TruxtonChildFileIO

This class provides a writable file to add to Truxton.

IOBase Methods

From IOBase it implements:

• close()
• closed
• fileno() - Will return ERROR
• flush()
• isatty()
• readable() - Always returns FALSE
• readline() - Do not use, will return ERROR
• readlines() - Do not use, will return ERROR
• seek() - Will return ERROR
• seekable() - returns FALSE
• tell()
• truncate()
• writable() - returns TRUE
• writelines()

RawIOBase Methods

From RawIOBase it implements:

• read()
• readall()
• readinto()
• write()

Truxton Methods

The above methods will let you read from a file in Truxton as if it were any other file in Python. The following methods are also present to make tasks of adding items extracted from a file easier.

• newartifact()
• newchild()
• newevent()
• newexif()
• newlocation()
• newrelation()
• newurl()
• newusb()
• tag()

Properties

accessed

When the file was last accessed in FILETIME ticks.

created

When the file was created in FILETIME ticks.

id

The GUID of the file record. This is valid once save()

mediaid

The GUID of the media the child file came from.

parentid

The GUID of the parent of this file.

modified

When the file was last written in FILETIME ticks.

name

The name of the file.

attributes

The attributes of the file.

size

The size, in bytes, of the file.

origin

Where the file came from. It should be one of the origin values.

status

The status of the contents of the file. It should be one of the content status values.

type

The type of the file.

hash

The MD5 hash of the contents of the file.

entropy

Shannon's entropy of the contents of the file.

diskoffset

The offset, in bytes, of the first byte of the contents of the file on the physical disk.

Sample

This will retrieve a file from Truxton, print the name and hash as stored in the database then calculate a hash on the contents and print that.

import truxton
import shutil
from pathlib import Path

def add_file(parent_truxton_file, filename):
  source_file = open(filename, "rb")
  child = parent_truxton_file.newchild()
  child.name = Path(filename).name
  shutil.copyfileobj(source_file, child)
  source_file.close()
  child.save()
  return child

def main():
  t = truxton.create()
  file = t.getfileid("5ec2a123-74d6-5da7-0653-4e6800000000")
  child = add_file(file, "C:\decrypts\PlainText.txt")

if __name__ == "__main__":
  main()