Difference between revisions of "TruxtonFileIO"

From truxwiki.com
Jump to navigation Jump to search
 
(16 intermediate revisions by the same user not shown)
Line 1: Line 1:
 
This class provides read-only access to a file's contents in Truxton.
 
This class provides read-only access to a file's contents in Truxton.
  
−
=IOBase Methods=
+
=IOBase Attributes and Methods=
−
From [https://docs.python.org/3/library/io.html#io.IOBase IOBase] it implements:
+
These mirror the [https://docs.python.org/3/library/io.html#io.IOBase IOBase] methods.
  
−
* [https://docs.python.org/3/library/io.html#io.IOBase.close close()]
+
==<code>close()</code>==
−
* [https://docs.python.org/3/library/io.html#io.IOBase.closed closed]
+
Closes the stream.
−
* [https://docs.python.org/3/library/io.html#io.IOBase.fileno fileno()]
+
Implements [https://docs.python.org/3/library/io.html#io.IOBase.close close()]
−
* [https://docs.python.org/3/library/io.html#io.IOBase.flush flush()] - Does nothing
 
−
* [https://docs.python.org/3/library/io.html#io.IOBase.isatty isatty()]
 
−
* [https://docs.python.org/3/library/io.html#io.IOBase.readable readable()]
 
−
* [https://docs.python.org/3/library/io.html#io.IOBase.readline readline()]
 
−
* [https://docs.python.org/3/library/io.html#io.IOBase.readlines readlines()]
 
−
* [https://docs.python.org/3/library/io.html#io.IOBase.seek seek()]
 
−
* [https://docs.python.org/3/library/io.html#io.IOBase.seekable seekable()]
 
−
* [https://docs.python.org/3/library/io.html#io.IOBase.tell tell()]
 
−
* [https://docs.python.org/3/library/io.html#io.IOBase.truncate truncate()] -  - Always returns [https://docs.python.org/3.8/library/exceptions.html?highlight=ioerror#IOError IOError]
 
−
* [https://docs.python.org/3/library/io.html#io.IOBase.writable writable()] - Always returns [https://docs.python.org/3.8/library/constants.html#False False]
 
−
* [https://docs.python.org/3/library/io.html#io.IOBase.writelines writelines()] - Always returns [https://docs.python.org/3.8/library/exceptions.html?highlight=ioerror#IOError IOError]
 
  
−
=RawIOBase=
+
==<code>closed</code>==
 +
Returns [https://docs.python.org/3/library/constants.html#True True] if the stream is closed, [https://docs.python.org/3/library/constants.html#False False] if it is open.
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.closed closed]
 +
 
 +
==<code>fileno()</code>==
 +
Will always return an error.
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.fileno fileno()]
 +
 
 +
==<code>flush()</code>==
 +
Does nothing.
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.flush flush()]
 +
 
 +
==<code>isatty()</code>==
 +
Returns [https://docs.python.org/3/library/constants.html#False False]
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.isatty isatty()]
 +
 
 +
==<code>readable()</code>==
 +
Returns [https://docs.python.org/3/library/constants.html#True True]
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.readable readable()]
 +
 
 +
==<code>readline(size = -1)</code>==
 +
Reads a line of text from the file.
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.readline readline()]
 +
 
 +
==<code>readlines(hint = -1)</code>==
 +
Reads multiple lines of text from the file.
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.readlines readlines()]
 +
 
 +
==<code>seek(offset, whence = SEEK_SET)</code>==
 +
Changes the current file pointer.
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.seek seek()]
 +
 
 +
==<code>seekable()</code>==
 +
Returns [https://docs.python.org/3/library/constants.html#True True]
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.seekable seekable()]
 +
 
 +
==<code>tell()</code>==
 +
Returns the current stream position.
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.tell tell()]
 +
 
 +
==<code>truncate(size = None)</code>==
 +
Returns an error.
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.truncate truncate()]
 +
 
 +
==<code>writable()</code>==
 +
Returns [https://docs.python.org/3.8/library/exceptions.html?highlight=ioerror#IOError IOError]
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.writable writable()]
 +
 
 +
==<code>writelines(lines)</code>==
 +
Returns an error.
 +
Implements [https://docs.python.org/3/library/io.html#io.IOBase.writelines writelines()] - Always returns [https://docs.python.org/3.8/library/exceptions.html?highlight=ioerror#IOError IOError]
 +
 
 +
=RawIOBase Attributes and Methods=
 
From [https://docs.python.org/3/library/io.html#io.RawIOBase RawIOBase] it implements:
 
From [https://docs.python.org/3/library/io.html#io.RawIOBase RawIOBase] it implements:
  
