Difference between revisions of "TruxtonEvent"

From truxwiki.com
Jump to navigation Jump to search
(Created page with "This class lets you add to the Event table in Truxton. =Attributes and Methods= ==<code>id</code>== This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GU...")
 
 
(18 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
This class lets you add to the Event table in Truxton.
+
This class lets you add to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table in Truxton.
 
=Attributes and Methods=
 
=Attributes and Methods=
−
==<code>id</code>==
+
==<code>addnote(text: str) -> boolean</code>==
 +
This adds an investigator's note.
 +
The <code>text</code> parameter is the contents of the note.
 +
It will return
 +
[https://docs.python.org/3.10/library/constants.html?highlight=false#True True] if the tag was associated with the event, [https://docs.python.org/3.10/library/constants.html?highlight=false#False False] on failure.
 +
The note is stored in the <code>[InvestigatorNote]</code> table in the database.
 +
 
 +
==<code>id: str</code>==
 
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the event.
 
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the event.
 
It becomes non-zero after <code>save()</code> has been called.
 
It becomes non-zero after <code>save()</code> has been called.
 +
This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
−
==<code>description</code>==
+
==<code>description: str</code>==
 
The longer description of the event.
 
The longer description of the event.
 +
This corresponds to the <code>[Description]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
 +
 +
==<code>end: [https://docs.python.org/3/library/datetime.html datetime]</code>==
 +
When the event ended.
 +
This value can be set with either a datetime value or an integer representing [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
 +
This corresponds to the <code>[End]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
 +
 +
==<code>fileid: str</code>==
 +
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this event came from.
 +
This corresponds to the <code>[FileID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
−
==<code>depotname</code>==
+
==<code>mediaid: str</code>==
−
The name of the depot that contains the file's contents.
+
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this event came from.
 +
This identifier corresponds to the <code>[MediaID]</code> of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
−
==<code>end</code>==
+
==<code>save() -> boolean</code>==
−
When the event ended.
+
This will commit the information to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
 +
It will return [https://docs.python.org/3.10/library/constants.html#True True] if the record was saved to the database, [https://docs.python.org/3.10/library/constants.html#False False] if there was an error.
 +
 
 +
==<code>start: [https://docs.python.org/3/library/datetime.html datetime]</code>==
 +
When the event began.
 +
This value can be set with either a datetime value or an integer representing [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
 +
This corresponds to the <code>[Start]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
−
==<code>dontroute</code>==
+
==<code>tag(tag: str, reason: str, origin: int) -> boolean</code>==
−
This integer controls whether the message should be further routed through the message bus.
+
This creates a tag associated with this event in Truxton.
−
This is usually only set when debugging an ETL process.
+
The <code>tag</code> parameter is a short, one or two word, bit of text that will be displayed in the UI.
 +
The <code>reason</code> is a sentence explaining why this event was tagged.
 +
The <code>origin</code> is either <code>TAG_ORIGIN_AUTOMATIC</code> (1) or <code>TAG_ORIGIN_HUMAN</code> (2).
 +
It will return
 +
[https://docs.python.org/3.10/library/constants.html?highlight=false#True True] if the tag was associated with the file, [https://docs.python.org/3.10/library/constants.html?highlight=false#False False] on failure.
  
−
==<code>file()</code>==
+
==<code>title: str</code>==
−
This method will return a read-only [[TruxtonFileIO | file]] that you can use to read the contents of the file.
+
This corresponds to the <code>[Title]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
  
−
==<code>fileid</code>==
+
==<code>type: int</code>==
−
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file.
+
This corresponds to the <code>[EventTypeID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
−
This identifier corresponds to the <code>ID</code> of the <code>File</code> table.
+
It should contain a value from the <code>[ID]</code> column of the <code>[EventType]</code> table.
  
−
==<code>filetype</code>==
+
=Sample=
−
The [[File Types Supported | type of the file.
+
<source lang="Python" highlight="28-34">
−
This corresponds to the <code>FileTypeID</code> column of the <code>File</code> table.
+
import sys
 +
sys.path.append('C:/Program Files/Truxton/SDK')
 +
import truxton
 +
import shutil
  
−
==<code>hash</code>==
+
from datetime import datetime
−
The [https://en.wikipedia.org/wiki/MD5 MD5] hash of the contents of the file.
+
from calendar import timegm
−
This corresponds to the <code>HashID</code> column of the <code>File</code> table.
+
from pathlib import Path
  
−
==<code>mediaid</code>==
+
EVENT_TYPE_FBI = 20001
−
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file.
 
−
This identifier corresponds to the <code>MediaID</code> of the <code>File</code> table.
 
