Difference between revisions of "Truxton C API"

From truxwiki.com
Jump to navigation Jump to search
 
(39 intermediate revisions by the same user not shown)
Line 60: Line 60:
 
* [[truxton_create]] - Creates a Truxton object
 
* [[truxton_create]] - Creates a Truxton object
 
* [[truxton_create_tag]] - Create a new type of tag
 
* [[truxton_create_tag]] - Create a new type of tag
 +
* [[truxton_delete_tag]] - Removes a tag from the system
 
* [[truxton_destroy]] - Frees a Truxton object
 
* [[truxton_destroy]] - Frees a Truxton object
 
* [[truxton_disable_route_update]] - Disables route updating when a [[Poly|poly file expander]] ETL is initializing.
 
* [[truxton_disable_route_update]] - Disables route updating when a [[Poly|poly file expander]] ETL is initializing.
Line 73: Line 74:
 
* [[truxton_start_adding_files]] - Prepares Truxton to add files to the database
 
* [[truxton_start_adding_files]] - Prepares Truxton to add files to the database
 
* [[truxton_tag_hash]] - Tags files based on their [https://en.wikipedia.org/wiki/MD5 MD5] hash
 
* [[truxton_tag_hash]] - Tags files based on their [https://en.wikipedia.org/wiki/MD5 MD5] hash
 +
* [[truxton_time_now]] - Returns the current time in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 
* [[truxton_update_investigation_type]] - Change the [[Investigation Types|type]] of an existing investigation
 
* [[truxton_update_investigation_type]] - Change the [[Investigation Types|type]] of an existing investigation
 
* [[truxton_update_media_primary_photo_by_hash]] - Set the primary photograph of an existing piece of media
 
* [[truxton_update_media_primary_photo_by_hash]] - Set the primary photograph of an existing piece of media
Line 102: Line 104:
 
* [[truxton_get_details_size]] - Returns the size of the buffer required to hold [[Type_File_Details|details]] of a file
 
* [[truxton_get_details_size]] - Returns the size of the buffer required to hold [[Type_File_Details|details]] of a file
 
* [[truxton_identify_bytes]] - Will return the [[File_Types_Supported|type]] of the file in the given buffer
 
* [[truxton_identify_bytes]] - Will return the [[File_Types_Supported|type]] of the file in the given buffer
 +
 +
===Triage Loads===
 +
* [[truxton_add_triage_file]] - Adds a record to the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table to have a file or folder included in a [[Triage]] load
 +
* [[truxton_remove_triage_file]] - Removes a record from the <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> table
 +
 +
===GUI Colors===
 +
* [[truxton_set_artifact_type_color]] - Sets the color of an [[Entity Types|artifact]] when displayed in the desktop GUI.
 +
* [[truxton_set_event_type_color]] - Sets the color of an [[Event Types|event]] when displayed in the desktop GUI.
 +
* [[truxton_set_file_type_color]] - Sets the color of an [[File Types Supported|file type]] when displayed in the desktop GUI.
 +
* [[truxton_set_investigation_status_color]] - Sets the color of an [[Investigation Statuses|investigation status]] when displayed in the desktop GUI.
 +
* [[truxton_set_investigation_type_color]] - Sets the color of an [[Investigation_Types|investigation type]] when displayed in the desktop GUI.
 +
* [[truxton_set_location_type_color]] - Sets the color of an [[Location Types|location type]] when displayed in the desktop GUI.
 +
* [[truxton_set_message_type_color]] - Sets the color of a [[Message Types|message type]] when displayed in the desktop GUI.
 +
* [[truxton_set_review_status_color]] - Sets the color of a review status when displayed in the desktop GUI.
 +
* [[truxton_set_review_type_color]] - Sets the color of a review type when displayed in the desktop GUI.
 +
* [[truxton_set_url_type_color]] - Sets the color of a [[URL Types|URL type]] when displayed in the desktop GUI.
  
 
==Artifacts==
 
==Artifacts==
Line 136: Line 154:
 
==Artifact Type==
 
==Artifact Type==
 
This API is used to create custom types of artifacts.
 
This API is used to create custom types of artifacts.
−
If one of the [[Event Types|default event types]] don't suite your purpose, you are free to create your own.
+
If one of the [[Entity Types|default artifact types]] don't suite your purpose, you are free to create your own.
  
