_time]] - Retrieves the time, according to the GPS in the imaging device, of when the image was taken in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_exif_set_gps_time]] - Sets the time, according to the GPS in the imaging device, of when the image was taken in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_exif_get_heading]] - Retrieves the direction the device was pointed when the image was taken
 +
* [[truxton_exif_set_heading]] - Sets the direction the device was pointed when the image was taken
 +
* [[truxton_exif_get_latitude]] - Retrieves the [https://en.wikipedia.org/wiki/Latitude latitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of the location where the image was taken
 +
* [[truxton_exif_set_latitude]] - Sets the [https://en.wikipedia.org/wiki/Latitude latitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of the location where the image was taken
 +
* [[truxton_exif_get_lens_serial_number]] - Retrieves the serial number of the lens attached to the imaging device
 +
* [[truxton_exif_set_lens_serial_number]] - Sets the serial number of the lens attached to the imaging device
 +
* [[truxton_exif_get_longitude]] - Retrieves the [https://en.wikipedia.org/wiki/Longitude longitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of the location where the image was taken
 +
* [[truxton_exif_set_longitude]] - Sets the [https://en.wikipedia.org/wiki/Longitude longitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of the location where the image was taken
 +
* [[truxton_exif_get_make]] - Retrieves the manufacturer of the imaging device
 +
* [[truxton_exif_set_make]] - Sets the manufacturer of the imaging device
 +
* [[truxton_exif_get_model]] - Retrieves the model of the imaging device
 +
* [[truxton_exif_set_model]] - Sets the model of the imaging device
 +
* [[truxton_exif_get_offset]] - Retrieves the offset into the parent file where the [https://en.wikipedia.org/wiki/Exif EXIF] data block began.
 +
* [[truxton_exif_set_offset]] - Sets the offset into the parent file where the [https://en.wikipedia.org/wiki/Exif EXIF] data block began.
 +
* [[truxton_exif_get_shutter_count]] - Retrieves the number of images taken by this device
 +
* [[truxton_exif_set_shutter_count]] - Sets the number of images taken by this device
 +
 
 +
===Not in Database===
 +
The following APIs are useful for forensic processing but not saved in the database.
 +
Internally, when Truxton finds EXIF data, it will create and populate an object with that information.
 +
All forensic processing is performed on that object.
 +
The information presented here, while not stored in the database, was used by Truxton to exploit the camera information data.
 +
* [[truxton_exif_get_gps_time_offset]] - Retrieves the offset into the parent file where [https://en.wikipedia.org/wiki/Global_Positioning_System#Timekeeping GPS time] was found
 +
* [[truxton_exif_set_gps_time_offset]] - Sets the offset into the parent file where [https://en.wikipedia.org/wiki/Global_Positioning_System#Timekeeping GPS time] was found
 +
* [[truxton_exif_get_device_time_offset]] - Retrieves the offset into the parent file where the time from the device's internal clock was stored
 +
* [[truxton_exif_set_device_time_offset]] - Sets the offset into the parent file where the time from the device's internal clock is stored
 +
* [[truxton_exif_get_latitude_offset]] - Retrieves the offset into the parent file where the latitude value was stored
 +
* [[truxton_exif_set_latitude_offset]] - Sets the offset into the parent file where the latitude value is stored
 +
* [[truxton_exif_get_longitude_offset]] - Retrieved the offset into the parent file where the longitude value was stored
 +
* [[truxton_exif_set_longitude_offset]] - Sets the offset into the parent file where the longitude value is stored
 +
* [[truxton_exif_get_altitude_offset]] - Retrieves the offset into the parent file where the altitude value was stored
 +
* [[truxton_exif_set_altitude_offset]] - Sets the offset into the parent file where the altitude value is stored
 +
* [[truxton_exif_get_heading_offset]] - Retrieves the offset into the parent file where the heading value was stored
 +
* [[truxton_exif_set_heading_offset]] - Sets the offset into the parent file where the heading value is stored
 +
* [[truxton_exif_get_focal_length_offset]] - Retrieves the offset into the parent file where the focal length value was stored
 +
* [[truxton_exif_set_focal_length_offset]] - Sets the offset into the parent file where the focal length value is stored
 +
* [[truxton_exif_get_shutter_count_offset]] - Retrieves the offset into the parent file where the shutter count value was stored
 +
* [[truxton_exif_set_shutter_count_offset]] - Sets the offset into the parent file where the shutter count value is stored
 +
* [[truxton_exif_get_thumbnail_offset]] - Retrieves the offset into the parent file where the thumbnail data was stored
 +
* [[truxton_exif_set_thumbnail_offset]] - Sets the offset into the parent file where the thumbnail data is stored
 +
* [[truxton_exif_get_thumbnail_offset_offset]] - Retrieves the offset into the parent file where the offset to the thumbnail image was stored
 +
* [[truxton_exif_set_thumbnail_offset_offset]] - Sets the offset into the parent file where the thumbnail offset value is stored
 +
* [[truxton_exif_get_thumbnail_length]] - Retrieves the number of bytes in the thumbnail image
 +
* [[truxton_exif_set_thumbnail_length]] - Sets the number of bytes in the thumbnail image
 +
* [[truxton_exif_get_thumbnail_length_offset]] - Retrieves the offset into the parent file where the thumbnail length value was stored
 +
* [[truxton_exif_set_thumbnail_length_offset]] - Sets the offset into the parent file where the thumbnail length value is stored
 +
* [[truxton_exif_get_make_offset]] - Retrieves the offset into the parent file where the make value was stored
 +
* [[truxton_exif_set_make_offset]] - Sets the offset into the parent file where the make value is stored
 +
* [[truxton_exif_get_model_offset]] - Retrieves the offset into the parent file where the model value was stored
 +
* [[truxton_exif_set_model_offset]] - Sets the offset into the parent file where the model value is stored
 +
* [[truxton_exif_get_body_serial_number_offset]] - Retrieves the offset into the parent file where the body serial number value was stored
 +
* [[truxton_exif_set_body_serial_number_offset]] - Sets the offset into the parent file where the body serial number value is stored
 +
* [[truxton_exif_get_lens_serial_number_offset]] - Retrieves the offset into the parent file where the lens serial number value was stored
 +
* [[truxton_exif_set_lens_serial_number_offset]] - Sets the offset into the parent file where the lens serial number value is stored
 +
 
 +
===Derived Objects===
 +
* [[truxton_exif_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 +
* [[truxton_exif_tag]] - Creates a tag and puts it on this EXIF object. This data will be saved to the <code>[Tagged]</code> table.
 +
 
 +
==File==
 +
===File Actions===
 +
These are things your can do to a file.
 +
These are not data items stored in the database.
 +
* [[truxton_file_change_type]] - Allows you to change the [[File Types Supported|type]] of the file
 +
* [[truxton_file_exists]] - Allows you to test if a file is in the database
 +
* [[truxton_file_get_details]] - Retrieves JSON with details of the file's contents
 +
* [[truxton_file_get_truxton]] - Retrieves the Truxton connection used to get this file
 +
 
 +
===File IO===
 +
* [[truxton_file_close]] - Closes the contents. You will no longer be able to read from the file.
 +
* [[truxton_file_free]] - Deallocates any resources allocated for this object. The file is no longer valid after this call.
 +
* [[truxton_file_is_closed]] - Tells you if the file has been closed or not.
 +
* [[truxton_file_length]] - Returns the number of bytes in the file's contents.
 +
* [[truxton_file_read]] - Reads bytes from the file.
 +
* [[truxton_file_readline]] - Reads a single line of text from the file.
 +
* [[truxton_file_seek]] - Changes the file pointer.
 +
* [[truxton_file_tell]] - Returns the current file pointer position.
  