  
−
==<code>parentid</code>==
+
def create_event_type(t, id, name):
−
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file.
+
  event_type = t.neweventtype()
−
This identifier corresponds to the <code>ParentID</code> of the <code>File</code> table.
+
  event_type.id = id
 +
  event_type.name = name
 +
  event_type.save()
  
−
==<code>priority</code>==
+
def add_file(parent_truxton_file, filename):
−
This integer value controls the prioriy of the message.
+
  source_file = open(filename, "rb")
−
High values have greater priority than lower values.
+
  child = parent_truxton_file.newchild()
 +
  child.name = Path(filename).name
 +
  shutil.copyfileobj(source_file, child)
 +
  source_file.close()
 +
  child.save()
 +
  return child
  
−
==<code>queueempty</code>==
+
def add_event(parent_file, start, end, title, description, type):
−
This integer tells you if your message queue is empty.
+
  event = parent_file.newevent()
−
When this value is non-zero, the message queue is empty.
+
  event.start = datetime.fromisoformat(start)
 +
  event.end = datetime.fromisoformat(end)
 +
  event.title = title
 +
  event.description = description
 +
  event.type = type
 +
  event.save()
 +
  return event
  
−
==<code>routeid</code>==
+
def add_media(t):
−
This integer represents the path that files should take through the exploitation processes.
+
  media = t.newmedia()
−
It should be a value in the <code>LoadConfigurationID</code> column of the <code>[[ETLRoute Table | ETLRoute]]</code> table.
 
  
−
==<code>signature</code>==
+
  media.name = "Public Documents"
−
The first four bytes of the file stored as an integer.
+
  media.description = "Publicly available documents"
−
This corresponds to the <code>Signature</code> column of the <code>File</code> table.
+
  media.case = "DC-SNAFU-2016.2020"
 +
  media.evidencebag = "EV-0937459386623-a"
 +
  media.originator = "Jeffrey Jensen"
 +
  media.latitude = 38.897661
 +
  media.longitude = -77.036458
 +
  media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
  
−
=Sample=
+
  if media.save():
 +
    print("Media saved")
 +
  else:
 +
    print("Media not saved")
  
−
<syntaxhighlight lang="Python" line highlight="27">
+
  return media
−
import truxton
 
  
−
def main():
+
def add_ec(parent_file ):
−
   etl = truxton.etl()
+
   child_file = add_file(parent_file, "JW-v-DOJ-reply-02743.pdf")
−
  etl.name = "My New ETL"
 
−
  etl.description = "This ETL processes files in the Truxton system"
 
−
  etl.queue = "anewetl"
 
−
  etl.stage = 40
 
−
  etl.expanderid = 0x05fc0bf6a57726a0
 
−
  etl.version = 0
 
−
  etl.depot = "thumbnail"
 
−
  etl.depotype = truxton.DEPOT_TYPE_THUMBNAILS
 
−
  etl.poly = 0
 
  
−
   etl.addarg("--verbose")
+
   url = child_file.newurl()
−
   etl.addarg("Yes")
+
  url.url = "https://www.judicialwatch.org/documents/jw-v-doj-reply-02743/"
 +
  url.localfilename = "JW-v-DOJ-reply-02743.pdf"
 +
   url.type = truxton.URL_TYPE_FIREFOX
 +
  url.method = truxton.URL_METHOD_TYPE_CLICKED_ON_A_LINK
 +
  url.format = truxton.URL_FORMAT_ASCII
 +
  url.when = datetime.fromisoformat("2020-05-20T00:00:00-05:00")
 +
  url.save()
  
−
   etl.sendmefileid("5ecbebc4-9937-2b88-f691-91a800000024")
+
   add_event( child_file, "2016-07-31T12:00:00-05:00", "2016-07-31T12:00:00-05:00", "Crossfire Hurricane Created", "At FBI HQ", EVENT_TYPE_FBI )
−
   etl.sendmehash("baa51f0cc8361660df911e06e7637485")
+
   add_event( child_file, "2016-07-27T12:00:00-05:00", "2016-07-27T12:00:00-05:00", "Legat called needing to meet US ambassador", "In London", EVENT_TYPE_FBI )
−
   etl.sendmefiles(truxton.Type_JPEGWithExif, 100)
+
   add_event( child_file, "2016-07-29T12:00:00-05:00", "2016-07-29T12:00:00-05:00", "FBI Receives Downer Info from Legat", "Probably legat London", EVENT_TYPE_FBI )
−
  etl.sendmefiles(truxton.Type_TIFFWithExif, 500)
 
−
  etl.sendmelocalfile( "C:/Test Files/Video/Fragmented/Recovered Video.mp4", truxton.Type_MPEG4Video, 0 )
 
  
−
   message = etl.getmessage()
+
def main():
 +
   t = truxton.create()
  
−
   while message is not None:
+
   create_event_type(t, EVENT_TYPE_FBI, "FBI Actions" )
−
    file_in_truxton = message.file()
 
  
−
    # YOUR FORENSIC CODE GOES HERE
+
  media = add_media(t)
  
−
    line_of_text = file_in_truxton.readline()
+
  root_file = media.addroot()
 +
  root_file.save()
  
−
    if "[SetupAPI" in line_of_text:
+
  add_ec(root_file)
−
      child = file_in_truxton.newchild()
 
−
      child.name = "Child file from New ETL"
 
−
      child.write("This is the file you were looking for.")
 