 
* [[truxton_artifact_type_create]] - Creates a new artifact type object
 
* [[truxton_artifact_type_create]] - Creates a new artifact type object
Line 147: Line 165:
 
* [[truxton_artifact_type_get_short_name]] - Gets the short human readable name of the artifact type
 
* [[truxton_artifact_type_get_short_name]] - Gets the short human readable name of the artifact type
 
* [[truxton_artifact_type_set_short_name]] - Sets the short human readable name of the artifact type
 
* [[truxton_artifact_type_set_short_name]] - Sets the short human readable name of the artifact type
 +
* [[truxton_delete_artifact_type]] - Deletes an artifact type from Truxton
  
 
==BOLOs==
 
==BOLOs==
Line 251: Line 270:
 
* [[truxton_enumeration_get_current_investigation]] - Retrieves the parent investigation of the current enumerated item
 
* [[truxton_enumeration_get_current_investigation]] - Retrieves the parent investigation of the current enumerated item
 
* [[truxton_enumeration_get_current_media]] - Retrieves the parent media of the current enumerated item
 
* [[truxton_enumeration_get_current_media]] - Retrieves the parent media of the current enumerated item
 +
* [[truxton_enumeration_get_double]] - Retrieves the floating point value at a desired column of a custom enumeration
 +
* [[truxton_enumeration_get_integer]] - Retrieves the integer value at a desired column of a custom enumeration
 
* [[truxton_enumeration_get_next]] - Retrieves the next item in the enumeration
 
* [[truxton_enumeration_get_next]] - Retrieves the next item in the enumeration
 
* [[truxton_enumeration_get_scope]] - Retrieves the scope of the enumeration
 
* [[truxton_enumeration_get_scope]] - Retrieves the scope of the enumeration
 
* [[truxton_enumeration_get_scope_id]] - Retrieves the specific item being enumerated
 
* [[truxton_enumeration_get_scope_id]] - Retrieves the specific item being enumerated
 +
* [[truxton_enumeration_get_string]] - Retrieves the string at a desired column of a custom enumeration
 +
* [[truxton_enumeration_get_time]] - Retrieves the time value at a desired column of a custom enumeration
 
* [[truxton_enumeration_get_target]] - Retrieves what is being enumerated
 
* [[truxton_enumeration_get_target]] - Retrieves what is being enumerated
 +
* [[truxton_enumeration_set_query]] - Sets SQL query to use with custom enumeration
 
* [[truxton_enumeration_set_scope]] - Sets the scope of the enumeration
 
* [[truxton_enumeration_set_scope]] - Sets the scope of the enumeration
 
* [[truxton_enumeration_set_scope_id]] - Sets the specific identifier of the scope
 
* [[truxton_enumeration_set_scope_id]] - Sets the specific identifier of the scope
Line 328: Line 352:
 
* [[truxton_event_type_get_name]] - Gets the human readable name of the event type
 
* [[truxton_event_type_get_name]] - Gets the human readable name of the event type
 
* [[truxton_event_type_set_name]] - Sets the human readable name of the event type
 
* [[truxton_event_type_set_name]] - Sets the human readable name of the event type
 +
* [[truxton_delete_event_type]] - Deletes an event type from Truxton
  
 
==EXIF (Camera Information)==
 
==EXIF (Camera Information)==
Line 460: Line 485:
 
* [[truxton_file_get_signature]] - Gets the first four bytes of the contents as an integer
 
* [[truxton_file_get_signature]] - Gets the first four bytes of the contents as an integer
 
* [[truxton_file_get_type]] - Reads the [[File Types Supported|type]] of the file
 
* [[truxton_file_get_type]] - Reads the [[File Types Supported|type]] of the file
 +
* [[truxton_file_path_exists]] - Determines if a file path exists in Truxton
  
 
===Derived Objects===
 
===Derived Objects===
Line 474: Line 500:
 
* [[truxton_file_open_id]] - Retrieves a particular file specified by the file's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].
 
* [[truxton_file_open_id]] - Retrieves a particular file specified by the file's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].
 
* [[truxton_file_open_md5]] - Retrieves the first file in Truxton whose contents have the given [https://en.wikipedia.org/wiki/MD5 MD5] hash.
 
* [[truxton_file_open_md5]] - Retrieves the first file in Truxton whose contents have the given [https://en.wikipedia.org/wiki/MD5 MD5] hash.
 +
* [[truxton_file_open_path]] - Retrieves a particular file specified by an exact path.
 
