Difference between revisions of "TruxtonChildFileIO newevent"
Jump to navigation
Jump to search
(Created page with "This create new event from a file in Truxton. It automatically associates the parent file and media identifiers used in the Event table. =Syntax= <syntaxhig...") |
(→Sample) |
||
| (2 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
This create new event from a file in Truxton. | This create new event from a file in Truxton. | ||
| − | It automatically associates the parent file and media identifiers used in the [[Event Table | Event table. | + | It automatically associates the parent file and media identifiers used in the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. |
=Syntax= | =Syntax= | ||
| − | < | + | <source lang="Python"> |
object newevent(); | object newevent(); | ||
| − | </ | + | </source> |
=Return value= | =Return value= | ||
| − | An event object | + | An [[TruxtonEvent|event]] object |
=Sample= | =Sample= | ||
| − | + | <source lang="Python" highlight="28"> | |
| − | < | ||
import truxton | import truxton | ||
import shutil | import shutil | ||
| Line 51: | Line 50: | ||
if __name__ == "__main__": | if __name__ == "__main__": | ||
| − | main() | + | sys.exit(main()) |
| − | + | </source> | |
| − | </ | ||
Latest revision as of 10:05, 3 February 2024
This create new event from a file in Truxton.
It automatically associates the parent file and media identifiers used in the [Event] table.
Syntax
object newevent();
Return value
An event object
Sample
import truxton
import shutil
from datetime import datetime
from calendar import timegm
from pathlib import Path
EPOCH_AS_FILETIME = 116444736000000000
HUNDREDS_OF_NANOSECONDS = 10000000
def date_to_filetime(dt):
return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)
def add_file(parent_truxton_file, filename):
source_file = open(filename, "rb")
child = parent_truxton_file.newchild()
child.name = Path(filename).name
shutil.copyfileobj(source_file, child)
source_file.close()
child.save()
return child
def main():
t = truxton.create()
file = t.getfileid("5ec2a123-74d6-5da7-0653-4e6800000000")
child = add_file(file, "C:/decrypts/PlainText.txt")
event = child.newevent()
event.title = "Python Executed"
event.description = "Created from Python!"
event.type = truxton.EVENT_TYPE_ADDED_BY_ANALYST
event.start = date_to_filetime(datetime.utcnow())
if event.save() is True:
print( "New event saved as id " + event.id)
if __name__ == "__main__":
sys.exit(main())
