Python

Truxton supports Python 3.8 via the Truxton.pyd library.

Overview

You must use the "import" directive to load the Truxton Python provider in truxton.pyd. This directive will search a variety of folders for the pyd file for Truxton (truxton.pyd). Normally, the truxton.pyd file is installed in the SDK folder (C:\Program Files\Truxton\SDK). You can modify the PYTHONPATH environment variable. Doing so will allow you to simply put:

import truxton

At the top of your Python scripts.

When you import truxton you will get all of the predefined constants for file type, data type, origins, locations, messages, entities, relations, events, media, objects, url methods, and urls. You can see them all by issuing a dir command.

>>> dir(truxton)

This will allow your Python code to use the same constant names as C, C++ and C# code.

>>> print(truxton.Type_JPEG)
203

Once you have this working, you can start playing with Truxton.

import truxton

def main():
  t = truxton.create()
  print(t.version)

if __name__ == "__main__":
  main()

You can create a folder for your project, copy the SDK contents into it and work from there.

Style

In general, when using a Truxton Python object, you will follow this pattern:

1. Create the object
2. Set the data members of the object
3. Call save() to store the object in the Truxton database.

Until you call save(), nothing will appear in Truxton.

Classes

Truxton exposes several classes to Python.

• Truxton - The top level object.
• TruxtonArtifact - For adding records to the [Entity] table.
• TruxtonChildFileIO - For writing a file to Truxton.
• TruxtonCommunication - For adding email, sms, mms, etc. communications to Truxton.
• TruxtonETL - For becoming a Truxton ETL process.
• TruxtonEvent - For adding records to the [Event] table.
• TruxtonEventType - For adding custom event types to Truxton. This will make an entry in the [EventType] table.
• TruxtonExport - For exporting files out of Truxton.
• TruxtonEXIF - For adding records to the [EXIF] table.
• TruxtonFileIO - For working with a read-only file stored in Truxton.
• TruxtonFileType - For adding new file types to Truxton. This will make an entry in the [FileType] table.
• TruxtonInvestigation - For creating new investigations in Truxton. This will make an entry in the [Investigation] table.
• TruxtonJurisdiction - For creating new jurisdictions in Truxton. This will make an entry in the [Jurisdiction] table.
• TruxtonLocation - For adding geographic coordinates to the [Location] table.
• TruxtonMedia - For adding media to Truxton. This will make an entry in the [Media] table.
• TruxtonMessage - The way Truxton ETL processes communicate.
• TruxtonObject - The object responsible for a connection to Truxton.
• TruxtonOptions - The object responsible for retrieving configuration variables from Truxton's Configuration System.
• TruxtonRelation - For adding records to the [Relation] table for relating two items in Truxton.
• TruxtonSubject - For adding subjects of investigations, aka persons of interest, aka suspects. This will make an entry in the [Suspect] table.
• TruxtonUrl - For adding records to the [WebsiteVisit] table.
• TruxtonUSB - For adding records to the [USBDevice] table.

Remarks

The Python API is designed primarily for programs to contribute to Truxton.

Truxton.pyd was developed using the C API with a thin adapter layer of code to translate from Python provider semantics to Truxton calls.

Samples

• Register a New File Type
• ETL for File Identification
• ETL for File Exploitation