−
* [https://docs.python.org/3/library/io.html#io.RawIOBase.read read()]
+
==<code>read(size = -1)</code>==
−
* [https://docs.python.org/3/library/io.html#io.RawIOBase.readall readall()]
+
Reads bytes from the file.
−
* [https://docs.python.org/3/library/io.html#io.RawIOBase.readinto readinto()]
+
Implements [https://docs.python.org/3/library/io.html#io.RawIOBase.read read()]
−
* [https://docs.python.org/3/library/io.html#io.RawIOBase.write write()] - Always returns [https://docs.python.org/3.8/library/exceptions.html?highlight=ioerror#IOError IOError]
+
 
 +
==<code>readall()</code>==
 +
Reads all of the bytes of the file.
 +
Implements [https://docs.python.org/3/library/io.html#io.RawIOBase.readall readall()]
 +
 
 +
==<code>readinto(b)</code>==
 +
Will fill byte array with bytes from the file.
 +
Implements [https://docs.python.org/3/library/io.html#io.RawIOBase.readinto readinto()]
 +
 
 +
==<code>write(b)</code>==
 +
Implements [https://docs.python.org/3/library/io.html#io.RawIOBase.write write()] - Always returns [https://docs.python.org/3.8/library/exceptions.html?highlight=ioerror#IOError IOError]
  
 
=Truxton Methods=
 
=Truxton Methods=
Line 31: Line 82:
 
The following methods are also present to make tasks of adding items extracted from a file easier.
 
The following methods are also present to make tasks of adding items extracted from a file easier.
  
−
* [[TruxtonFileIO_newartifact | newartifact()]] - Used to create a record in the [[Entity Table | entity table]] and associated with this file.
+
* [[TruxtonFileIO addnote|addnote()]] - Used to create a record in the <code>[InvestigatorNote]</code> table in the database associated with this file.
−
* [[TruxtonFileIO_newchild | newchild()]] - Creates a writable file that will be a child of this file.\
+
* [[TruxtonFileIO changetype|changetype()]] - Used the change the type of the file.
−
* [[TruxtonFileIO_newcommunication | newcommunication()]] - Creates a new [[TruxtonCommunication|communication]] object with this file as its source.
+
* [[TruxtonFileIO newartifact|newartifact()]] - Used to create a record in the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table and associated with this file.
−
* [[TruxtonFileIO_newevent | newevent()]] - Used to create a record in the [[Event Table | Event table]] and associated with this file.
+
* [[TruxtonFileIO newchild|newchild()]] - Creates a writable file that will be a child of this file.
−
* [[TruxtonFileIO_newexif | newexif()]] - Used to create a record in the [[EXIF Table | EXIF table]] and associated with this file.
+
* [[TruxtonFileIO newcommunication|newcommunication()]] - Creates a new [[TruxtonCommunication|communication]] object with this file as its source.
−
* [[TruxtonFileIO_newlocation | newlocation()]] - Used to create a record in the [[Location Table | Location table]] and associated with this file.
+
* [[TruxtonFileIO newevent|newevent()]] - Used to create a record in the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table and associated with this file.
−
* [[TruxtonFileIO_newrelation | newrelation()]] - Used to create a record in the [[Relation Table | Relation table]] and associated with this file.
+
* [[TruxtonFileIO newexif|newexif()]] - Used to create a record in the <code><nowiki>[</nowiki>[[EXIF Table|EXIF]]<nowiki>]</nowiki></code> table and associated with this file.
−
* [[TruxtonFileIO_newurl | newurl()]] - Used to create a record in the [[WebsiteVisit Table | WebsiteVisit table]] and associated with this file.
+
* [[TruxtonFileIO newlocation|newlocation()]] - Used to create a record in the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table and associated with this file.
−
* [[TruxtonFileIO_newusb | newusb()]] - Used to create a record in the [[USBDevice Table | USBDevice table]] and associated with this file.
+
* [[TruxtonFileIO newrelation|newrelation()]] - Used to create a record in the <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> table and associated with this file.
−
* [[TruxtonFileIO_tag | tag()]] - Used to associate a tag with this file.
+
* [[TruxtonFileIO newurl|newurl()]] - Used to create a record in the <code><nowiki>[</nowiki>[[WebsiteVisit Table|WebsiteVisit]]<nowiki>]</nowiki></code> table and associated with this file.
−
* [[TruxtonFileIO_changetype | changetype()]] - Used the change the type of the file.
+
* [[TruxtonFileIO newusb|newusb()]] - Used to create a record in the <code><nowiki>[</nowiki>[[USBDevice Table|USBDevice]]<nowiki>]</nowiki></code> table and associated with this file.
 +
* [[TruxtonFileIO tag|tag()]] - Used to associate a tag with this file.
  