−
==Message==
+
===File Record Fields===
−
* [[truxton_message_create]]
+
* [[truxton_file_get_accessed]] - Reads the file's last access timestamp in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
* [[truxton_message_destroy]]
+
* [[truxton_file_get_attributes]] - Reads the attributes of the file
−
* [[truxton_message_get_queue_is_empty]]
+
* [[truxton_file_get_content_status]] - Reads the [[Content Status|status]] of the file's contents
−
* [[truxton_message_set_queue_is_empty]]
+
* [[truxton_file_get_created]] - Reads the file's creation timestamp in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
* [[truxton_message_get_route_id]]
+
* [[truxton_file_get_depot_id]] - Reads the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the [[Depot|depot]] holding the file's contents
−
* [[truxton_message_set_route_id]]
+
* [[truxton_file_get_depot_length]] - Reads the number of bytes in the [[Depot|depot]] taken by this file's contents
−
* [[truxton_message_get_priority]]
+
* [[truxton_file_get_depot_name]] - Reads the file name of the [[Depot|depot]] holding this file's contents
−
* [[truxton_message_set_priority]]
+
* [[truxton_file_get_depot_offset]] - The offset from the beginning of the [[Depot | depot]] where this file's contents begin
−
* [[truxton_message_get_file_id]]
+
* [[truxton_file_get_disk_offset]] - Reads physical offset of the first byte of the file's contents
−
* [[truxton_message_set_file_id]]
+
* [[truxton_file_get_entropy]] - Reads the [https://en.wikipedia.org/wiki/Entropy_(information_theory) entropy] of the file's contents
−
* [[truxton_message_get_parent_id]]
+
* [[truxton_file_get_hash]] - Reads the [https://en.wikipedia.org/wiki/MD5 MD5] of the file's contents
−
* [[truxton_message_set_parent_id]]
+
* [[truxton_file_get_id]] - Retrieves the file's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
−
* [[truxton_message_get_media_id]]
+
* [[truxton_file_get_is_eliminated]] - Tells you of the file's contents were discarded
−
* [[truxton_message_set_media_id]]
+
* [[truxton_file_get_is_resident]] - Tells you if the file's contents exist contiguously within its parent
−
* [[truxton_message_get_depot_id]]
+
* [[truxton_file_get_media_id]] - Reads the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file's media
−
* [[truxton_message_set_depot_id]]
+
* [[truxton_file_get_modified]] - Reads the file's last write timestamp in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
* [[truxton_message_get_depot_offset]]
+
* [[truxton_file_get_name]] - Reads the name of the file
−
* [[truxton_message_set_depot_offset]]
+
* [[truxton_file_get_number_of_children]] - Returns the number of files that have this one as their parent
−
* [[truxton_message_get_depot_length]]
+
* [[truxton_file_get_origin]] - Reads the [[Origin|origin]] of the file's contents
−
* [[truxton_message_set_depot_length]]
+
* [[truxton_file_get_parent_id]] - Reads the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file's parent
−
* [[truxton_message_get_hash]]
+
* [[truxton_file_get_size]] - Reads the size of the file as recorded in the directory entry for the file
−
* [[truxton_message_set_hash]]
+
* [[truxton_file_get_signature]] - Gets the first four bytes of the contents as an integer
−
* [[truxton_message_get_signature]]
+
* [[truxton_file_get_type]] - Reads the [[File Types Supported|type]] of the file
−
* [[truxton_message_set_signature]]
+
* [[truxton_file_path_exists]] - Determines if a file path exists in Truxton
−
* [[truxton_message_get_file_type]]
 
−
* [[truxton_message_set_file_type]]
 
−
* [[truxton_message_get_depot_filename]]
 
−
* [[truxton_message_set_depot_filename]]
 
−
* [[truxton_message_get_dont_route]]
 
−
* [[truxton_message_set_dont_route]]
 
−
* [[truxton_message_get_truxton]]
 
−
* [[truxton_message_set_truxton]]
 
  
−
==String Map==
+
===Derived Objects===
−
* [[truxton_string_map_create]]
+
The following APIs are used to create objects with a file as their parent.
−
* [[truxton_string_map_destroy]]
+
* [[truxton_file_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
−
* [[truxton_string_map_set]]
+
* [[truxton_file_create_artifact]] - Creates and associates an artifact with this file. The artifact be saved to the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table.
−
* [[truxton_string_map_get]]
+
* [[truxton_file_create_child]] - For creating a file.
−
* [[truxton_string_map_copy]]
+
* [[truxton_file_create_event]] - Creates and associates an event with this file. The event will be saved to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
−
* [[truxton_string_map_clone]]
+
* [[truxton_file_create_exif]] - Creates and associates camera information with this file. The data will be saved to the <code><nowiki>[</nowiki>[[EXIF Table|EXIF]]<nowiki>]</nowiki></code> table.
−
* [[truxton_string_map_size]]
+
* [[truxton_file_create_location]] - Creates and associates a geographic location with this file. The data will be saved to the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.
 +
* [[truxton_file_create_relation]] - Creates a relationship with this file as the source. The data will be saved to the <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> table.
 +
* [[truxton_file_create_url]] - Creates a website visit with this file as the source. This data will be saved to the <code><nowiki>[</nowiki>[[WebsiteVisit Table|WebsiteVisit]]<nowiki>]</nowiki></code> table.
 +
* [[truxton_file_create_usb]] - Creates a USB device with this file as the source. This data will be saved to the <code><nowiki>[</nowiki>[[USBDevice Table|USBDevice]]<nowiki>]</nowiki></code> table.
 +
* [[truxton_file_open_id]] - Retrieves a particular file specified by the file's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].
 +
* [[truxton_file_open_md5]] - Retrieves the first file in Truxton whose contents have the given [https://en.wikipedia.org/wiki/MD5 MD5] hash.
 +
* [[truxton_file_open_path]] - Retrieves a particular file specified by an exact path.
 +
* [[truxton_file_tag]] - Creates a tag and puts it on this file. This data will be saved to the <code>[Tagged]</code> table.
  
 
==File Export==
 
==File Export==
−
* [[truxton_file_export_create]]
+
* [[truxton_file_export_create]] - Creates a new file export object
−
* [[truxton_file_export_destroy]]
+
* [[truxton_file_export_destroy]] - Destroys an existing file export object
−
* [[truxton_file_export_set_option]]
+
* [[truxton_file_export_execute]] - Exports the files based on the given criteria and options
−
* [[truxton_file_export_get_where_clause]]
+
* [[truxton_file_export_add_criteria]] - Adds a criteria to the export
−
* [[truxton_file_export_add_string_criteria]]
+
* [[truxton_file_export_set_option]] - Sets options for the export
−
* [[truxton_file_export_add_integer_criteria]]
+
* [[truxton_file_export_set_truxton]] - Sets the Truxton object for an export
−
* [[truxton_file_export_set_truxton]]
+
* [[truxton_file_export_where_clause]] - Retrieves the [https://en.wikipedia.org/wiki/SQL SQL] <code>WHERE</code> clause of the current criteria
−
* [[truxton_file_export_where_clause]]
 
  
−
==Artifacts==
+
==File Type==
−
uint64_t truxton_artifact_create(uint64_t truxton_handle);
+
* [[truxton_file_type_create]] - Creates a file type object.
−
void    truxton_artifact_destroy(uint64_t entity_handle);
+
* [[truxton_file_type_open_id]] - Opens an existing a file type.
−
int      truxton_artifact_save(uint64_t entity_handle);
+
* [[truxton_file_type_destroy]] - Frees any resources allocated for this file type object.
−
uint64_t truxton_artifact_get_data_type(uint64_t entity_handle);
+
* [[truxton_file_type_get_id]] - Retrieves the identifier you assigned to this file type.
−
void    truxton_artifact_set_data_type(uint64_t entity_handle, uint64_t data_type);
+
* [[truxton_file_type_set_id]] - Sets the unique identifier. This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
−
void    truxton_artifact_get_file_id(uint64_t entity_handle, char* buffer, size_t buffer_size);
+
* [[truxton_file_type_get_parent_id]] - Retrieves the parent identifier you assigned to this file type.
−
void    truxton_artifact_set_file_id(uint64_t entity_handle, char const* guid);
+
* [[truxton_file_type_set_parent_id]] - Sets the more generic type of the file. This corresponds to the <code>[ParentFileTypeID]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
−
void    truxton_artifact_get_id(uint64_t entity_handle, char* buffer, size_t buffer_size);
+
* [[truxton_file_type_get_short_name]] - Retrieves the short name you assigned to this file type.
−
uint64_t truxton_artifact_get_length(uint64_t entity_handle);
+
* [[truxton_file_type_set_short_name]] - Sets the short name to use for this file type. This corresponds to the <code>[ShortName]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
−
void    truxton_artifact_set_length(uint64_t entity_handle, uint64_t length);
+
* [[truxton_file_type_get_long_name]] - Retrieves the longer description you assigned to this file type.
−
void    truxton_artifact_get_media_id(uint64_t entity_handle, char* buffer, size_t buffer_size);
+
* [[truxton_file_type_set_long_name]] - Sets the longer description of the file type. This corresponds to the <code>[LongName]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
−
void    truxton_artifact_set_media_id(uint64_t entity_handle, char const* guid);
+
* [[truxton_file_type_get_extension]] - Retrieves the [https://en.wikipedia.org/wiki/Filename_extension file name extension] you assigned to this object.
−
void    truxton_artifact_get_object_id(uint64_t entity_handle, char* buffer, size_t buffer_size);
+
* [[truxton_file_type_set_extension]] - Sets the [https://en.wikipedia.org/wiki/Filename_extension file name extension] for this file type.
−
void    truxton_artifact_set_object_id(uint64_t entity_handle, char const* guid);
+
* [[truxton_file_type_get_mime_type]] - Retrieves the [https://en.wikipedia.org/wiki/Media_type MIME type] you assigned to this object. This corresponds to the <code>[Extension]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
−
uint64_t truxton_artifact_get_object_type(uint64_t entity_handle);
+
* [[truxton_file_type_set_mime_type]] - Sets the [https://en.wikipedia.org/wiki/Media_type MIME type]. This corresponds to the <code>[MIME]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
−
void    truxton_artifact_set_object_type(uint64_t entity_handle, uint32_t artifact_type);
+
* [[truxton_file_type_save]] - This will write the information in the object to the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
−
uint64_t truxton_artifact_get_offset(uint64_t entity_handle);
+
* [[truxton_file_type_update_average_file_size]] - This will update the <code>[AverageFileSize]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
−
void    truxton_artifact_set_offset(uint64_t entity_handle, uint64_t offset);
+
* [[truxton_file_type_update_maximum_carve_file_size]] - This will update the <code>[MaximumCarveFileSize]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
−
void    truxton_artifact_get_value(uint64_t entity_handle, char* buffer, size_t buffer_size);
+
* [[truxton_file_type_update_minimum_carve_file_size]] - This will update the <code>[MinimumCarveFileSize]</code> column of the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> table.
−
void    truxton_artifact_set_value(uint64_t entity_handle, char const* value);
+
 