−
      child.save()
 
  
 
if __name__ == "__main__":
 
if __name__ == "__main__":
−
   main()
+
   sys.exit(main())
−
</syntaxhighlight>
+
</source>

Latest revision as of 15:08, 27 January 2024

This class lets you add to the [Event] table in Truxton.

Attributes and Methods

addnote(text: str) -> boolean

This adds an investigator's note. The text parameter is the contents of the note. It will return True if the tag was associated with the event, False on failure. The note is stored in the [InvestigatorNote] table in the database.

id: str

This is the GUID of the event. It becomes non-zero after save() has been called. This corresponds to the [ID] column of the [Event] table.

description: str

The longer description of the event. This corresponds to the [Description] column of the [Event] table.

end: datetime

When the event ended. This value can be set with either a datetime value or an integer representing FILETIME ticks. This corresponds to the [End] column of the [Event] table.

fileid: str

The GUID of the file this event came from. This corresponds to the [FileID] column of the [Event] table.

mediaid: str

This is the GUID of the media this event came from. This identifier corresponds to the [MediaID] of the [Event] table.

save() -> boolean

This will commit the information to the [Event] table. It will return True if the record was saved to the database, False if there was an error.

start: datetime

When the event began. This value can be set with either a datetime value or an integer representing FILETIME ticks. This corresponds to the [Start] column of the [Event] table.

tag(tag: str, reason: str, origin: int) -> boolean

This creates a tag associated with this event in Truxton. The tag parameter is a short, one or two word, bit of text that will be displayed in the UI. The reason is a sentence explaining why this event was tagged. The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2). It will return True if the tag was associated with the file, False on failure.

title: str

This corresponds to the [Title] column of the [Event] table.

type: int

This corresponds to the [EventTypeID] column of the [Event] table. It should contain a value from the [ID] column of the [EventType] table.

Sample

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton
import shutil

from datetime import datetime
from calendar import timegm
from pathlib import Path

EVENT_TYPE_FBI = 20001

def create_event_type(t, id, name):
  event_type = t.neweventtype()
  event_type.id = id
  event_type.name = name
  event_type.save()

def add_file(parent_truxton_file, filename):
  source_file = open(filename, "rb")
  child = parent_truxton_file.newchild()
  child.name = Path(filename).name
  shutil.copyfileobj(source_file, child)
  source_file.close()
  child.save()
  return child

def add_event(parent_file, start, end, title, description, type):
  event = parent_file.newevent()
  event.start = datetime.fromisoformat(start)
  event.end = datetime.fromisoformat(end)
  event.title = title
  event.description = description
  event.type = type
  event.save()
  return event

def add_media(t):
  media = t.newmedia()

  media.name = "Public Documents"
  media.description = "Publicly available documents"
  media.case = "DC-SNAFU-2016.2020"
  media.evidencebag = "EV-0937459386623-a"
  media.originator = "Jeffrey Jensen"
  media.latitude = 38.897661
  media.longitude = -77.036458
  media.type = truxton.MEDIA_TYPE_LOGICAL_FILES

  if media.save():
    print("Media saved")
  else:
    print("Media not saved")

  return media

def add_ec(parent_file ):
  child_file = add_file(parent_file, "JW-v-DOJ-reply-02743.pdf")

  url = child_file.newurl()
  url.url = "https://www.judicialwatch.org/documents/jw-v-doj-reply-02743/"
  url.localfilename = "JW-v-DOJ-reply-02743.pdf"
  url.type = truxton.URL_TYPE_FIREFOX
  url.method = truxton.URL_METHOD_TYPE_CLICKED_ON_A_LINK
  url.format = truxton.URL_FORMAT_ASCII
  url.when = datetime.fromisoformat("2020-05-20T00:00:00-05:00")
  url.save()

  add_event( child_file, "2016-07-31T12:00:00-05:00", "2016-07-31T12:00:00-05:00", "Crossfire Hurricane Created", "At FBI HQ", EVENT_TYPE_FBI )
  add_event( child_file, "2016-07-27T12:00:00-05:00", "2016-07-27T12:00:00-05:00", "Legat called needing to meet US ambassador", "In London", EVENT_TYPE_FBI )
  add_event( child_file, "2016-07-29T12:00:00-05:00", "2016-07-29T12:00:00-05:00", "FBI Receives Downer Info from Legat", "Probably legat London", EVENT_TYPE_FBI )

def main():
  t = truxton.create()

  create_event_type(t, EVENT_TYPE_FBI, "FBI Actions" )

  media = add_media(t)

  root_file = media.addroot()
  root_file.save()

  add_ec(root_file)

if __name__ == "__main__":
  sys.exit(main())
Retrieved from "https://truxwiki.com/index.php?title=TruxtonEvent&oldid=7038"