−
=Properties=
+
=Truxton Attributes=
  
−
==<code>accessed</code>==
+
==<code>accessed: int</code>==
 
When the file was last accessed in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
 
When the file was last accessed in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
−
This corresponds to the <code>LastAccess</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[LastAccess]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>attributes</code>==
+
==<code>attributes: int</code>==
 
An integer value representing the attributes of the file.
 
An integer value representing the attributes of the file.
 
For a Microsoft filesystem, it can be a combination of the [https://docs.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants file attribute flags.]
 
For a Microsoft filesystem, it can be a combination of the [https://docs.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants file attribute flags.]
−
This corresponds to the <code>Attributes</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[Attributes]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>children</code>==
+
==<code>children: int</code>==
 
The number of files that have this file as their parent.
 
The number of files that have this file as their parent.
−
This corresponds to the <code>NumberOfChildren</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[NumberOfChildren]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>created</code>==
+
==<code>created: int</code>==
 
When the file was created in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
 
When the file was created in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
−
This corresponds to the <code>Created</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[Created]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>depot</code>==
+
==<code>depot: str</code>==
 
The name of the depot holding the file's contents.
 
The name of the depot holding the file's contents.
−
This corresponds to the <code>Filename</code> column of the <code>Depot</code> table.
+
This corresponds to the <code>[Filename]</code> column of the <code><nowiki>[</nowiki>[[Depot Table|Depot]]<nowiki>]</nowiki></code> table.
  
−
==<code>depotid</code>==
+
==<code>depotid: str</code>==
 
The name of the depot holding the file's contents.
 
The name of the depot holding the file's contents.
−
This corresponds to the <code>DepotID</code> column of the <code>Content</code> table.
+
This corresponds to the <code>[DepotID]</code> column of the <code><nowiki>[</nowiki>[[Content Table|Content]]<nowiki>]</nowiki></code> table.
  
−
==<code>depotlength</code>==
+
==<code>depotlength: int</code>==
 
The number of bytes in the depot used for this file's contents.
 
The number of bytes in the depot used for this file's contents.
−
This corresponds tot he <code>Length</code> column of the <code>Content</code> table.
+
This corresponds tot he <code>[Length]</code> column of the <code><nowiki>[</nowiki>[[Content Table|Content]]<nowiki>]</nowiki></code> table.
  
−
==<code>depotoffset</code>==
+
==<code>depotoffset: int</code>==
 
The number of bytes in the depot used for this file's contents.
 
The number of bytes in the depot used for this file's contents.
−
This corresponds tot he <code>Offset</code> column of the <code>Content</code> table.
+
This corresponds tot he <code>[Offset]</code> column of the <code><nowiki>[</nowiki>[[Content Table|Content]]<nowiki>]</nowiki></code> table.
  
−
==<code>diskoffset</code>==
+
==<code>diskoffset: int</code>==
 
The offset, in bytes, of the first byte of the contents of the file on the physical disk.
 
The offset, in bytes, of the first byte of the contents of the file on the physical disk.
−
This corresponds to the <code>PhysicalDiskOffset</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[PhysicalDiskOffset]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>eliminated</code>==
+
==<code>eliminated: boolean</code>==
 
[https://docs.python.org/3/library/constants.html#True True] when the original contents of the file were eliminated based on the hash matching one from a list of hashes of files known to have no investigative value.
 
[https://docs.python.org/3/library/constants.html#True True] when the original contents of the file were eliminated based on the hash matching one from a list of hashes of files known to have no investigative value.
 
The [https://www.nist.gov/itl/ssd/software-quality-group/national-software-reference-library-nsrl NSRL] is one such library.
 
The [https://www.nist.gov/itl/ssd/software-quality-group/national-software-reference-library-nsrl NSRL] is one such library.
 
If this is [https://docs.python.org/3/library/constants.html#False False], the file's contents are available for use.
 
If this is [https://docs.python.org/3/library/constants.html#False False], the file's contents are available for use.
  
−
==<code>entropy</code>==
+
==<code>entropy: float</code>==
−
[[Truxton_child_file_get_entropy | Shannon's entropy]] of the contents of the file.
+
[[Truxton_child_file_get_entropy|Shannon's entropy]] of the contents of the file.
−
This corresponds to the <code>RawEntropy</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[RawEntropy]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>hash</code>==
+
==<code>hash: str</code>==
 
The [https://en.wikipedia.org/wiki/MD5 MD5] hash of the contents of the file.
 