 +
==Group==
 +
A group is a collection of things scoped to an investigation and investigator.
 +
This is the technology behind marking things as Findings.
 +
 
 +
* [[truxton_group_create]] - Creates a group
 +
* [[truxton_group_destroy]] - Destroys the group object
 +
* [[truxton_group_save]] - Saves the group to the <code>[Group]</code> table in the database
 +
* [[truxton_group_get_id]] - Gets the group [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
 +
* [[truxton_group_set_id]] - Sets the group [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
 +
* [[truxton_group_get_investigation_id]] - Gets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation this group belongs to
 +
* [[truxton_group_set_investigation_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation this group belongs to
 +
* [[truxton_group_get_investigator_id]] - Gets the investigator's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
 +
* [[truxton_group_set_investigator_id]] - Sets the investigator's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
 +
* [[truxton_group_get_copy_id]] - Gets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the group this group was copied from
 +
* [[truxton_group_set_copy_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the group this group was copied from
 +
* [[truxton_group_get_name]] - Gets the name of the group
 +
* [[truxton_group_set_name]] - Sets the name of the group
 +
* [[truxton_group_get_description]] - Gets the description of the group
 +
* [[truxton_group_set_description]] - Sets the description of the group
 +
* [[truxton_group_get_status]] - Gets the [[Group Status|status]] of the group
 +
* [[truxton_group_set_status]] - Sets the [[Group Status|status]] of the group
 +
* [[truxton_group_get_type]] - Gets the [[Group Types|type]] of the group
 +
* [[truxton_group_set_type]] - Sets the [[Group Types|type]] of the group
 +
* [[truxton_group_get_created]] - Gets the date time of the group creation in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_group_set_created]] - Sets the date time of the group creation in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_group_get_is_default]] - Tells you if this group is the default group for the investigation
 +
* [[truxton_group_set_is_default]] - Sets the group to be the default
 +
* [[truxton_group_get_is_deleted]] - Tells you if this group is deleted
 +
* [[truxton_group_set_is_deleted]] - Marks the group as deleted
 +
 
 +
==Investigation==
 +
* [[truxton_investigation_add_media]] - Adds media to the investigation
 +
* [[truxton_investigation_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 +
* [[truxton_investigation_create]] - Creates an investigation object
 +
* [[truxton_investigation_create_group]] - Creates a group associated with this investigation
 +
* [[truxton_investigation_destroy]] - Destroys an investigation object
 +
* [[truxton_investigation_get_active_group_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation's active group
 +
* [[truxton_investigation_get_case_number]] - Retrieves the case number of the investigation
 +
* [[truxton_investigation_get_description]] - Retrieves the description of the investigation
 +
* [[truxton_investigation_get_id]] - Retrieves the investigation's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
 +
* [[truxton_investigation_get_jurisdiction]] - Retrieves the jurisdiction identifier of the investigation
 +
* [[truxton_investigation_get_name]] - Retrieves the name of the investigation
 +
* [[truxton_investigation_get_opened]] - Retrieves when the investigation was opened
 +
* [[truxton_investigation_get_status]] - Retrieves the [[Investigation Statuses|status]] of the investigation
 +
* [[truxton_investigation_get_truxton]] - Retrieves the parent Truxton handle
 +
* [[truxton_investigation_get_type]] - Retrieves the [[Investigation Types|type]] of the investigation
 +
* [[truxton_investigation_initialize_findings]] - Initializes the "My Findings" group for this investigation
 +
* [[truxton_investigation_open_id]] - Opens an existing investigation
 +
* [[truxton_investigation_remove_media]] - Removes media from the investigation
 +
* [[truxton_investigation_save]] - Saves the data in the object to the <code>[Investigation]</code> table
 +
* [[truxton_investigation_set_active_group_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the group to be the default for the investigation
 +
* [[truxton_investigation_set_case_number]] - Sets the case number of the investigation
 +
* [[truxton_investigation_set_description]] - Sets the description of the investigation
 +
* [[truxton_investigation_set_id]] - Assigns a [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] to the investigation
 +
* [[truxton_investigation_set_jurisdiction]] - Sets the jurisdiction identifier of the investigation
 +
* [[truxton_investigation_set_name]] - Sets the name of the investigation
 +
* [[truxton_investigation_set_opened]] - Sets the date and time of when the investigation was opened in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_investigation_set_status]] - Sets the [[Investigation Statuses|status]] of the investigation
 +
* [[truxton_investigation_set_type]] - Sets the [[Investigation Types|type]] of the investigation
 +
* [[truxton_delete_investigation_by_name]] - Deletes an investigation given only a name
 +
 
 +
==Investigation Event==
 +
This set of API's allow you to add records to the <code>[InvestigationEvent]</code> table.
 +
 
 +
* [[truxton_investigation_event_create]] - Creates an investigation event object
 +
* [[truxton_investigation_event_destroy]] - Destroys the investigation event object
 +
* [[truxton_investigation_event_get_id]] - Gets the event [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
 +
* [[truxton_investigation_event_set_id]] - Sets the event [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
 +
* [[truxton_investigation_event_get_investigation_id]] - Gets the investigation [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
 +
* [[truxton_investigation_event_set_investigation_id]] - Sets the investigation [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
 +
* [[truxton_investigation_event_get_color]] - Retrieves the color assigned to the event
 +
* [[truxton_investigation_event_set_color]] - Assigns a color to the event
 +
* [[truxton_investigation_event_get_text]] - Retrieves the text of the event
 +
* [[truxton_investigation_event_set_text]] - Sets the text of the event
 +
* [[truxton_investigation_event_get_status]] - Retrieves the [[Investigation Statuses|status]] of the investigation
 +
* [[truxton_investigation_event_set_status]] - Sets the [[Investigation Statuses|status]] of the investigation
 +
* [[truxton_investigation_event_get_type]] - Retrieves the [[Investigation Event Types|type]] of the event
 +
* [[truxton_investigation_event_set_type]] - Sets the [[Investigation Event Types|type]] of the event
 +
* [[truxton_investigation_event_get_when]] - Retrieves when the event took place in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_investigation_event_set_when]] - Sets when the event took place in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_investigation_event_save]] - Saves the investigation event object to the database
  
−
==Event==
+
==Jurisdiction==
−
uint64_t truxton_event_create(uint64_t truxton_handle);
+
Jurisdictions is a way to keep track of work done on behalf of others.
−
void    truxton_event_destroy(uint64_t event_handle);
+
Say you're a regional forensics lab and your boss asks you, "How much work did we do for [https://en.wikipedia.org/wiki/Mayberry Mayberry] last quarter?"
−
int      truxton_event_save(uint64_t event_handle);
 
−
void    truxton_event_get_id(uint64_t event_handle, char* buffer, size_t buffer_size);
 
−
void    truxton_event_set_title(uint64_t event_handle, char const* value);
 
−
void    truxton_event_get_title(uint64_t event_handle, char* buffer, size_t buffer_size);
 
−
void    truxton_event_set_description(uint64_t event_handle, char const* value);
 
−
void    truxton_event_get_description(uint64_t event_handle, char* buffer, size_t buffer_size);
 
−
uint64_t truxton_event_get_start(uint64_t event_handle);
 
−
void    truxton_event_set_start(uint64_t event_handle, uint64_t value);
 
−
uint64_t truxton_event_get_end(uint64_t event_handle);
 
−
void    truxton_event_set_end(uint64_t event_handle, uint64_t value);
 
−
uint64_t truxton_event_get_type(uint64_t event_handle);
 
−
void    truxton_event_set_type(uint64_t event_handle, uint64_t value);
 
−
void    truxton_event_get_media_id(uint64_t event_handle, char* buffer, size_t buffer_size);
 
−
void    truxton_event_set_media_id(uint64_t event_handle, char const* guid);
 
−
void    truxton_event_get_file_id(uint64_t event_handle, char* buffer, size_t buffer_size);
 
−
void    truxton_event_set_file_id(uint64_t event_handle, char const* guid);
 
  
−
==EXIF (Camera Information)==
+
* [[truxton_jurisdiction_create]] - This will create a new jurisdiction object
−
uint64_t truxton_exif_create(uint64_t truxton_handle);
+
* [[truxton_jurisdiction_destroy]] - This will destroy the jurisdiction object
−
void    truxton_exif_destroy(uint64_t exif_handle);
+
* [[truxton_jurisdiction_save]] - This will save the data in the object to the <code>[Jurisdiction]</code> table
−
int      truxton_exif_save(uint64_t exif_handle);
+
* [[truxton_jurisdiction_get_id]] - This will retrieve the id of the jurisdiction
−
void    truxton_exif_get_id(uint64_t exif_handle, char* buffer, size_t buffer_size);
+
* [[truxton_jurisdiction_set_id]] - This will set the id of the jurisdiction
−
void    truxton_exif_get_file_id(uint64_t exif_handle, char* buffer, size_t buffer_size);
+
* [[truxton_jurisdiction_get_description]] - This retrieves the description of the jurisdiction
−
void    truxton_exif_set_file_id(uint64_t exif_handle, char const* guid);
+
* [[truxton_jurisdiction_set_description]] - This sets the description of the jurisdiction
−
void    truxton_exif_get_media_id(uint64_t exif_handle, char* buffer, size_t buffer_size);
+
* [[truxton_jurisdiction_get_name]] - This retrieves the name of the jurisdiction
−
void    truxton_exif_set_media_id(uint64_t exif_handle, char const* guid);
+
* [[truxton_jurisdiction_set_name]] - This sets the name of the jurisdiction
−
uint64_t truxton_exif_get_gps_time(uint64_t exif_handle);
 
