TruxtonEXIF

This class lets you add to the [EXIF] table in Truxton. Truxton will store any information about an imaging device it can find in this table. This information may not come from Exif sections of the exploited file. If the same information is embedded using a different format, the fields of the [EXIF] table will still be filled with that data. Just because there's a record in the [EXIF] doesn't mean that data came from an Exif blob.

Attributes and Methods

altitude

The altitude in meters.

altitudeoffset

The offset into the file where the altitude was found.

bodyserialnumber

The serial number of the body of the imaging device.

bodyserialnumberoffset

The offset into the file where the body serial number was found

devicetime

The timestamp of the image taken from the clock of the imaging device in FILETIME ticks.

devicetimeoffset

The offset into the file where the device time was found.

fileid

The GUID of the file this camera information came from. This corresponds to the [FileID] column of the [EXIF] table.

focallength

The focal length of the lens in 35mm equivalent.

focallengthoffset

The offset in the file where focal length was found.

gpstime

The timestamp from a GPS unit in the imaging device in FILETIME ticks.

gpstimeoffset

The offset in the file where the GPS time was found.

heading

The compass heading of the image. The direction the camera was pointing when the image was taken.

headingoffset

The offset into the file where the heading was found.

id

This is the GUID of the record. It becomes non-zero after save() has been called. This corresponds to the [ID] column of the [EXIF] table.

latitude

The latitude portion of the geographic coordinate using the WGS84 ellipsoid.

latitudeoffset

The offset into the file where the latitude was found.

lensserialnumber

The serial number of the lens.

lensserialnumberoffset

The offset into the file where the lens serial number was found.

longitude

The longitude portion of the geographic coordinate using the WGS84 ellipsoid. Many thanks go to John Harrison for his work.

longitudeoffset

The offset into the file where longitude was found.

make

The manufacturer of the imaging device.

makeoffset

The offset into the file where the make was found.

mediaid

This is the GUID of the media this artifact came from. This corresponds to the [MediaID] column of the [EXIF] table.

model

The model of the imaging device.

modeloffset

The offset into the file where the model was found.

save()

This will commit the information to the [EXIF] table. It will return True if the record was saved to the database, False if there was an error.

shuttercount

The number of times the shutter has been activated on the imaging device.

shuttercountoffset

The offset into the file where shutter count was found.

tag(tag, reason, origin)

This creates a tag associated with this camera information in Truxton. The tag parameter is a short, one or two word, bit of text that will be displayed in the UI. The reason a sentence explaining why this camera information was tagged. The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2). It will return True if the tag was associated with the camera information, False on failure.

thumbnaillength

The length of the thumbnail of this image.

thumbnaillengthoffset

The offset in the file where the length of the thumbnail image was found.

thumbnailoffset

The offset of the thumbnail image.

thumbnailoffsetoffset

The offset in the file where thumbnail offset was found.

Sample

import truxton
import shutil

from datetime import datetime
from calendar import timegm
from pathlib import Path

EPOCH_AS_FILETIME = 116444736000000000
HUNDREDS_OF_NANOSECONDS = 10000000

def date_to_filetime(dt):
  return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)

def add_file(parent_truxton_file, filename):
  source_file = open(filename, "rb")
  child = parent_truxton_file.newchild()
  child.name = Path(filename).name
  shutil.copyfileobj(source_file, child)
  source_file.close()
  child.save()
  return child

def add_media(t):
  media = t.newmedia()

  media.name = "Public Documents"
  media.description = "Publicly available documents"
  media.case = "DC-SNAFU-2016.2020"
  media.evidencebag = "EV-0937459386623-a"
  media.originator = "Jeffrey Jensen"
  media.latitude = 38.897661
  media.longitude = -77.036458
  media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
  media.save()

  return media

def add_cs(parent_file ):
  child_file = add_file(parent_file, "cs.jpg")

  exif = child_file.newexif()
  exif.latitude = 51.487329
  exif.longitude = -0.124057
  exif.make = "Universal"
  exif.model = "Minute 16"
  exif.devicetime = date_to_filetime(datetime.fromisoformat("2016-04-01T12:00:00-05:00"))
  exif.save()

def main():
  t = truxton.create()

  media = add_media(t)

  root_file = media.addroot()
  root_file.save()

  add_cs(root_file)

if __name__ == "__main__":
  main()