Difference between revisions of "TruxtonEvent"
(→end) |
|||
| Line 10: | Line 10: | ||
==<code>end</code>== | ==<code>end</code>== | ||
When the event ended in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | When the event ended in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | ||
| − | + | This corresponds to the <code>End</code> column of the <code>Event</code> table. | |
| − | |||
| − | |||
==<code>fileid</code>== | ==<code>fileid</code>== | ||
| − | + | The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this event came from. | |
| − | This | + | This corresponds to the <code>FileID</code> column of the <code>Event</code> table. |
==<code>mediaid</code>== | ==<code>mediaid</code>== | ||
| − | This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the event. | + | This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this event came from. |
| − | This identifier corresponds to the <code>MediaID</code> of the <code> | + | This identifier corresponds to the <code>MediaID</code> of the <code>Event</code> table. |
==<code>save()</code>== | ==<code>save()</code>== | ||
| Line 32: | Line 30: | ||
It will return | It will return | ||
[https://docs.python.org/3.8/library/constants.html?highlight=false#True True] if the tag was associated with the file, [https://docs.python.org/3.8/library/constants.html?highlight=false#False False] on failure. | [https://docs.python.org/3.8/library/constants.html?highlight=false#True True] if the tag was associated with the file, [https://docs.python.org/3.8/library/constants.html?highlight=false#False False] on failure. | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
==<code>start</code>== | ==<code>start</code>== | ||
| + | When the event began in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | ||
| + | This corresponds to the <code>Start</code> column of the <code>Event</code> table. | ||
==<code>title</code>== | ==<code>title</code>== | ||
| + | This corresponds to the <code>Title</code> column of the <code>Event</code> table. | ||
==<code>type</code>== | ==<code>type</code>== | ||
| + | This corresponds to the <code>EventTypeID</code> column of the <code>Event</code> table. | ||
| + | It should contain a value from the <code>ID</code> column of the <code>EventType</code> table. | ||
=Sample= | =Sample= | ||
Revision as of 06:15, 28 May 2020
This class lets you add to the Event table in Truxton.
Contents
Attributes and Methods
id
This is the GUID of the event.
It becomes non-zero after save() has been called.
description
The longer description of the event.
end
When the event ended in FILETIME ticks.
This corresponds to the End column of the Event table.
fileid
The GUID of the file this event came from.
This corresponds to the FileID column of the Event table.
mediaid
This is the GUID of the media this event came from.
This identifier corresponds to the MediaID of the Event table.
save()
This will commit the information to the Event table.
tag(tag, reason, origin)
This creates a tag associated with this event in Truxton.
The tag parameter is a short, one or two word, bit of text that will be displayed in the UI.
The reason a sentence explaining why this event was tagged.
The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2).
It will return
True if the tag was associated with the file, False on failure.
start
When the event began in FILETIME ticks.
This corresponds to the Start column of the Event table.
title
This corresponds to the Title column of the Event table.
type
This corresponds to the EventTypeID column of the Event table.
It should contain a value from the ID column of the EventType table.
Sample
1 import truxton
2
3 def main():
4 etl = truxton.etl()
5 etl.name = "My New ETL"
6 etl.description = "This ETL processes files in the Truxton system"
7 etl.queue = "anewetl"
8 etl.stage = 40
9 etl.expanderid = 0x05fc0bf6a57726a0
10 etl.version = 0
11 etl.depot = "thumbnail"
12 etl.depotype = truxton.DEPOT_TYPE_THUMBNAILS
13 etl.poly = 0
14
15 etl.addarg("--verbose")
16 etl.addarg("Yes")
17
18 etl.sendmefileid("5ecbebc4-9937-2b88-f691-91a800000024")
19 etl.sendmehash("baa51f0cc8361660df911e06e7637485")
20 etl.sendmefiles(truxton.Type_JPEGWithExif, 100)
21 etl.sendmefiles(truxton.Type_TIFFWithExif, 500)
22 etl.sendmelocalfile( "C:/Test Files/Video/Fragmented/Recovered Video.mp4", truxton.Type_MPEG4Video, 0 )
23
24 message = etl.getmessage()
25
26 while message is not None:
27 file_in_truxton = message.file()
28
29 # YOUR FORENSIC CODE GOES HERE
30
31 line_of_text = file_in_truxton.readline()
32
33 if "[SetupAPI" in line_of_text:
34 child = file_in_truxton.newchild()
35 child.name = "Child file from New ETL"
36 child.write("This is the file you were looking for.")
37 child.save()
38
39 if __name__ == "__main__":
40 main()