−
void    truxton_exif_set_gps_time(uint64_t exif_handle, uint64_t value);
 
−
uint64_t truxton_exif_get_gps_time_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_gps_time_offset(uint64_t exif_handle, uint64_t value);
 
−
uint64_t truxton_exif_get_device_time(uint64_t exif_handle);
 
−
void    truxton_exif_set_device_time(uint64_t exif_handle, uint64_t value);
 
−
uint64_t truxton_exif_get_device_time_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_device_time_offset(uint64_t exif_handle, uint64_t value);
 
−
double  truxton_exif_get_latitude(uint64_t exif_handle);
 
−
void    truxton_exif_set_latitude(uint64_t exif_handle, double value);
 
−
uint64_t truxton_exif_get_latitude_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_latitude_offset(uint64_t exif_handle, uint64_t value);
 
−
double  truxton_exif_get_longitude(uint64_t exif_handle);
 
−
void    truxton_exif_set_longitude(uint64_t exif_handle, double value);
 
−
uint64_t truxton_exif_get_longitude_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_longitude_offset(uint64_t exif_handle, uint64_t value);
 
−
double  truxton_exif_get_altitude(uint64_t exif_handle);
 
−
void    truxton_exif_set_altitude(uint64_t exif_handle, double value);
 
−
uint64_t truxton_exif_get_altitude_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_altitude_offset(uint64_t exif_handle, uint64_t value);
 
−
double  truxton_exif_get_heading(uint64_t exif_handle);
 
−
void    truxton_exif_set_heading(uint64_t exif_handle, double value);
 
−
uint64_t truxton_exif_get_heading_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_heading_offset(uint64_t exif_handle, uint64_t value);
 
−
double  truxton_exif_get_focal_length(uint64_t exif_handle);
 
−
void    truxton_exif_set_focal_length(uint64_t exif_handle, double value);
 
−
uint64_t truxton_exif_get_focal_length_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_focal_length_offset(uint64_t exif_handle, uint64_t value);
 
−
uint64_t truxton_exif_get_shutter_count(uint64_t exif_handle);
 
−
void    truxton_exif_set_shutter_count(uint64_t exif_handle, uint64_t value);
 
−
uint64_t truxton_exif_get_shutter_count_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_shutter_count_offset(uint64_t exif_handle, uint64_t value);
 
−
uint64_t truxton_exif_get_thumbnail_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_thumbnail_offset(uint64_t exif_handle, uint64_t value);
 
−
uint64_t truxton_exif_get_thumbnail_offset_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_thumbnail_offset_offset(uint64_t exif_handle, uint64_t value);
 
−
uint64_t truxton_exif_get_thumbnail_length(uint64_t exif_handle);
 
−
void    truxton_exif_set_thumbnail_length(uint64_t exif_handle, uint64_t value);
 
−
uint64_t truxton_exif_get_thumbnail_length_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_thumbnail_length_offset(uint64_t exif_handle, uint64_t value);
 
−
void    truxton_exif_get_make(uint64_t exif_handle, char* buffer, size_t buffer_size);
 
−
void    truxton_exif_set_make(uint64_t exif_handle, char const* guid);
 
−
uint64_t truxton_exif_get_make_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_make_offset(uint64_t exif_handle, uint64_t value);
 
−
void    truxton_exif_get_model(uint64_t exif_handle, char* buffer, size_t buffer_size);
 
−
void    truxton_exif_set_model(uint64_t exif_handle, char const* guid);
 
−
uint64_t truxton_exif_get_model_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_model_offset(uint64_t exif_handle, uint64_t value);
 
−
void    truxton_exif_get_body_serial_number(uint64_t exif_handle, char* buffer, size_t buffer_size);
 
−
void    truxton_exif_set_body_serial_number(uint64_t exif_handle, char const* guid);
 
−
uint64_t truxton_exif_get_body_serial_number_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_body_serial_number_offset(uint64_t exif_handle, uint64_t value);
 
−
void    truxton_exif_get_lens_serial_number(uint64_t exif_handle, char* buffer, size_t buffer_size);
 
−
void    truxton_exif_set_lens_serial_number(uint64_t exif_handle, char const* guid);
 
−
uint64_t truxton_exif_get_lens_serial_number_offset(uint64_t exif_handle);
 
−
void    truxton_exif_set_lens_serial_number_offset(uint64_t exif_handle, uint64_t value);
 
  
 
==Geographic Location==
 
==Geographic Location==
−
uint64_t truxton_location_create(uint64_t truxton_handle);
+
* [[truxton_location_create]] - Creates geographic location. The data will be saved to the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table
−
void    truxton_location_destroy(uint64_t location_handle);
+
* [[truxton_location_destroy]] - Destroys the location object
−
int      truxton_location_save(uint64_t location_handle);
+
* [[truxton_location_save]] - Saves the information in the object to the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table
−
void    truxton_location_get_id(uint64_t location_handle, char* buffer, size_t buffer_size);
+
* [[truxton_location_get_id]] - After saving, retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the event
−
void    truxton_location_get_file_id(uint64_t location_handle, char* buffer, size_t buffer_size);
+
* [[truxton_location_get_file_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file the location came from
−
void    truxton_location_set_file_id(uint64_t location_handle, char const* guid);
+
* [[truxton_location_set_file_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this location came from
−
void    truxton_location_get_media_id(uint64_t location_handle, char* buffer, size_t buffer_size);
+
* [[truxton_location_get_media_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this location came from
−
void    truxton_location_set_media_id(uint64_t location_handle, char const* guid);
+
* [[truxton_location_set_media_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this location came from
−
double  truxton_location_get_altitude(uint64_t location_handle);
+
* [[truxton_location_get_altitude]] - Retrieves the altitude, in meters, of this location
−
void    truxton_location_set_altitude(uint64_t location_handle, double value);
+
* [[truxton_location_set_altitude]] - Sets the altitude, in meters, of this location
−
void    truxton_location_get_label(uint64_t location_handle, char* buffer, size_t buffer_size);
+
* [[truxton_location_get_label]] - Retrieves the short title of this location
−
void    truxton_location_set_label(uint64_t location_handle, char const* value);
+
* [[truxton_location_set_label]] - Sets the short description of this location
−
double  truxton_location_get_latitude(uint64_t location_handle);
+
* [[truxton_location_get_latitude]] - Retrieves the [https://en.wikipedia.org/wiki/Latitude latitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of this location
−
void    truxton_location_set_latitude(uint64_t location_handle, double value);
+
* [[truxton_location_set_latitude]] - Sets the [https://en.wikipedia.org/wiki/Latitude latitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of this location
−
double  truxton_location_get_longitude(uint64_t location_handle);
+
* [[truxton_location_get_longitude]] - Retrieves the [https://en.wikipedia.org/wiki/Longitude longitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of this location
−
void    truxton_location_set_longitude(uint64_t location_handle, double value);
+
* [[truxton_location_set_longitude]] - Sets the [https://en.wikipedia.org/wiki/Longitude longitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of this location
−
uint64_t truxton_location_get_type(uint64_t location_handle);
+
* [[truxton_location_get_type]] - Retrieves the [[Location Types|type]] of the location
−
void    truxton_location_set_type(uint64_t location_handle, uint64_t value);
+
* [[truxton_location_set_type]] - Sets the [[Location Types|type]] of the location
−
uint64_t truxton_location_get_when(uint64_t location_handle);
+
* [[truxton_location_get_when]] - Retrieves the date and time associated with this location in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
void    truxton_location_set_when(uint64_t location_handle, uint64_t value);
+
* [[truxton_location_set_when]] - Sets the date and time associated with this location in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
 
 +
===Derived Objects===
 +
The following APIs are used to create objects with a location as their parent.
 +
* [[truxton_location_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 +
* [[truxton_location_tag]] - Associating a tag with this media. This data will be saved to the <code>[Tagged]</code> table.
 +
 
