Difference between revisions of "Truxton event set media id"

From truxwiki.com
Jump to navigation Jump to search
 
(4 intermediate revisions by the same user not shown)
Line 15: Line 15:
  
 
=Remarks=
 
=Remarks=
−
This identifier should be a value from the <code>[ID]</code> column of the <code>[Media]</code> table in the database.
+
This identifier should be a value from the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table in the database.
  
 
=Sample=
 
=Sample=
−
<source lang="C" highlight="8">
+
<source lang="C" highlight="10">
−
void dump_event(uint64_t event_handle)
+
void initialize_investigation( uint64_t truxton, char const * media_id, char const * file_id )
 
{
 
{
−
   char guid_string[ 40 ];
+
   uint64_t event_handle = truxton_event_create( truxton );
  
−
   truxton_event_get_file_id( event_handle, guid_string, sizeof(guid_string) );
+
   truxton_event_set_title( event_handle, "Phase 1" );
−
   printf( "File ID is %s\n", guid_string );
+
  truxton_event_set_description( event_handle, "As described by SA Barnett" );
 +
  truxton_event_set_start( event_handle, get_ticks( "2016-07-31T12:00:00-05:00" ) );
 +
   truxton_event_set_end( event_handle, get_ticks( "2017-01-04T12:00:00-05:00" ) );
 +
  truxton_event_set_type( event_handle, EVENT_TYPE_ADDED_BY_ANALYST );
 +
  truxton_event_set_media_id( event_handle, media_id );
 +
  truxton_event_set_file_id( event_handle, file_id );
  
−
   truxton_event_get_media_id( event_handle, guid_string, sizeof(guid_string) );
+
   truxton_event_save( event_handle );
−
  printf( "Media ID is %s\n", guid_string );
 
  
−
   truxton_event_get_id( event_handle, guid_string, sizeof(guid_string) );
+
   char id[ 65 ];
−
  printf( "Event ID is %s\n", guid_string );
 
  
−
   uint64_t value = truxton_event_get_type( event_handle );
+
   truxton_event_get_id( event_handle, id, sizeof( id ) );
−
  printf( "Type is %" PRIu64 "\n", value );
 
  
−
  value = truxton_event_get_start( event_handle );
+
   printf( "Event ID is %s\n", id );
−
   printf( "Start is %" PRIu64 "\n", value );
 
  
−
   value = truxton_event_get_end( event_handle );
+
   truxton_event_destroy( event_handle );
−
  printf( "End is %" PRIu64 "\n", value );
 
 
}
 
}
 
</source>
 
</source>

Latest revision as of 07:51, 3 February 2024

This sets the source media of the event.

Syntax

void truxton_event_set_media_id( uint64_t event_handle, char const * id );

Parameters

event_handle

The handle to an event created by the truxton_event_create call.

id

The string representation of a GUID. It corresponds to the [MediaID] column of the [Event] table.

Remarks

This identifier should be a value from the [ID] column of the [Media] table in the database.

Sample

void initialize_investigation( uint64_t truxton, char const * media_id, char const * file_id )
{
   uint64_t event_handle = truxton_event_create( truxton );

   truxton_event_set_title( event_handle, "Phase 1" );
   truxton_event_set_description( event_handle, "As described by SA Barnett" );
   truxton_event_set_start( event_handle, get_ticks( "2016-07-31T12:00:00-05:00" ) );
   truxton_event_set_end( event_handle, get_ticks( "2017-01-04T12:00:00-05:00" ) );
   truxton_event_set_type( event_handle, EVENT_TYPE_ADDED_BY_ANALYST );
   truxton_event_set_media_id( event_handle, media_id );
   truxton_event_set_file_id( event_handle, file_id );

   truxton_event_save( event_handle );

   char id[ 65 ];

   truxton_event_get_id( event_handle, id, sizeof( id ) );

   printf( "Event ID is %s\n", id );

   truxton_event_destroy( event_handle );
}
Retrieved from "https://truxwiki.com/index.php?title=Truxton_event_set_media_id&oldid=7175"