Difference between revisions of "TruxtonChildFileIO"
(→Sample) |
|||
| (2 intermediate revisions by the same user not shown) | |||
| Line 45: | Line 45: | ||
=Properties= | =Properties= | ||
| − | ==<code>accessed: | + | ==<code>accessed: [https://docs.python.org/3/library/datetime.html datetime]</code>== |
| − | When the file was last accessed | + | When the file was last accessed. |
| + | This value can be set with either a datetime value or an integer representing [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | ||
==<code>attributes: int</code>== | ==<code>attributes: int</code>== | ||
| Line 52: | Line 53: | ||
For a Microsoft filesystem, it can be a combination of the [https://docs.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants file attribute flags.] | For a Microsoft filesystem, it can be a combination of the [https://docs.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants file attribute flags.] | ||
| − | ==<code>created: | + | ==<code>created: [https://docs.python.org/3/library/datetime.html datetime]</code>== |
| − | When the file was created | + | When the file was created. |
| + | This value can be set with either a datetime value or an integer representing [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | ||
==<code>diskoffset: int</code>== | ==<code>diskoffset: int</code>== | ||
| Line 71: | Line 73: | ||
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media the child file came from. | The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media the child file came from. | ||
| − | ==<code>modified: | + | ==<code>modified: [https://docs.python.org/3/library/datetime.html datetime]</code>== |
| − | When the file was last written | + | When the file was last written. |
| + | This value can be set with either a datetime value or an integer representing [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | ||
==<code>name: str</code>== | ==<code>name: str</code>== | ||
| Line 108: | Line 111: | ||
def add_file(parent_truxton_file, filename): | def add_file(parent_truxton_file, filename): | ||
| − | |||
child = parent_truxton_file.newchild() | child = parent_truxton_file.newchild() | ||
| − | child.name = Path(filename).name | + | with open(filename, "rb") as source_file: |
| − | + | child.name = Path(filename).name | |
| − | + | shutil.copyfileobj(source_file, child) | |
child.save() | child.save() | ||
return child | return child | ||
| Line 118: | Line 120: | ||
def main(): | def main(): | ||
t = truxton.create() | t = truxton.create() | ||
| − | + | with t.getfileid("66e0fd95-aafe-b0a4-dade-fde000000065") as file: | |
| − | + | child = add_file(file, "C:/decrypts/PlainText.txt") | |
if __name__ == "__main__": | if __name__ == "__main__": | ||
| − | main() | + | sys.exit(main()) |
</source> | </source> | ||
Latest revision as of 14:10, 11 September 2024
This class provides a writable file to add to Truxton.
IOBase Methods
From IOBase it implements:
- close() - Flush and close this stream
- closed - True if the stream is closed
- fileno() - Truxton will return ERROR
- flush() - Flush the write buffers of the stream if applicable
- isatty() - Return True if the stream is interactive
- readable() - Truxton always returns False
- readline() - Do not use, will return ERROR
- readlines() - Do not use, will return ERROR
- seek() - Truxton will return ERROR
- seekable() - Truxton always returns False
- tell() - Return the current stream position
- truncate() - Resize the stream
- writable() - Truxton always returns True
- writelines() - Write a list of lines to the stream
RawIOBase Methods
From RawIOBase it implements:
Truxton Methods
The above methods will let you read from a file in Truxton as if it were any other file in Python. The following methods are also present to make tasks of adding items extracted from a file easier.
- addnote()
- newartifact()
- newchild()
- newcommunication()
- newevent()
- newexif()
- newlocation()
- newrelation()
- newurl()
- newusb()
- tag()
Properties
accessed: datetime
When the file was last accessed. This value can be set with either a datetime value or an integer representing FILETIME ticks.
attributes: int
An integer value representing the attributes of the file. For a Microsoft filesystem, it can be a combination of the file attribute flags.
created: datetime
When the file was created. This value can be set with either a datetime value or an integer representing FILETIME ticks.
diskoffset: int
The offset, in bytes, of the first byte of the contents of the file on the physical disk.
entropy: float
Shannon's entropy of the contents of the file.
hash: str
The MD5 hash of the contents of the file.
id: str
The GUID of the file record.
This is valid once save() has been called.
mediaid: str
The GUID of the media the child file came from.
modified: datetime
When the file was last written. This value can be set with either a datetime value or an integer representing FILETIME ticks.
name: str
The name of the file.
origin: int
Where the file came from. It should be one of the origin values.
parentid: str
The GUID of the parent of this file.
save() -> true
This will commit the information to the [File] table.
It will return True if the record was saved to the database, False if there was an error.
size: int
The size, in bytes, of the file.
status: int
The status of the contents of the file. It should be one of the content status values.
type: int
The type of the file.
Sample
This will retrieve a file from Truxton, print the name and hash as stored in the database then calculate a hash on the contents and print that.
import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton
import shutil
from pathlib import Path
def add_file(parent_truxton_file, filename):
child = parent_truxton_file.newchild()
with open(filename, "rb") as source_file:
child.name = Path(filename).name
shutil.copyfileobj(source_file, child)
child.save()
return child
def main():
t = truxton.create()
with t.getfileid("66e0fd95-aafe-b0a4-dade-fde000000065") as file:
child = add_file(file, "C:/decrypts/PlainText.txt")
if __name__ == "__main__":
sys.exit(main())