 +
==Media==
 +
These are the API's that allow you to add to the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table in the database.
 +
* [[truxton_media_create]] - Creates a new media object
 +
* [[truxton_media_open_by_name]] - Opens an existing media in the database given the media's name.
 +
* [[truxton_media_open_id]] - Opens an existing media in the database given the media's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].
 +
* [[truxton_media_destroy]] - Frees any resources allocated to this object
 +
* [[truxton_media_get_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media
 +
* [[truxton_media_set_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media
 +
* [[truxton_media_get_name]] - Retrieves the name of the media
 +
* [[truxton_media_set_name]] - Sets the name of the media
 +
* [[truxton_media_get_description]] - Retrieves the longer description of the media
 +
* [[truxton_media_set_description]] - Sets the description of the media
 +
* [[truxton_media_get_case_number]] - Retrieves the case identifier of the media
 +
* [[truxton_media_set_case_number]] - Sets the case identifier of the media
 +
* [[truxton_media_get_originator]] - Retrieves who asked you to process the media
 +
* [[truxton_media_set_originator]] - Sets the origin of the media
 +
* [[truxton_media_get_evidence_bag]] - Retrieves the identifier of the evidence bag the media is being kept in
 +
* [[truxton_media_set_evidence_bag]] - Records the identifier of the evidence bag the media is stored in.
 +
* [[truxton_media_get_status]] - Retrieves the [[Media Status|status]] of the media
 +
* [[truxton_media_set_status]] - Sets the [[Media Status|status]] of the media
 +
* [[truxton_media_get_type]] - Retrieves the [[Media Types|type]] of the media
 +
* [[truxton_media_set_type]] - Sets the [[Media Types|type]] of the media
 +
* [[truxton_media_get_created]] - Retrieves when the media was created in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_media_set_created]] - Sets when the media was created in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_media_get_last_updated]] - Retrieves when the media was last updated in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_media_set_last_updated]] - Sets when the media was last updated in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_media_get_expires]] - Retrieves the expiration date of the media
 +
* [[truxton_media_set_expires]] - Sets the expiration date of the media
 +
* [[truxton_media_get_percent_complete]] - Retrieves the completeness the processing of this media
 +
* [[truxton_media_set_percent_complete]] - Sets the completeness the processing of this media
 +
* [[truxton_media_get_load_configuration_id]] - Retrieves the load configuration of this media
 +
* [[truxton_media_set_load_configuration_id]] - Sets the load configuration of this media
 +
* [[truxton_media_get_size]] - Retrieves the size, in bytes, of the original media
 +
* [[truxton_media_set_size]] - Sets the size, in bytes, of the original media
 +
* [[truxton_media_get_latitude]] - Retrieves the [https://en.wikipedia.org/wiki/Latitude latitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of where the media was seized.
 +
* [[truxton_media_set_latitude]] - Sets the [https://en.wikipedia.org/wiki/Latitude latitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of where the media was seized.
 +
* [[truxton_media_get_longitude]] - Retrieves the [https://en.wikipedia.org/wiki/Longitude longitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of where the media was seized.
 +
* [[truxton_media_set_longitude]] - Sets the [https://en.wikipedia.org/wiki/Longitude longitude] portion of the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] coordinates of where the media was seized.
 +
* [[truxton_media_get_generated_files_folder_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the "Generated Files" folder in the media
 +
* [[truxton_media_get_root_file_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the top level file in the media
 +
* [[truxton_media_save]] - Saves the media information to the database
 +
* [[truxton_delete_media_by_name]] - Deletes a piece of media given only a name
 +
* [[truxton_media_set_calculated_size]] - Calculates the size of the media and updates the database
 +
 
 +
===Derived Objects===
 +
The following APIs are used to create objects with a media as their parent.
 +
* [[truxton_media_add_child]] - Created a child file object belonging to this media.
 +
* [[truxton_media_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 +
* [[truxton_media_tag]] - Associating a tag with this media. This data will be saved to the <code>[Tagged]</code> table.
 +
 
 +
===Maintenance Functions===
 +
* [[truxton_media_update_cache_file_counts]] - This will count the files in the different groups and cache them
 +
* [[truxton_media_update_child_count]] - This method updates the <code>[NumberOfChildren]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> for this media
 +
* [[truxton_media_update_paths]] - This method updates the <code>[FullPathID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> for this media
 +
 
 +
==Message==
 +
This is the message sent on the message bus between the ETL processes.
 +
* [[truxton_message_create]] - Creates a new message object
 +
* [[truxton_message_destroy]] - Destroys the message object
 +
* [[truxton_message_send]] - Sends a message to a particular queue
 +
* [[truxton_message_get_queue_is_empty]] - Tells you if the message queue is empty
 +
* [[truxton_message_set_queue_is_empty]] - Sets the empty-queue attribute
 +
* [[truxton_message_get_route_id]] - Retrieves the route this message is taking
 +
* [[truxton_message_set_route_id]] - Sets the route the message should take
 +
* [[truxton_message_get_priority]] - Retrieves the priority of the message
 +
* [[truxton_message_set_priority]] - Sets the priority of the message
 +
* [[truxton_message_get_file_id]] - Retrieves the identifier of the file
 +
* [[truxton_message_set_file_id]] - Sets the identifier of the file
 +
* [[truxton_message_get_parent_id]] - Retrieves the parent file identifier
 +
* [[truxton_message_set_parent_id]] - Sets the parent file identifier
 +
* [[truxton_message_get_media_id]] - Retrieves the media identifier
 +
* [[truxton_message_set_media_id]] - Sets the media identifier
 +
* [[truxton_message_get_depot_id]] - Retrieves the depot identifier
 +
* [[truxton_message_set_depot_id]] - Sets the depot identifier
 +
* [[truxton_message_get_depot_offset]] - Retrieves the offset into the depot of the first byte of the file's contents
 +
* [[truxton_message_set_depot_offset]] - Sets the offset into the depot of the first byte of the file's contents
 +
* [[truxton_message_get_depot_length]] - Retrieves the number of bytes in the depot for this file's contents
 +
* [[truxton_message_set_depot_length]] - Sets the number of bytes in the depot for this file's contents
 +
* [[truxton_message_get_hash]] - Retrieves the [https://en.wikipedia.org/wiki/MD5 MD5] hash (digital fingerprint) of the file's contents
 +
* [[truxton_message_set_hash]] - Sets the [https://en.wikipedia.org/wiki/MD5 MD5] hash (digital fingerprint) of the file's contents
 +
* [[truxton_message_get_signature]] - Retrieves the first four bytes of the contents as an integer
 +
* [[truxton_message_set_signature]] - Sets the first four bytes of the contents as an integer
 +
* [[truxton_message_get_file_type]] - Retrieves the [[File Types Supported|type]] of the file
 +
* [[truxton_message_set_file_type]] - Sets the [[File Types Supported|type]] of the file
 +
* [[truxton_message_get_depot_name]] - Retrieves the name of the file that stores this file's contents
 +
* [[truxton_message_set_depot_name]] - Sets the name of the file that stores this file's contents
 +
* [[truxton_message_get_dont_route]] - Retrieves the Don't Route flag
 +
* [[truxton_message_set_dont_route]] - Sets the Don't Route flag
 +
* [[truxton_message_get_truxton]] - Retrieves the Truxton handle
 +
* [[truxton_message_set_truxton]] - Sets the Truxton handle
 +
 
 +
===Derived Objects===
 +
The following APIs are used to create objects from the given message.
 +
* [[truxton_message_get_file]] - Created a child file object belonging to this media.
 +
 
 +
==Message Addresses==
 +
* [[truxton_message_address_create]] - Creates a message address
 +
* [[truxton_message_address_destroy]] - Frees a message address
 +
* [[truxton_message_address_save]] - Saves the message address to the <code>[MessageAddress]</code> table
 +
* [[truxton_message_address_get_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the message address
 +
* [[truxton_message_address_get_combined_id]] - Retrieves the combined identifier for the account and server
 +
* [[truxton_message_address_get_combined_guid]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the combined identifier for the address
 +
* [[truxton_message_address_get_account]] - Retrieves the account part of the address
 +
* [[truxton_message_address_set_account]] - Sets the account part of the address
 +
* [[truxton_message_address_get_server]] - Retrieves the server part of the address
 +
* [[truxton_message_address_set_server]] - Sets the server part of the address
 +
* [[truxton_message_address_get_name]] - Retrieves the name associated with the address
 +
* [[truxton_message_address_set_name]] - Sets the name to associate with the address
 +
 
 +
==Message Participant==
 +
This is basically a useless API.
 +
It is used internally during the enumeration of the participants of a communication.
 +
 
 +
* [[truxton_message_participant_create]] - Creates a participant in a message
 +
* [[truxton_message_participant_destroy]] - Frees the participant object
 +
* [[truxton_message_participant_get_id]] - Retrieves he globally unique identifier of the participant
 +
* [[truxton_message_participant_set_id]] - Sets the globally unique identifier of the participant
 +
* [[truxton_message_participant_get_combined_id]] - Retrieves the combined id of the message address
 +
* [[truxton_message_participant_get_combined_guid]] - Retrieves the combined identifier as a globally unique identifier
 +
* [[truxton_message_participant_get_account]] - Retrieves the account portion of the message address
 +
* [[truxton_message_participant_set_account]] - Sets the account portion of the message address
 +
* [[truxton_message_participant_get_file_id]] - Retrieves the globally unique identifier of the file containing this participant
 +
* [[truxton_message_participant_set_file_id]] - Sets the globally unique identifier of the file containing this participant
 +
* [[truxton_message_participant_get_media_id]] - Retrieves the globally unique identifier of the media containing this participant
 +
* [[truxton_message_participant_set_media_id]] - Sets the globally unique identifier of the media containing this participant
 +
* [[truxton_message_participant_get_message_address_id]] - Retrieved the globally unique identifier of the message address
 +
* [[truxton_message_participant_set_message_address_id]] - Sets the globally unique identifier of the message address
 +
* [[truxton_message_participant_get_message_id]] - Retrieves the globally unique identifier for the participant
 +
* [[truxton_message_participant_set_message_id]] - Sets the globally unique identifier for the participant
 +
* [[truxton_message_participant_get_server]] - Retrieves the server portion of the participant address
 +
* [[truxton_message_participant_set_server]] - Sets the server portion of the participant address
 +
* [[truxton_message_participant_get_name]] - Retrieves the name portion of the participant address
 +
* [[truxton_message_participant_set_name]] - Sets the name portion of the participant address
 +
* [[truxton_message_participant_get_type]] - Gets the [[Message Participants|role]] this participant took in the message
 +
* [[truxton_message_participant_set_type]] - Sets the [[Message Participants|role]] this participant took in the message
  
