TruxtonObject

This class gives you access to Truxton at a global level.

Attributes and Methods

adddatabaseid(file_type_id: int, table_and_column: str) -> boolean

Creates a record in the [DatabaseTableName] table to help identify a database file.

addtriagefile(type: int, name: str, description: str, why: str) -> boolean

Creates a record in the [TriageFile] table to specify the files and folders used in a Triage load. You supply the name of the file or folder, which can be a regular expression, a description of the file and a reason why it should be part of the Triage. Here's and example of how to use it.

The values for type can be:

Value	Meaning
1	The name is the name of a file
2	The name is the name of a folder
5	The name is regular expression pattern for a file
6	The name is regular expression pattern for a folder

carvefile(file_id: str | UUID) -> boolean

Will tell the carver to carve the contents of the given file identifier. Carved files will be added as child files. It will return True if the message was sent, False otherwise.

cleandatabase() -> boolean

This send a message to the maintenance ETL to go through the tables looking for unreferenced (orphaned) records and delete them. It will return True if the message was sent, False otherwise.

closed: boolean

It will be True if the connection to Truxton is closed, False otherwise.

connnectionstring: str

This will return the database connection string. Use this if you want to query the database directly.

consolidatedepots() -> boolean

This send a message to the maintenance ETL to go through closed depots and merge the smaller ones into the larger ones. What you will be left with is few very large depot files instead of many smaller ones. It will return True if the message was sent, False otherwise.

createeverythinghashset(output_filename: str) -> boolean

Creates a hash set file from the unique hashes in Truxton.

createinvestigationhashset(investigation_id: str | UUID, output_filename: str) -> boolean

Creates a hash set file from the unique hashes in the given investigation.

createmediahashset(media_id: str | UUID, output_filename: str) -> boolean

Creates a hash set file from the unique hashes in the given media.

createtag(name: str, description: str) -> None

This will create a new tag in Truxton. After calling this method, you can tag other items using only the name.

datatypenames() -> str

This will return a JSON string integer strings mapped to the names of the data types. The name corresponds to the [Name] column of the [DataType] table in the database.

deleteartifacttype(typeid: int) -> boolean

This will delete an artifact type from Truxton. It will return True on success, False otherwise.

deletedepots() -> boolean

This will send a message to the maintenance ETL to delete any depot files that have been marked as ToBeDeleted. It will return True if the message was sent, False otherwise.

deleteeventtype(typeid: int) -> boolean

This will delete an event type from Truxton. It will return True on success, False otherwise.

deleteinvestigationbyname(name: str) -> boolean

This will delete an investigation from Truxton knowing only the name. It will return True on success, False otherwise.

deletemedia(media_id: str | UUID) -> boolean

This will delete a piece of media from Truxton given its identifier. It will return True on success, False on failure.

deletemediabyname(name: str) -> boolean

This will delete a piece of media from Truxton knowing only the name. It will return True on success, False otherwise.

deletemedia(media_id: str | UUID) -> boolean

This will delete a piece of media from Truxton given its identifier. It will return True on success, False on failure.

deletesubject(subject_id: str | UUID) -> boolean

This will delete a subject from Truxton given its identifier. It will return True on success, False on failure.

deletetag(tagname: str) -> boolean

This will delete tag from Truxton. It will return True on success, False otherwise.

depotstatusnames() -> str

This will return a JSON string of integer strings mapped to the names of the depot status. The name corresponds to the [ShortName] column of the [DepotStatus] table in the database.

disablerouteupdate() -> boolean

Disable the automatic update of the [ETLRoute] table during software updates

enablerouteupdate() -> boolean

Enable the automatic update of the [ETLRoute] table during software updates

entitytypenames() -> str

This will return a JSON string of integer strings mapped to the names of the artifact types. The name corresponds to the [ShortName] column of the [EntityType] table in the database.

eventtypenames() -> str

This will return a JSON string of integer string mapped to the names of the artifact types. The name corresponds to the [Name] column of the [EventType] table in the database.

etlid: str

Returns the GUID of the ETL as a string if it is running.

fileexists(file_id: str | UUID) -> boolean

This looks in the [File] for a record with the given file_id. If a record is found with that globally unique identifier, True is returned.

filemimetypes() -> str

This will return a JSON string of integer strings mapped to the MIME types of the file types. The name corresponds to the [MIME] column of the [FileType] table in the database. Please see the sample code for how to use it.

filetypenames() -> str

This will return a JSON string of integer strings mapped to the names of the file types. The name corresponds to the [ShortName] column of the [FileType] table in the database. Please see the sample code for how to use it.

getfilehash(hash: str) -> TruxtonFileIO

This will retrieve a file from Truxton based on its MD5 hash.