* [[truxton_file_tag]] - Creates a tag and puts it on this file. This data will be saved to the <code>[Tagged]</code> table.
 
* [[truxton_file_tag]] - Creates a tag and puts it on this file. This data will be saved to the <code>[Tagged]</code> table.
  
Line 482: Line 509:
 
* [[truxton_file_export_add_criteria]] - Adds a criteria to the export
 
* [[truxton_file_export_add_criteria]] - Adds a criteria to the export
 
* [[truxton_file_export_set_option]] - Sets options for the export
 
* [[truxton_file_export_set_option]] - Sets options for the export
−
* [[truxton_file_export_set_truxton]] -
+
* [[truxton_file_export_set_truxton]] - Sets the Truxton object for an export
 
* [[truxton_file_export_where_clause]] - Retrieves the [https://en.wikipedia.org/wiki/SQL SQL] <code>WHERE</code> clause of the current criteria
 
* [[truxton_file_export_where_clause]] - Retrieves the [https://en.wikipedia.org/wiki/SQL SQL] <code>WHERE</code> clause of the current criteria
  
 
==File Type==
 
==File Type==
 
* [[truxton_file_type_create]] - Creates a file type object.
 
* [[truxton_file_type_create]] - Creates a file type object.
 +
* [[truxton_file_type_open_id]] - Opens an existing a file type.
 
* [[truxton_file_type_destroy]] - Frees any resources allocated for this file type object.
 
* [[truxton_file_type_destroy]] - Frees any resources allocated for this file type object.
 
* [[truxton_file_type_get_id]] - Retrieves the identifier you assigned to this file type.
 
* [[truxton_file_type_get_id]] - Retrieves the identifier you assigned to this file type.
Line 512: Line 540:
 
* [[truxton_group_destroy]] - Destroys the group object
 
* [[truxton_group_destroy]] - Destroys the group object
 
* [[truxton_group_save]] - Saves the group to the <code>[Group]</code> table in the database
 
* [[truxton_group_save]] - Saves the group to the <code>[Group]</code> table in the database
−
* [[truxton_group_get_id]] -  
+
* [[truxton_group_get_id]] - Gets the group [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
−
* [[truxton_group_set_id]] -  
+
* [[truxton_group_set_id]] - Sets the group [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
−
* [[truxton_group_get_investigation_id]] -  
+
* [[truxton_group_get_investigation_id]] - Gets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation this group belongs to
−
* [[truxton_group_set_investigation_id]] -  
+
* [[truxton_group_set_investigation_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation this group belongs to
−
* [[truxton_group_get_investigator_id]] -  
+
* [[truxton_group_get_investigator_id]] - Gets the investigator's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
−
* [[truxton_group_set_investigator_id]] -  
+
* [[truxton_group_set_investigator_id]] - Sets the investigator's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
−
* [[truxton_group_get_copy_id]] -  
+
* [[truxton_group_get_copy_id]] - Gets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the group this group was copied from
−
* [[truxton_group_set_copy_id]] -  
+
* [[truxton_group_set_copy_id]] - Sets the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the group this group was copied from
−
* [[truxton_group_get_name]] -  
+
* [[truxton_group_get_name]] - Gets the name of the group
−
* [[truxton_group_set_name]] -  
+
* [[truxton_group_set_name]] - Sets the name of the group
−
* [[truxton_group_get_description]] -  
+
* [[truxton_group_get_description]] - Gets the description of the group
−
* [[truxton_group_set_description]] -  
+
* [[truxton_group_set_description]] - Sets the description of the group
−
* [[truxton_group_get_status]] -  
+
* [[truxton_group_get_status]] - Gets the [[Group Status|status]] of the group
−
* [[truxton_group_set_status]] -  
+
* [[truxton_group_set_status]] - Sets the [[Group Status|status]] of the group
−
* [[truxton_group_get_type]] -  
+
* [[truxton_group_get_type]] - Gets the [[Group Types|type]] of the group
−
* [[truxton_group_set_type]] -  
+
* [[truxton_group_set_type]] - Sets the [[Group Types|type]] of the group
−
* [[truxton_group_get_created]] -  
+
* [[truxton_group_get_created]] - Gets the date time of the group creation in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
* [[truxton_group_set_created]] -  
+
* [[truxton_group_set_created]] - Sets the date time of the group creation in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
−
* [[truxton_group_get_is_default]] -  
+
* [[truxton_group_get_is_default]] - Tells you if this group is the default group for the investigation
−
* [[truxton_group_set_is_default]] -  
+
* [[truxton_group_set_is_default]] - Sets the group to be the default
−
* [[truxton_group_get_is_deleted]] -  
+
* [[truxton_group_get_is_deleted]] - Tells you if this group is deleted
−
* [[truxton_group_set_is_deleted]] -  
+
* [[truxton_group_set_is_deleted]] - Marks the group as deleted
  