−
==Website Visit==
+
==Options==
−
uint64_t truxton_url_create(uint64_t truxton_handle);
+
Truxton "options" are otherwise known as [[Configuration System|configuration settings]], command line options, etc.
−
void    truxton_url_destroy(uint64_t url_handle);
+
They are configuration items that your program can use.
−
int      truxton_url_save(uint64_t url_handle);
 
  
−
void    truxton_url_get_account(uint64_t url_handle, char* buffer, size_t buffer_size);
+
* [[truxton_options_create]] - Creates the options object
−
void    truxton_url_set_account(uint64_t url_handle, char const* value);
+
* [[truxton_options_destroy]] - Frees any resources allocated by the options
−
uint64_t truxton_url_get_account_offset(uint64_t url_handle);
+
* [[truxton_options_exists]] - Determines if a value can be read from the options object
−
void    truxton_url_set_account_offset(uint64_t url_handle, uint64_t value);
+
* [[truxton_option_get_boolean|truxton_options_get_boolean]] - Reads a named boolean value
−
void    truxton_url_get_file_id(uint64_t url_handle, char* buffer, size_t buffer_size);
+
* [[truxton_option_get_integer|truxton_options_get_integer]] - Reads a named integer value
−
void    truxton_url_set_file_id(uint64_t url_handle, char const* guid);
+
* [[truxton_option_get_string|truxton_options_get_string]] - Reads a named string value
−
uint64_t truxton_url_get_format(uint64_t url_handle);
+
 
−
void    truxton_url_set_format(uint64_t url_handle, uint64_t value);
+
==Note==
−
void    truxton_url_get_id(uint64_t url_handle, char* buffer, size_t buffer_size);
+
This set of API's allow you to add records to the <code>[InvestigatorNote]</code> table.
−
void    truxton_url_get_local_filename(uint64_t url_handle, char* buffer, size_t buffer_size);
+
 
−
void    truxton_url_set_local_filename(uint64_t url_handle, char const* value);
+
* [[truxton_note_create]] - Creates a note
−
void    truxton_url_get_media_id(uint64_t url_handle, char* buffer, size_t buffer_size);
+
* [[truxton_note_destroy]] - Frees a note
−
void    truxton_url_set_media_id(uint64_t url_handle, char const* guid);
+
* [[truxton_note_get_investigation_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation that this note belongs
−
uint64_t truxton_url_get_method(uint64_t url_handle);
+
* [[truxton_note_set_investigation_id]] - Sets the investigation [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the note
−
void    truxton_url_set_method(uint64_t url_handle, uint64_t value);
+
* [[truxton_note_get_object_id]] - Retrieves the identifier of the object that has the attached note
−
uint64_t truxton_url_get_type(uint64_t url_handle);
+
* [[truxton_note_set_object_id]] - Sets the identifier of the object to attach the note to
−
void    truxton_url_set_type(uint64_t url_handle, uint64_t value);
+
* [[truxton_note_get_object_type]] - Retrieves the [[Object Types|type]] of the object id
−
void    truxton_url_set_url(uint64_t url_handle, char const* value);
+
* [[truxton_note_set_object_type]] - Sets the [[Object Types|type]] of the object id
−
void    truxton_url_get_url(uint64_t url_handle, char* buffer, size_t buffer_size);
+
* [[truxton_note_get_text]] - Retrieves the contents of the investigator's note
−
uint64_t truxton_url_get_url_offset(uint64_t url_handle);
+
* [[truxton_note_set_text]] - Sets the contents of the investigator's note
−
void    truxton_url_set_url_offset(uint64_t url_handle, uint64_t value);
+
* [[truxton_note_save]] - Saves the note to the <code>[InvestigatorNote]</code> table in the database
−
uint64_t truxton_url_get_when(uint64_t url_handle);
+
 
−
void    truxton_url_set_when(uint64_t url_handle, uint64_t value);
+
==Relation==
 +
These functions let you add to the <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> table in Truxton.
 +
This is how to establish some sort of [[Relation Types|relationship]] between items in Truxton to create a [https://en.wikipedia.org/wiki/Graph_(discrete_mathematics) graph.]
 +
Relations in Truxton adhere to the form of "A is a [[Relation Types|thing]] of B"
 +
Truxton is not focused on exploring graphs ([https://en.wikipedia.org/wiki/Clique_(graph_theory) cliques] anyone?) but needed a way to establish simple relationships between objects.
 +
 
 +
* [[truxton_relation_create]] - Creates a new relationship object
 +
* [[truxton_relation_destroy]] - Destroys an existing relationship object
 +
* [[truxton_relation_save]] - Saves the information in the object to the <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> table
 +
* [[truxton_relation_get_a_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the A object
 +
* [[truxton_relation_set_a_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the A object
 +
* [[truxton_relation_get_b_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the B object
 +
* [[truxton_relation_set_b_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the B object
 +
* [[truxton_relation_get_source_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the object this relation came from
 +
* [[truxton_relation_set_source_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the object this relation came from
 +
* [[truxton_relation_get_a_type]] - Gets the [[Object Types|type]] of A's object id
 +
* [[truxton_relation_set_a_type]] - Sets the [[Object Types|type]] of A's object id
 +
* [[truxton_relation_get_b_type]] - Gets the [[Object Types|type]] of B's object id
 +
* [[truxton_relation_set_b_type]] - Sets the [[Object Types|type]] of B's object id
 +
* [[truxton_relation_get_source_type]] - Gets the [[Object Types|type]] of the source's object id
 +
* [[truxton_relation_set_source_type]] - Sets the [[Object Types|type]] of the source's object id
 +
* [[truxton_relation_get_relation]] - Retrieves the [[Relation Types|type]] of the relation
 +
* [[truxton_relation_set_relation]] - Sets the [[Relation Types|type]] of the relation
 +
 
 +
==Sensitive Site List==
 +
These are the API's that allow you to manipulate a [[Sensitive Site List|sensitive site list]] for Truxton.
 +
These will add records to the <code>[SensitiveSiteList]</code> and <code>[SensitiveSite]</code> tables.
 +
 
 +
* [[truxton_sensitive_site_list_create]] - Creates a new sensitive site list object
 +
* [[truxton_sensitive_site_list_open_id]] - Opens an existing sensitive site list object
 +
* [[truxton_sensitive_site_list_destroy]] - Destroys the sensitive site list object
 +
* [[truxton_sensitive_site_list_delete]] - Deletes the sensitive site list and entries from the <code>[SensitiveSiteList]</code> and <code>[SensitiveSite]</code> tables in the database
 +
* [[truxton_sensitive_site_list_get_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the list
 +
* [[truxton_sensitive_site_list_set_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the list
 +
* [[truxton_sensitive_site_list_get_name]] - Retrieves the name of the sensitive site list
 +
* [[truxton_sensitive_site_list_set_name]] - Sets the name of the sensitive site list
 +
* [[truxton_sensitive_site_list_get_description]] - Retrieves the description of the list
 +
* [[truxton_sensitive_site_list_set_description]] - Sets the description of the list
 +
* [[truxton_sensitive_site_list_save]] - Saves the data to the <code>[SensitiveSiteList]</code> table
 +
* [[truxton_sensitive_site_list_add]] - Adds a geographic point to the current sensitive site list. It writes to the <code>[SensitiveSite]</code> table.
 +
* [[truxton_sensitive_site_list_remove]] - Removes a geographic point from the current list. It deletes from the <code>[SensitiveSite]</code> table.
 +
 
 +
==Subject==
 +
These are the API's that allow you to add an investigative subject to Truxton.
 +
These will add records to the <code>[Suspect]</code> table.
 +
 
 +
* [[truxton_subject_create]] - Creates a new investigative subject
 +
* [[truxton_subject_destroy]] - Destroys the subject
 +
* [[truxton_subject_get_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the subject
 +
* [[truxton_subject_set_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the subject
 +
* [[truxton_subject_get_name]] - Sets the name of the subject
 +
* [[truxton_subject_set_name]] - Retrieves the name of the subject
 +
* [[truxton_subject_get_description]] - Retrieves the description of the subject
 +
* [[truxton_subject_set_description]] - Sets the description of the subject
 +
* [[truxton_subject_get_picture]] - Retrieves the picture of the subject
 +
* [[truxton_subject_set_picture]] - Sets the picture of the subject
 +
* [[truxton_subject_get_custom]] - Retrieves the custom data of the subject
 +
* [[truxton_subject_set_custom]] - Sets the custom data of the subject
 +
* [[truxton_subject_get_birthday]] - Retrieves the birthday of the subject in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_subject_set_birthday]] - Sets the birthday of the subject in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_subject_save]] - Will commit the information in the subject object to the <code>[Suspect]</code> table.
 +
* [[truxton_delete_subject]] - Deletes a subject from the system
 +
 
 +
===Derived Objects===
 +
The following APIs are used to create objects with a subject as their parent.
 +
* [[truxton_subject_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 +
* [[truxton_subject_tag]] - Associating a tag with this subject. This data will be saved to the <code>[Tagged]</code> table.
 +
 
 +
==Types==
 +
Truxton has many different [[Developer's_Guide#Data_Types|types]] in it.
 +
They are generally integer values that have meanings.
 +
Here's how to get a list of them.
 +
 
