Difference between revisions of "Python Sample Triage File"
Jump to navigation
Jump to search
| (One intermediate revision by the same user not shown) | |||
| Line 5: | Line 5: | ||
This will add records to the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table. | This will add records to the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table. | ||
It allows you to specify the files and folders where evidence may be found. | It allows you to specify the files and folders where evidence may be found. | ||
| + | |||
| + | The first argument to <code>addtriafefile</code> can be one of the following: | ||
| + | {| class="wikitable" | ||
| + | ! Value | ||
| + | ! Meaning | ||
| + | |- | ||
| + | | style="text-align:center;" | 1 | ||
| + | | The <code>name</code> is the name of a file | ||
| + | |- | ||
| + | | style="text-align:center;" | 2 | ||
| + | | The <code>name</code> is the name of a folder | ||
| + | |- | ||
| + | | style="text-align:center;" | 5 | ||
| + | | The <code>name</code> is [https://en.wikipedia.org/wiki/Regular_expression regular expression] pattern for a file | ||
| + | |- | ||
| + | | style="text-align:center;" | 6 | ||
| + | | The <code>name</code> is [https://en.wikipedia.org/wiki/Regular_expression regular expression] pattern for a folder | ||
| + | |} | ||
| + | |||
<source lang="python"> | <source lang="python"> | ||
| Line 11: | Line 30: | ||
import truxton | import truxton | ||
| − | def main(): | + | def main() -> None: |
t = truxton.create() | t = truxton.create() | ||
Latest revision as of 16:24, 10 December 2024
This sample shows how to add files and folders to be included in a Triage load. You can also see how to do this in C.
Add to a Triage Load
This will add records to the [TriageFile] table.
It allows you to specify the files and folders where evidence may be found.
The first argument to addtriafefile can be one of the following:
| Value | Meaning |
|---|---|
| 1 | The name is the name of a file
|
| 2 | The name is the name of a folder
|
| 5 | The name is regular expression pattern for a file
|
| 6 | The name is regular expression pattern for a folder
|
import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton
def main() -> None:
t = truxton.create()
t.addtriagefile( 1, "bluetooth_device_map.xml", "Phonebook Access Permissions", "This is a source of MAC addresses" );
t.addtriagefile( 2, "MySecrets", "MySecrets application data folder", "Things the user wants to be hidden" );
t.addtriagefile( 5, "dumpstate-2.*\\.txt$", "Android Bug Report", "We can get SSIDs out of this file" );
t.addtriagefile( 6, "ch.protonmail.android/databases.*", "Proton Mail", "Proton is a privacy oriented service" );
return None
if __name__ == "__main__":
sys.exit(main())
The magic values for the first parameter to addtriagefile() can be found here.