getfileid(file_id: str | UUID) -> TruxtonFileIO

This will retrieve a file from Truxton based on its GUID.

getinvestigationid(id: str | UUID) -> TruxtonInvestigation

This will retrieve an investigation from Truxton based on its GUID.

getmediaid(media_id: str | UUID) -> TruxtonMedia

This will retrieve a media from Truxton based on its GUID.

getsensitivesitelistid(list_id: object) -> TruxtonSensitiveSiteList

This will retrieve a sensitive site list from Truxton based on its GUID.

groupentrytypenames() -> str

This will return a JSON string of integer strings mapped to the names of the group entry types. The name corresponds to the [Name] column of the [GroupEntryType] table in the database.

groupstatusnames() -> str

This will return a JSON string of integer strings mapped to the names of the group status. The name corresponds to the [Name] column of the [GroupStatus] table in the database.

grouptypenames() -> str

This will return a JSON string of integer strings mapped to the names of the group types. The name corresponds to the [Name] column of the [GroupType] table in the database.

investigationstatusnames() -> str

This will return a JSON string of integer strings mapped to the names of the investigation types. The name corresponds to the [Name] column of the [InvestigationStatus] table in the database.

investigationtypenames() -> str

This will return a JSON string of integer strings mapped to the names of the investigation types. The name corresponds to the [Name] column of the [InvestigationType] table in the database.

locationtypenames() -> str

This will return a JSON string of integer strings mapped to the names of the geographic location types. The name corresponds to the [Name] column of the [LocationType] table in the database.

machineid: str

Returns the GUID of the machine. When Truxton is installed, this identifier is generated with the most significant 64-bits being a Windows FILETIME and the lower 64-bits being random.

mediastatusnames() -> str

This will return a JSON string of integer strings mapped to the names of the media status. The name corresponds to the [Name] column of the [MediaStatus] table in the database.

mediatypenames() -> str

This will return a JSON string of integer strings mapped to the names of the media types. The name corresponds to the [ShortName] column of the [MediaType] table in the database.

messageaddresstypenames() -> str

This will return a JSON string of integer strings mapped to the names of the message address types. The name corresponds to the [Name] column of the [MessageAddressType] table in the database.

messagetypenames() -> str

This will return a JSON string of integer strings mapped to the names of the message types. The name corresponds to the [ShortName] column of the [MessageType] table in the database.

newartifact() -> TruxtonArtifact

This will create an artifact object.

newartifacttype() -> TruxtonArtifactType

This will create an artifact type object.

newbolo() -> TruxtonBolo

This will create a BOLO object.

neweventtype() -> TruxtonEventType

This will create an event type object.

newexporter() -> TruxtonExporter

This will create an exporter object.

newfiletype() -> TruxtonFileType

This will create a file type object.

newinvestigation() -> TruxtonInvestigation

This will create an investigation object.

newjurisdiction() -> TruxtonJurisdiction

This will create a jurisdiction object.

newmedia() -> TruxtonMedia

This will create a media object.

newmessageaddress() -> TruxtonMessageAddress

This will create a message address object.

newrelation() -> TruxtonRelation

This will create a relation object.

newsensitivesitelist() -> TruxtonSensitiveSiteList

This will create a sensitive site list object.

newsubject() -> TruxtonSubject

This will create a subject object.

objecttypenames() -> str

This will return a JSON string of integer strings mapped to the names of the object types. The name corresponds to the [Name] column of the [ObjectType] table in the database.

openfiletype(file_type: int) -> TruxtonFileType

This will open an existing file type object given the file type identifier.

optimizedatabase() -> boolean

This update the query statistics in the database.

originnames() -> str

This will return a JSON string of integer strings mapped to the names of the file origins. The name corresponds to the [Name] column of the [Origin] table in the database.

reindexmedia(media_id: str | UUID) -> boolean

This will send all of the files in a piece of media to the indexer.

relationtypenames() -> str

This will return a JSON string of integer strings mapped to the names of the relation types. The name corresponds to the [Name] column of the [RelationType] table in the database.

removedatabaseid(file_type_id: int, table_and_column: str) -> boolean

Removes a record in the [DatabaseTableName] table used to identify a database file.

removetriagefile(type: int, name: str) -> boolean

Removes a record from the [TriageFile] table.

setartifacttypecolor(type_id: int, foreground_rgb_color: int, background_rgb_color: int) -> None

Sets the color of an artifact when displayed in the GUI. This is a per user setting.

seteventtypecolor(type_id: int, foreground_rgb_color: int, background_rgb_color: int) -> None

Sets the color of an event type when displayed in the GUI. This is a per user setting.