 +
* [[truxton_get_content_status_names]] - Retrieves mappings from the <code>[ContentStatus]</code> table
 +
* [[truxton_get_data_type_names]] - Retrieves mappings from the <code>[DataType]</code> table
 +
* [[truxton_get_depot_status_names]] - Retrieves mappings from the <code>[DepotStatus]</code> table
 +
* [[truxton_get_depot_type_names]] - Retrieves mappings from the <code>[DepotType]</code> table
 +
* [[truxton_get_entity_type_names]] - Retrieves mappings from the <code>[EntityType]</code> table
 +
* [[truxton_get_event_type_names]] - Retrieves mappings from the <code>[EventType]</code> table
 +
* [[truxton_get_file_type_names]] - Retrieves mappings from the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code>  table
 +
* [[truxton_get_file_type_mime_types]] - Retrieves mappings from the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code>  table
 +
* [[truxton_get_group_entry_type_names]] - Retrieves mappings from the <code>[GroupEntryType]</code> table
 +
* [[truxton_get_group_status_names]] - Retrieves mappings from the <code>[GroupStatus]</code> table
 +
* [[truxton_get_group_type_names]] - Retrieves mappings from the the <code>[GroupType]</code> table
 +
* [[truxton_get_investigation_status_names]] - Retrieves mappings from the <code>[InvestigationStatus]</code> table
 +
* [[truxton_get_investigation_type_names]] - Retrieves mappings from the <code>[InvestigationType]</code> table
 +
* [[truxton_get_location_type_names]] - Retrieves mappings from the <code>[LocationType]</code> table
 +
* [[truxton_get_media_status_names]] - Retrieves mappings from the <code>[MediaStatus]</code> table
 +
* [[truxton_get_media_type_names]] - Retrieves mappings from the <code>[MediaType]</code> table
 +
* [[truxton_get_message_address_type_names]] - Retrieves mappings from the <code>[MessageAddressType]</code> table
 +
* [[truxton_get_message_type_names]] - Retrieves mappings from the <code>[MessageType]</code> table
 +
* [[truxton_get_object_type_names]] - Retrieves mappings from the <code>[ObjectType]</code> table
 +
* [[truxton_get_origin_names]] - Retrieves mappings from the <code>[Origin]</code> table
 +
* [[truxton_get_relation_type_names]] - Retrieves mappings from the <code>[RelationType]</code> table
 +
* [[truxton_get_url_type_names]] - Retrieves mappings from the <code>[URLType]</code> table
 +
* [[truxton_get_website_method_names]] - Retrieves mappings from the <code>[WebsiteMethod]</code> table
 +
 
 +
==URL==
 +
These functions encapsulate a data structure similar to the one used in the [[Message Bus Messages#Website Visit|Website Visit message.]]
 +
* [[truxton_url_create]] - Creates a new URL object
 +
* [[truxton_url_destroy]] - Destroys an existing URL object
 +
* [[truxton_url_save]] - Saves the information in the object to the <code><nowiki>[</nowiki>[[WebsiteVisit Table|WebsiteVisit]]<nowiki>]</nowiki></code> table
 +
* [[truxton_url_get_account]] - Retrieves the account in use when the URL was visited
 +
* [[truxton_url_set_account]] - Sets the account in use when the URL was visited
 +
* [[truxton_url_get_account_offset]] - Retrieves the offset into the parent file where the account was found
 +
* [[truxton_url_set_account_offset]] - Sets the offset into the parent file where the account was found
 +
* [[truxton_url_get_file_id]] - Retrieves the identifier of the file this URL came from
 +
* [[truxton_url_set_file_id]] - Sets the identifier of the file this URL came from
 +
* [[truxton_url_get_format]] - Retrieves the format of the URL
 +
* [[truxton_url_set_format]] - Sets the format of the URL
 +
* [[truxton_url_get_id]] - Retrieves the identifier of the URL after it has been saved
 +
* [[truxton_url_get_local_filename]] - Retrieves the name of the file the URL was cached to
 +
* [[truxton_url_set_local_filename]] - Sets the name of the file the URL was cached to
 +
* [[truxton_url_get_media_id]] - Retrieves the identifier of the media this URL belongs to
 +
* [[truxton_url_set_media_id]] - Sets the identifier of the media this URL belongs to
 +
* [[truxton_url_get_method]] - Retrieves the [[URL Methods|method]] used to visit the URL
 +
* [[truxton_url_set_method]] - Sets the [[URL Methods|method]] used to visit the URL
 +
* [[truxton_url_get_type]] - Retrieves the [[URL Types|type]] of the URL
 +
* [[truxton_url_set_type]] - Sets the [[URL Types|type]] of the URL
 +
* [[truxton_url_get_url]] - Retrieves the URL that was visited
 +
* [[truxton_url_set_url]] - Sets the URL that was visited
 +
* [[truxton_url_get_url_offset]] - Retrieves the offset into the parent file where the URL was found
 +
* [[truxton_url_set_url_offset]] - Sets the offset into the parent file where the URL was found
 +
* [[truxton_url_get_when]] - Retrieves the date and time of when the URL was visited in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_url_set_when]] - Sets the date and time of when the URL was visited in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
 
 +
===Derived Objects===
 +
The following APIs are used to create objects with an event as their parent.
 +
* [[truxton_url_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
 +
* [[truxton_url_tag]] - Creates a tag and puts it on this location. This data will be saved to the <code>[Tagged]</code> table.
  
 
==USB Device==
 
==USB Device==
−
uint64_t truxton_usb_create(uint64_t truxton_handle);
+
* [[truxton_usb_create]] - Creates a new USB object
−
void    truxton_usb_destroy(uint64_t usb_handle);
+
* [[truxton_usb_destroy]] - Destroys an existing USB object
−
int      truxton_usb_save(uint64_t usb_handle);
+
* [[truxton_usb_save]] - Saves the information in the object to the <code><nowiki>[</nowiki>[[USBDevice Table|USBDevice]]<nowiki>]</nowiki></code> table
 +
* [[truxton_usb_get_device_id]] - Retrieves the identifier of the USB device as assigned by Windows
 +
* [[truxton_usb_set_device_id]] - Sets the identifier of the USB device as assigned by Windows
 +
* [[truxton_usb_get_device_type]] - Retrieves the type of the USB device
 +
* [[truxton_usb_set_device_type]] - Sets the type of the USB device
 +
* [[truxton_usb_get_file_id]] - Retrieves the identifier of the file this USB came from
 +
* [[truxton_usb_set_file_id]] - Sets the identifier of the file this USB came from
 +
* [[truxton_usb_get_id]] - Retrieves the identifier of the USB after it has been saved
 +
* [[truxton_usb_get_media_id]] - Retrieves the identifier of the media this USB belongs to
 +
* [[truxton_usb_set_media_id]] - Sets the identifier of the media this USB belongs to
 +
* [[truxton_usb_get_file_offset]] - Retrieves the offset into the parent file where the USB was found
 +
* [[truxton_usb_set_file_offset]] - Sets the offset into the parent file where the USB was found
 +
* [[truxton_usb_get_product_id]] - Retrieves the product identifier (PID) of the USB device
 +
* [[truxton_usb_set_product_id]] - Sets the product identifier (PID) of the USB device
 +
* [[truxton_usb_get_revision]] - Retrieves the revision number of the device
 +
* [[truxton_usb_set_revision]] - Sets the revision number of the device
 +
* [[truxton_usb_get_vendor_id]] - Retrieves the vendor identifier (VID) of the USB device
 +
* [[truxton_usb_set_vendor_id]] - Sets the vendor identifier (VID) of the USB device
 +
* [[truxton_usb_get_when]] - Retrieves the date and time of when the USB was seen in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_usb_set_when]] - Sets the date and time of when the USB was seen in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
  
−
void    truxton_usb_get_id(uint64_t usb_handle, char* buffer, size_t buffer_size);
+
===Derived Objects===
−
void    truxton_usb_get_file_id(uint64_t usb_handle, char* buffer, size_t buffer_size);
+
* [[truxton_usb_add_note]] - Creates an investigator's note. This data will be saved to the <code>[InvestigatorNote]</code> table.
−
void    truxton_usb_set_file_id(uint64_t usb_handle, char const* guid);
+
* [[truxton_usb_tag]] - Associate a tag with this USB device. This data will be saved to the <code>[Tagged]</code> table.
−
void    truxton_usb_get_media_id(uint64_t usb_handle, char* buffer, size_t buffer_size);
 
−
void    truxton_usb_set_media_id(uint64_t usb_handle, char const* guid);
 
−
void    truxton_usb_get_device_id(uint64_t usb_handle, char* buffer, size_t buffer_size);
 
−
void    truxton_usb_set_device_id(uint64_t usb_handle, char const* guid);
 
−
uint64_t truxton_usb_get_device_type(uint64_t usb_handle);
 
−
void    truxton_usb_set_device_type(uint64_t usb_handle, uint64_t value);
 
−
uint64_t truxton_usb_get_file_offset(uint64_t usb_handle);
 
−
void    truxton_usb_set_file_offset(uint64_t usb_handle, uint64_t value);
 
−
uint64_t truxton_usb_get_product_id(uint64_t usb_handle);
 
−
void    truxton_usb_set_product_id(uint64_t usb_handle, uint64_t value);
 
−
uint64_t truxton_usb_get_revision(uint64_t usb_handle);
 
−
void    truxton_usb_set_revision(uint64_t usb_handle, uint64_t value);
 
−
uint64_t truxton_usb_get_when(uint64_t usb_handle);
 
−
void    truxton_usb_set_when(uint64_t usb_handle, uint64_t value);
 