The [https://en.wikipedia.org/wiki/MD5 MD5] hash of the contents of the file.
−
This corresponds to the <code>HashID</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[HashID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>id</code>==
+
==<code>id: str</code>==
 
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file record.
 
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file record.
−
This corresponds to the <code>ID</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>mediaid</code>==
+
==<code>mediaid: str</code>==
 
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media the child file came from.
 
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media the child file came from.
−
This corresponds to the <code>MediaID</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[MediaID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>modified</code>==
+
==<code>modified: int</code>==
 
When the file was last written in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
 
When the file was last written in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.
−
This corresponds to the <code>LastWrite</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[LastWrite]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>name</code>==
+
==<code>name: str</code>==
 
The name of the file.
 
The name of the file.
  
−
==<code>origin</code>==
+
==<code>origin: int</code>==
 
Where the file came from.
 
Where the file came from.
−
It should be one of the [[Origin | origin values.]]
+
It should be one of the [[Origin|origin values.]]
−
This corresponds to the <code>OriginID</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[OriginID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>parentid</code>==
+
==<code>parentid: str</code>==
 
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the parent of this file.
 
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the parent of this file.
−
This corresponds to the <code>ParentFileID</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[ParentFileID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>resident</code>==
+
==<code>resident: boolean</code>==
 
[https://docs.python.org/3/library/constants.html#True True] if this file's contents exist contiguously within the contents of another file.
 
[https://docs.python.org/3/library/constants.html#True True] if this file's contents exist contiguously within the contents of another file.
  
−
==<code>size</code>==
+
==<code>size: int</code>==
 
The size, in bytes, of the file.
 
The size, in bytes, of the file.
−
This corresponds to the <code>OSLength</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[OSLength]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>status</code>==
+
==<code>status: int</code>==
 
The status of the contents of the file.
 
The status of the contents of the file.
−
It should be one of the [[Content Status | content status values.]]
+
It should be one of the [[Content Status|content status values.]]
−
This corresponds to the <code>ContentStatusID</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[ContentStatusID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
−
==<code>type</code>==
+
==<code>type: int</code>==
−
The [[File Types Supported | type]] of the file.
+
The [[File Types Supported|type]] of the file.
−
This corresponds to the <code>FileTypeID</code> column of the <code>[[File Table | File]]</code> table.
+
This corresponds to the <code>[FileTypeID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table.
  
 
=Sample=
 
=Sample=
 
This will retrieve a file from Truxton, print the name and hash as stored in the database then calculate a hash on the contents and print that.
 
This will retrieve a file from Truxton, print the name and hash as stored in the database then calculate a hash on the contents and print that.
−
<syntaxhighlight lang="Python">
+
<source lang="Python">
 +
import sys
 +
sys.path.append('C:/Program Files/Truxton/SDK')
 
import truxton
 
import truxton
 
import hashlib
 
import hashlib
  
−
def main():
+
def main() -> None:
 
   t = truxton.create()
 
   t = truxton.create()
−
   file = t.getfileid("5ec2a123-74d6-5da7-0653-4e6800000000")
+
   with t.getfileid("5ec2a123-74d6-5da7-0653-4e6800000000") as the_file:
−
  print(file.hash + " is the hash in the database for " + file.name )
+
    byte_buffer = the_file.readall()
−
  bytes = file.readall()
+
    readable_hash = hashlib.md5(byte_buffer).hexdigest()
−
  readable_hash = hashlib.md5(bytes).hexdigest()
+
    print(readable_hash + " is the calculated hash of the contents")
−
  print(readable_hash + " is the calculated hash of the contents")
+
 
 +
  return None
  
 
if __name__ == "__main__":
 
if __name__ == "__main__":
−
   main()
+
   sys.exit(main())
−
</syntaxhighlight>
+
</source>

Latest revision as of 16:56, 11 September 2024

This class provides read-only access to a file's contents in Truxton.

