Difference between revisions of "Truxton file export add criteria"

From truxwiki.com
Jump to navigation Jump to search
(Created page with "This gives you the ability to specify criteria for selecting files to export from Truxton. =Syntax= <source lang="C"> void truxton_file_export_add_criteria(uint64_t export_ha...")
 
 
(5 intermediate revisions by the same user not shown)
Line 3: Line 3:
 
=Syntax=
 
=Syntax=
 
<source lang="C">
 
<source lang="C">
−
void truxton_file_export_add_criteria(uint64_t export_handle, uint64_t field, char const * value);
+
void truxton_file_export_add_criteria( uint64_t export_handle, uint64_t field, char const * value );
 
</source>
 
</source>
  
Line 15: Line 15:
 
==<code>value</code>==
 
==<code>value</code>==
 
The string representation of the field criteria.
 
The string representation of the field criteria.
 +
 +
=Criteria Fields=
 +
The following are the possible criteria to set.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE</code>==
 +
The length of the file to export.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MINIMUM</code>==
 +
The minimum number of bytes in the file to export.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MAXIMUM</code>==
 +
The maximum number of bytes in the file to export.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_HASH</code>==
 +
The hash or partial hash of the file to export.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_TYPE</code>==
 +
The type of file to export.
 +
You can specify a comma separated list of file types if you want to export more than a single type.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_PARENT_ID</code>==
 +
The identifier of the parent of the files to export.
 +
This is useful for exporting the files in a folder in the seized media.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_ID</code>==
 +
The identifier of the file.
 +
You can specify a comma separated list of identifiers if you want to export more than a single file.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_MEDIA</code>==
 +
The identifier of the media the exported files belong to.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_LIMIT</code>==
 +
Sets the maximum number of files to export.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_FILE_GROUP</code>==
 +
The file group to export.
 +
You can specify a comma separated list of file groups if you want to export more than a single type.
 +
 +
==<code>TRUXTON_EXPORT_FILE_QUERY_FIELD_ORIGIN</code>==
 +
Allows you to limit the output to just files of a particular [[Origin|origin.]]
  
 
=Sample=
 
=Sample=
−
<source lang="C" line highlight="20,23,26,29,32">
+
<source lang="C" highlight="20,23,26,29,32,35">
 
#include "TruxtonCAPI.h"
 
#include "TruxtonCAPI.h"
 
#pragma comment(lib, "TruxtonCAPI.lib")
 
#pragma comment(lib, "TruxtonCAPI.lib")
Line 25: Line 65:
 
#pragma hdrstop
 
#pragma hdrstop
  
−
int main()
+
void main( void )
 
{
 
{
 
     char temporary_string[256];
 
     char temporary_string[256];
Line 33: Line 73:
 
     uint64_t truxton = truxton_create();
 
     uint64_t truxton = truxton_create();
  
−
     uint64_t export_handle = truxton_file_export_create(truxton);
+
     uint64_t export_handle = truxton_file_export_create( truxton );
  
 
     // We want a variety of file types
 
     // We want a variety of file types
−
     sprintf_s(temporary_string, sizeof(temporary_string), "%d, %d, %d", Type_JPEGWithExif, Type_JPEG, Type_GIF);
+
     sprintf_s( temporary_string, sizeof(temporary_string), "%d, %d, %d", Type_JPEGWithExif, Type_JPEG, Type_GIF );
−
     truxton_file_export_add_criteria(export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_TYPE, temp_string);
+
     truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_TYPE, temp_string );
  
 
     // We only want files where the MD5 hash starts with "e4"
 
     // We only want files where the MD5 hash starts with "e4"
−
     truxton_file_export_add_criteria(export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_HASH, "e4");
+
     truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_HASH, "e4" );
  
 
     // We want a file that is at least 4MB long
 
     // We want a file that is at least 4MB long
−
     truxton_file_export_add_criteria(export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MINIMUM, "4194304");
+
     truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MINIMUM, "4194304" );
  
 
     // We want a file that is no larger than 5MB
 
     // We want a file that is no larger than 5MB
−
     truxton_file_export_add_criteria(export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MAXIMUM, "5242880");
+
     truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MAXIMUM, "5242880" );
 +
 
 +
    // Limit the output to a hundred file
 +
    truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_LIMIT, "001" );
  
−
     // Limit the output to a single file
+
     // We only want carved files
−
     truxton_file_export_add_criteria(export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_LIMIT, "1");
+
     truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_ORIGIN, "3" );
  
−
     truxton_file_export_where_clause(export_handle, temporary_string, sizeof(temporary_string));
+
     truxton_file_export_where_clause( export_handle, temporary_string, sizeof(temporary_string) );
−
     printf( "Will use the following WHERE clause to select files: %s\n", temporary_string);
+
     printf( "Will use the following WHERE clause to select files: %s\n", temporary_string );
  
 
     // Rename the file being exported to include the hash before the original name
 
     // Rename the file being exported to include the hash before the original name
−
     truxton_file_export_set_option(export_handle, TRUXTON_EXPORT_FILE_OPTION_NAME_FORMAT, "{hash}_{name}");
+
     truxton_file_export_set_option( export_handle, TRUXTON_EXPORT_FILE_OPTION_NAME_FORMAT, "{hash}_{name}" );
  