−
uint64_t truxton_usb_get_vendor_id(uint64_t usb_handle);
 
−
void    truxton_usb_set_vendor_id(uint64_t usb_handle, uint64_t value);
 
  
−
==Relation==
+
==Debugging==
−
uint64_t truxton_relation_create(uint64_t truxton_handle);
+
* [[truxton_dump_black_box]] - Dumps the [[Black Box|black box]] of the given process id
−
void    truxton_relation_destroy(uint64_t relation_handle);
+
* [[truxton_set_black_box_activity]] - Sets the activity taking place at a location in the [[Black Box|black box]]
−
int      truxton_relation_save(uint64_t relation_handle);
+
* [[truxton_set_black_box_source_code_location]] - Sets a location in the [[Black Box|black box]]
−
void    truxton_relation_get_a_id(uint64_t relation_handle, char* buffer, size_t buffer_size);
+
* [[truxton_set_black_box_thread_type]] - Sets type of the thread in the [[Black Box|black box]]
−
void    truxton_relation_set_a_id(uint64_t relation_handle, char const* guid);
+
* [[truxton_set_black_box_value]] - Sets a debugging value in the [[Black Box|black box]]
−
void    truxton_relation_get_b_id(uint64_t relation_handle, char* buffer, size_t buffer_size);
+
 
−
void    truxton_relation_set_b_id(uint64_t relation_handle, char const* guid);
+
=Samples=
−
void    truxton_relation_get_source_id(uint64_t relation_handle, char* buffer, size_t buffer_size);
+
* [[C One Time Setup|One time setup]] - Things that should be done before slinging code
−
void    truxton_relation_set_source_id(uint64_t relation_handle, char const* guid);
+
* [[C Sample Register a New File Type|Register a New File Type]] - Create your own type of file
−
uint64_t truxton_relation_get_a_type(uint64_t relation_handle);
+
* [[C Sample Identification ETL|ETL for File Identification]] - Identify new file types
−
void    truxton_relation_set_a_type(uint64_t relation_handle, uint64_t value);
+
* [[C Sample Exploitation ETL|ETL for File Exploitation]] - Exploit files
−
uint64_t truxton_relation_get_b_type(uint64_t relation_handle);
+
* [[C Sample Export Videos|Export Videos]] - Export only unique videos from Truxton
−
void    truxton_relation_set_b_type(uint64_t relation_handle, uint64_t value);
 
−
uint64_t truxton_relation_get_source_type(uint64_t relation_handle);
 
−
void    truxton_relation_set_source_type(uint64_t relation_handle, uint64_t value);
 
−
uint64_t truxton_relation_get_relation(uint64_t relation_handle);
 
−
void    truxton_relation_set_relation(uint64_t relation_handle, uint64_t value);
 

Latest revision as of 06:21, 20 February 2026

Truxton functionality is exposed to the C programming world as a DLL named TruxtonCAPI.dll in the C:\Program Files\Truxton\SDK folder. This DLL can be called from any programming language that has the ability to make operating system calls.

Philosophy

The API is considered to be "flat" in that only integers and ASCII character strings are used in the interface. This was chosen to make it easy for other languages to call the API. The coding convention is all lower case names with underscores separating words. Truxton is a member of the east const posse.

Preparing for Use

Truxton does not ship a linker library for TruxtonCAPI.dll in order to free the developer to use any particular compiler. If you want to link TruxtonCAPI.dll with your own C/C++ code, you will need to generate a linker library.

Alternatively, you can use a plugin pattern of calling LoadLibrary followed by many calls to GetProcAddress to get the function pointers. This is a lot of work and very prone to errors.

Generating a Linker Library for Microsoft Compilers

You can download a free Visual Studio from Microsoft. The steps to produce a LIB file from a DLL are:

  1. Generate a module definition (DEF) file from TruxtonCAPI.dll.
  2. Use the DEF file to create the linker library (LIB) file.

The following Powershell script will create the lib file for you. 

$msvc = "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x64\"
$dumpbin = $msvc + "dumpbin.exe"
$lib = $msvc + "lib.exe"

$lines = (& $dumpbin /exports "C:\Program Files\Truxton\SDK\TruxtonCAPI.dll")

Add-Content TruxtonCAPI.def "EXPORTS"

foreach ( $line in $lines )
{
   if ( $line.Contains(" = ") -EQ $true )
   {
      Add-Content TruxtonCAPI.def $line.SubString($line.IndexOf(" = ") + 3)
   }
}

(& $lib /def:TruxtonCAPI.def /out:TruxtonCAPI.lib /machine:x64)

Remove-Item TruxtonCAPI.def, TruxtonCAPI.exp

In your project folder, execute the script from Powershell to create TruxtonCAPI.lib: 

.\MakeDef.ps1

API Groups

The API is broken down into the different areas of Truxton.

Initialization

Functions

Maintenance

These functions are used to perform periodic maintenance tasks in Truxton. These will send messages to the maintenance ETL which will carry out the tasks.

Hash Sets

These functions handle the creation of hash set files

Database Identification

File Identification

Triage Loads

GUI Colors

Artifacts

Artifacts are pieces of information that are also known as entities.

Derived Objects

The following APIs are used to create objects with an artifact as their parent.

Artifact Type

This API is used to create custom types of artifacts. If one of the default artifact types don't suite your purpose, you are free to create your own.

BOLOs

These are the APIs used to create a be-on-the-lookout alert criteria.

Child Files

A child file is one that you have created and need to save in Truxton.

Derived Objects

Communications

These are the APIs that deal with humans communicating via email, SMS, chat, etc.

Derived Objects

Enumeration

This set of functions allow you to get things out of Truxton.

ETL Application Creation

Debugging

Event

If you need to save a significant place in time, use the following functions. The data structure these API encapsulate is similar to the one used in the event message. These will create a record in the [Event] table.

Derived Objects

The following APIs are used to create objects with an event as their parent.

  • truxton_event_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_event_tag - Creates a tag and puts it on this event. This data will be saved to the [Tagged] table.

Event Type

This API is used to create custom types of events. If one of the default event types don't suite your purpose, you are free to create your own.

EXIF (Camera Information)

This set if APIs deal with information from the EXIF section of files. The primary file types that contain EXIF are JPG and TIFF. Not all of the fields of this object are stored in the database. Internally, Truxton has one parser for EXIF and uses that information to perform other forensic tasks.

These functions give you access to a data structure equivalent to the one used in EXIF messages.

Persisted in Database

The following APIs deal with things that are stored in the database.

Not in Database

The following APIs are useful for forensic processing but not saved in the database. Internally, when Truxton finds EXIF data, it will create and populate an object with that information. All forensic processing is performed on that object. The information presented here, while not stored in the database, was used by Truxton to exploit the camera information data.

Derived Objects

  • truxton_exif_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_exif_tag - Creates a tag and puts it on this EXIF object. This data will be saved to the [Tagged] table.

File

File Actions

These are things your can do to a file. These are not data items stored in the database.

File IO

File Record Fields

Derived Objects

The following APIs are used to create objects with a file as their parent.

File Export

File Type

Group

A group is a collection of things scoped to an investigation and investigator. This is the technology behind marking things as Findings.

Investigation

Investigation Event

This set of API's allow you to add records to the [InvestigationEvent] table.

Jurisdiction

Jurisdictions is a way to keep track of work done on behalf of others. Say you're a regional forensics lab and your boss asks you, "How much work did we do for Mayberry last quarter?"

Geographic Location

Derived Objects

The following APIs are used to create objects with a location as their parent.

Media

These are the API's that allow you to add to the [Media] table in the database.

Derived Objects

The following APIs are used to create objects with a media as their parent.

Maintenance Functions

Message

This is the message sent on the message bus between the ETL processes.

Derived Objects

The following APIs are used to create objects from the given message.

Message Addresses

Message Participant

This is basically a useless API. It is used internally during the enumeration of the participants of a communication.

Options

Truxton "options" are otherwise known as configuration settings, command line options, etc. They are configuration items that your program can use.

Note

This set of API's allow you to add records to the [InvestigatorNote] table.

Relation

These functions let you add to the [Relation] table in Truxton. This is how to establish some sort of relationship between items in Truxton to create a graph. Relations in Truxton adhere to the form of "A is a thing of B" Truxton is not focused on exploring graphs (cliques anyone?) but needed a way to establish simple relationships between objects.

Sensitive Site List

These are the API's that allow you to manipulate a sensitive site list for Truxton. These will add records to the [SensitiveSiteList] and [SensitiveSite] tables.

Subject

These are the API's that allow you to add an investigative subject to Truxton. These will add records to the [Suspect] table.

Derived Objects

The following APIs are used to create objects with a subject as their parent.

  • truxton_subject_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_subject_tag - Associating a tag with this subject. This data will be saved to the [Tagged] table.

Types

Truxton has many different types in it. They are generally integer values that have meanings. Here's how to get a list of them.

URL

These functions encapsulate a data structure similar to the one used in the Website Visit message.

Derived Objects

The following APIs are used to create objects with an event as their parent.

  • truxton_url_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_url_tag - Creates a tag and puts it on this location. This data will be saved to the [Tagged] table.

USB Device

Derived Objects

  • truxton_usb_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_usb_tag - Associate a tag with this USB device. This data will be saved to the [Tagged] table.

Debugging

Samples

Retrieved from "https://truxwiki.com/index.php?title=Truxton_C_API&oldid=10807"