setfiletypecolor(type_id: int, foreground_rgb_color: int, background_rgb_color: int) -> None

Sets the color of a file type when displayed in the GUI. This is a per user setting.

setinvestigationstatuscolor(type_id: int, foreground_rgb_color: int, background_rgb_color: int) -> None

Sets the color of an investigation status when displayed in the GUI. This is a per user setting.

setinvestigationtypecolor(type_id: int, foreground_rgb_color: int, background_rgb_color: int) -> None

Sets the color of an investigation type when displayed in the GUI. This is a per user setting.

setlocationtypecolor(type_id: int, foreground_rgb_color: int, background_rgb_color: int) -> None

Sets the color of a location type when displayed in the GUI. This is a per user setting.

setmessagetypecolor(type_id: int, foreground_rgb_color: int, background_rgb_color: int) -> None

Sets the color of a message type when displayed in the GUI. This is a per user setting.

setreviewstatuscolor(type_id: int, foreground_rgb_color: int, background_rgb_color: int) -> None

Sets the color of a review status when displayed in the GUI. This is a per user setting.

setreviewtypecolor(type_id: int, foreground_rgb_color: int, background_rgb_color: int) -> None

Sets the color of a review type when displayed in the GUI. This is a per user setting.

seturltypecolor(type_id: int, foreground_rgb_color: int, background_rgb_color: int) -> None

Sets the color of a URL type when displayed in the GUI. This is a per user setting.

taghash(hash: object, tag: str, description: str) -> boolean

This will add a tag to all files that have contents matching the given hash.

updateinvestigationtype(investigation_id: str | UUID, type: int) -> boolean

This will add a tag to all files that have contents matching the given hash.

updatemediatype(media_id: str | UUID, type: int) -> boolean

Sets the type of the media. This updates the [MediaTypeID] column of the [Media] table. It can be one of the defined constants but it must be one of the values in the [ID] column of the [MediaType] table. It will return True if the update succeeded, False otherwise.

updatemediaphotohash(media_id: str | UUID, hash: object) -> boolean

Associates the photo with the given MD5 hash with the Media.

urltypenames() -> str

This will return a JSON string of integer strings mapped to the names of the URL types. The name corresponds to the [ShortName] column of the [URLType] table in the database.

version: str

Returns the version of Truxton as a string.

websitevisitmethodnames() -> str

This will return a JSON string of mapped integer strings to the names of the URL methods. The name corresponds to the [ShortName] column of the [WebsiteMethod] table in the database.

Sample

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton
import shutil

from datetime import datetime
from calendar import timegm
from pathlib import Path

def create_event_type(t, id, name):
  event_type = t.neweventtype()
  event_type.id = id
  event_type.name = name
  event_type.save()

def add_file(parent_truxton_file, filename):
  source_file = open(filename, "rb")
  child = parent_truxton_file.newchild()
  child.name = Path(filename).name
  shutil.copyfileobj(source_file, child)
  source_file.close()
  child.save()

  return child

def add_media(t):
  media = t.newmedia()
  media.name = "Public Documents"
  media.description = "Publicly available documents"
  media.case = "DC-SNAFU-2016.2020"
  media.evidencebag = "EV-0937459386623-a"
  media.originator = "Jeffrey Jensen"
  media.latitude = 38.897661
  media.longitude = -77.036458
  media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
  media.save()

  return media

def add_ec(parent_file ):
  child_file = add_file(parent_file, "JW-v-DOJ-reply-02743.pdf")

  a = child_file.newartifact()
  a.type = truxton.ENTITY_TYPE_ACCOUNT
  a.value = "r0cker"
  a.datatype = truxton.DATA_TYPE_ASCII
  a.length = 6
  a.save()

  b = child_file.newartifact()
  b.type = truxton.ENTITY_TYPE_PERSON
  b.value = "Bob Smith"
  b.datatype = truxton.DATA_TYPE_ASCII
  b.length = 9
  b.save()

  relation = child_file.newrelation()
  relation.a = a.id
  relation.atype = truxton.OBJECT_TYPE_ENTITY
  relation.b = b.id
  relation.btype = truxton.OBJECT_TYPE_ENTITY
  relation.relation = truxton.RELATION_LOGON_ACCOUNT
  relation.save()

def main():
  t = truxton.create()

  print(t.version + '\n' );
  print("Truxton will write to depot files in: " + t.getstring("datadir") + '\n');
  print("The database port is: " + str(t.getint("dbport")) + '\n');
  print("Database was created: " + str(t.getbool("CreateTheDatabase")) + '\n');

  media = add_media(t)

  root_file = media.addroot()
  root_file.save()

  add_ec(root_file)

if __name__ == "__main__":
  sys.exit(main())