IOBase Attributes and Methods

These mirror the IOBase methods.

close()

Closes the stream. Implements close()

closed

Returns True if the stream is closed, False if it is open. Implements closed

fileno()

Will always return an error. Implements fileno()

flush()

Does nothing. Implements flush()

isatty()

Returns False Implements isatty()

readable()

Returns True Implements readable()

readline(size = -1)

Reads a line of text from the file. Implements readline()

readlines(hint = -1)

Reads multiple lines of text from the file. Implements readlines()

seek(offset, whence = SEEK_SET)

Changes the current file pointer. Implements seek()

seekable()

Returns True Implements seekable()

tell()

Returns the current stream position. Implements tell()

truncate(size = None)

Returns an error. Implements truncate()

writable()

Returns IOError Implements writable()

writelines(lines)

Returns an error. Implements writelines() - Always returns IOError

RawIOBase Attributes and Methods

From RawIOBase it implements:

read(size = -1)

Reads bytes from the file. Implements read()

readall()

Reads all of the bytes of the file. Implements readall()

readinto(b)

Will fill byte array with bytes from the file. Implements readinto()

write(b)

Implements write() - Always returns IOError

Truxton Methods

The above methods will let you read from a file in Truxton as if it were any other file in Python. The following methods are also present to make tasks of adding items extracted from a file easier.

  • addnote() - Used to create a record in the [InvestigatorNote] table in the database associated with this file.
  • changetype() - Used the change the type of the file.
  • newartifact() - Used to create a record in the [Entity] table and associated with this file.
  • newchild() - Creates a writable file that will be a child of this file.
  • newcommunication() - Creates a new communication object with this file as its source.
  • newevent() - Used to create a record in the [Event] table and associated with this file.
  • newexif() - Used to create a record in the [EXIF] table and associated with this file.
  • newlocation() - Used to create a record in the [Location] table and associated with this file.
  • newrelation() - Used to create a record in the [Relation] table and associated with this file.
  • newurl() - Used to create a record in the [WebsiteVisit] table and associated with this file.
  • newusb() - Used to create a record in the [USBDevice] table and associated with this file.
  • tag() - Used to associate a tag with this file.

Truxton Attributes

accessed: int

When the file was last accessed in FILETIME ticks. This corresponds to the [LastAccess] column of the [File] table.

attributes: int

An integer value representing the attributes of the file. For a Microsoft filesystem, it can be a combination of the file attribute flags. This corresponds to the [Attributes] column of the [File] table.

children: int

The number of files that have this file as their parent. This corresponds to the [NumberOfChildren] column of the [File] table.

created: int

When the file was created in FILETIME ticks. This corresponds to the [Created] column of the [File] table.

depot: str

The name of the depot holding the file's contents. This corresponds to the [Filename] column of the [Depot] table.

depotid: str

The name of the depot holding the file's contents. This corresponds to the [DepotID] column of the [Content] table.

depotlength: int

The number of bytes in the depot used for this file's contents. This corresponds tot he [Length] column of the [Content] table.

depotoffset: int

The number of bytes in the depot used for this file's contents. This corresponds tot he [Offset] column of the [Content] table.

diskoffset: int

The offset, in bytes, of the first byte of the contents of the file on the physical disk. This corresponds to the [PhysicalDiskOffset] column of the [File] table.

eliminated: boolean

True when the original contents of the file were eliminated based on the hash matching one from a list of hashes of files known to have no investigative value. The NSRL is one such library. If this is False, the file's contents are available for use.

entropy: float

Shannon's entropy of the contents of the file. This corresponds to the [RawEntropy] column of the [File] table.

hash: str

The MD5 hash of the contents of the file. This corresponds to the [HashID] column of the [File] table.

id: str

The GUID of the file record. This corresponds to the [ID] column of the [File] table.

mediaid: str

The GUID of the media the child file came from. This corresponds to the [MediaID] column of the [File] table.

modified: int

When the file was last written in FILETIME ticks. This corresponds to the [LastWrite] column of the [File] table.

name: str

The name of the file.

origin: int

Where the file came from. It should be one of the origin values. This corresponds to the [OriginID] column of the [File] table.

parentid: str

The GUID of the parent of this file. This corresponds to the [ParentFileID] column of the [File] table.

resident: boolean

True if this file's contents exist contiguously within the contents of another file.

size: int

The size, in bytes, of the file. This corresponds to the [OSLength] column of the [File] table.

status: int

The status of the contents of the file. It should be one of the content status values. This corresponds to the [ContentStatusID] column of the [File] table.

type: int

The type of the file. This corresponds to the [FileTypeID] column of the [File] table.

Sample

This will retrieve a file from Truxton, print the name and hash as stored in the database then calculate a hash on the contents and print that. 

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton
import hashlib

def main() -> None:
  t = truxton.create()
  with t.getfileid("5ec2a123-74d6-5da7-0653-4e6800000000") as the_file:
    byte_buffer = the_file.readall()
    readable_hash = hashlib.md5(byte_buffer).hexdigest()
    print(readable_hash + " is the calculated hash of the contents")

  return None

if __name__ == "__main__":
  sys.exit(main())
Retrieved from "https://truxwiki.com/index.php?title=TruxtonFileIO&oldid=9839"