 
     // The files should be output to a particular folder
 
     // The files should be output to a particular folder
−
     truxton_file_export_set_option(export_handle, TRUXTON_EXPORT_FILE_OPTION_FOLDER, "C:\\temp");
+
     truxton_file_export_set_option( export_handle, TRUXTON_EXPORT_FILE_OPTION_FOLDER, "C:\\temp" );
  
 
     // We want them output to a TAR file in that particular folder
 
     // We want them output to a TAR file in that particular folder
−
     truxton_file_export_set_option(export_handle, TRUXTON_EXPORT_FILE_OPTION_TAR, "JPGWithExif.tar");
+
     truxton_file_export_set_option( export_handle, TRUXTON_EXPORT_FILE_OPTION_TAR, "CarvedGraphics.tar" );
  
−
     // Go find the files and output them to C:\temp\JPGWithExif.tar
+
     // Go find the files and output them to C:\temp\CarvedGraphics.tar
−
     truxton_file_export_execute(export_handle);
+
     truxton_file_export_execute( export_handle );
  
 
     // Clean up
 
     // Clean up
−
     truxton_file_export_destroy(export_handle);
+
     truxton_file_export_destroy( export_handle );
−
     truxton_destroy(truxton);
+
     truxton_destroy( truxton );
 
     truxton_stop();
 
     truxton_stop();
 
}
 
}
 
</source>
 
</source>

Latest revision as of 10:58, 3 February 2024

This gives you the ability to specify criteria for selecting files to export from Truxton.

Syntax

void truxton_file_export_add_criteria( uint64_t export_handle, uint64_t field, char const * value );

Parameters

export_handle

The handle to an export instance created by the truxton_file_export_create() call.

field

Which criteria to set.

value

The string representation of the field criteria.

Criteria Fields

The following are the possible criteria to set.

TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE

The length of the file to export.

TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MINIMUM

The minimum number of bytes in the file to export.

TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MAXIMUM

The maximum number of bytes in the file to export.

TRUXTON_EXPORT_FILE_QUERY_FIELD_HASH

The hash or partial hash of the file to export.

TRUXTON_EXPORT_FILE_QUERY_FIELD_TYPE

The type of file to export. You can specify a comma separated list of file types if you want to export more than a single type.

TRUXTON_EXPORT_FILE_QUERY_FIELD_PARENT_ID

The identifier of the parent of the files to export. This is useful for exporting the files in a folder in the seized media.

TRUXTON_EXPORT_FILE_QUERY_FIELD_ID

The identifier of the file. You can specify a comma separated list of identifiers if you want to export more than a single file.

TRUXTON_EXPORT_FILE_QUERY_FIELD_MEDIA

The identifier of the media the exported files belong to.

TRUXTON_EXPORT_FILE_QUERY_FIELD_LIMIT

Sets the maximum number of files to export.

TRUXTON_EXPORT_FILE_QUERY_FIELD_FILE_GROUP

The file group to export. You can specify a comma separated list of file groups if you want to export more than a single type.

TRUXTON_EXPORT_FILE_QUERY_FIELD_ORIGIN

Allows you to limit the output to just files of a particular origin.

Sample

#include "TruxtonCAPI.h"
#pragma comment(lib, "TruxtonCAPI.lib")

#include "filetypes.h"
#include <stdlib.h>
#pragma hdrstop

void main( void )
{
    char temporary_string[256];

    truxton_start();

    uint64_t truxton = truxton_create();

    uint64_t export_handle = truxton_file_export_create( truxton );

    // We want a variety of file types
    sprintf_s( temporary_string, sizeof(temporary_string), "%d, %d, %d", Type_JPEGWithExif, Type_JPEG, Type_GIF );
    truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_TYPE, temp_string );

    // We only want files where the MD5 hash starts with "e4"
    truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_HASH, "e4" );

    // We want a file that is at least 4MB long
    truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MINIMUM, "4194304" );

    // We want a file that is no larger than 5MB
    truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MAXIMUM, "5242880" );

    // Limit the output to a hundred file
    truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_LIMIT, "001" );

    // We only want carved files
    truxton_file_export_add_criteria( export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_ORIGIN, "3" );

    truxton_file_export_where_clause( export_handle, temporary_string, sizeof(temporary_string) );
    printf( "Will use the following WHERE clause to select files: %s\n", temporary_string );

    // Rename the file being exported to include the hash before the original name
    truxton_file_export_set_option( export_handle, TRUXTON_EXPORT_FILE_OPTION_NAME_FORMAT, "{hash}_{name}" );

    // The files should be output to a particular folder
    truxton_file_export_set_option( export_handle, TRUXTON_EXPORT_FILE_OPTION_FOLDER, "C:\\temp" );

    // We want them output to a TAR file in that particular folder
    truxton_file_export_set_option( export_handle, TRUXTON_EXPORT_FILE_OPTION_TAR, "CarvedGraphics.tar" );

    // Go find the files and output them to C:\temp\CarvedGraphics.tar
    truxton_file_export_execute( export_handle );

    // Clean up
    truxton_file_export_destroy( export_handle );
    truxton_destroy( truxton );
    truxton_stop();
}
Retrieved from "https://truxwiki.com/index.php?title=Truxton_file_export_add_criteria&oldid=7249"