 
==Investigation==
 
==Investigation==
Line 561: Line 589:
 
* [[truxton_investigation_set_jurisdiction]] - Sets the jurisdiction identifier of the investigation
 
* [[truxton_investigation_set_jurisdiction]] - Sets the jurisdiction identifier of the investigation
 
* [[truxton_investigation_set_name]] - Sets the name of the investigation
 
* [[truxton_investigation_set_name]] - Sets the name of the investigation
−
* [[truxton_investigation_set_opened]] - Sets the date and time of when the investigation was opened
+
* [[truxton_investigation_set_opened]] - Sets the date and time of when the investigation was opened in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 
* [[truxton_investigation_set_status]] - Sets the [[Investigation Statuses|status]] of the investigation
 
* [[truxton_investigation_set_status]] - Sets the [[Investigation Statuses|status]] of the investigation
 
* [[truxton_investigation_set_type]] - Sets the [[Investigation Types|type]] of the investigation
 
* [[truxton_investigation_set_type]] - Sets the [[Investigation Types|type]] of the investigation
 +
* [[truxton_delete_investigation_by_name]] - Deletes an investigation given only a name
  
 
==Investigation Event==
 
==Investigation Event==
−
* [[truxton_investigation_event_create]] -  
+
This set of API's allow you to add records to the <code>[InvestigationEvent]</code> table.
−
* [[truxton_investigation_event_destroy]] -  
+
 
−
* [[truxton_investigation_event_get_id]] -  
+
* [[truxton_investigation_event_create]] - Creates an investigation event object
−
* [[truxton_investigation_event_set_id]] -  
+
* [[truxton_investigation_event_destroy]] - Destroys the investigation event object
−
* [[truxton_investigation_event_get_investigation_id]] -  
+
* [[truxton_investigation_event_get_id]] - Gets the event [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
−
* [[truxton_investigation_event_set_investigation_id]] -  
+
* [[truxton_investigation_event_set_id]] - Sets the event [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
−
* [[truxton_investigation_event_get_color]] -  
+
* [[truxton_investigation_event_get_investigation_id]] - Gets the investigation [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
−
* [[truxton_investigation_event_set_color]] -  
+
* [[truxton_investigation_event_set_investigation_id]] - Sets the investigation [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID]
−
* [[truxton_investigation_event_get_text]] -  
+
* [[truxton_investigation_event_get_color]] - Retrieves the color assigned to the event
−
* [[truxton_investigation_event_set_text]] -  
+
* [[truxton_investigation_event_set_color]] - Assigns a color to the event
−
* [[truxton_investigation_event_get_status]] -  
+
* [[truxton_investigation_event_get_text]] - Retrieves the text of the event
−
* [[truxton_investigation_event_set_status]] -  
+
* [[truxton_investigation_event_set_text]] - Sets the text of the event
−
* [[truxton_investigation_event_get_type]] -  
+
* [[truxton_investigation_event_get_status]] - Retrieves the [[Investigation Statuses|status]] of the investigation
−
* [[truxton_investigation_event_set_type]] -  
+
* [[truxton_investigation_event_set_status]] - Sets the [[Investigation Statuses|status]] of the investigation
−
* [[truxton_investigation_event_get_when]] -  
+
* [[truxton_investigation_event_get_type]] - Retrieves the [[Investigation Event Types|type]] of the event
−
* [[truxton_investigation_event_set_when]] -  
+
* [[truxton_investigation_event_set_type]] - Sets the [[Investigation Event Types|type]] of the event
−
* [[truxton_investigation_event_save]] -  
+
* [[truxton_investigation_event_get_when]] - Retrieves when the event took place in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_investigation_event_set_when]] - Sets when the event took place in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 +
* [[truxton_investigation_event_save]] - Saves the investigation event object to the database
  
 
==Jurisdiction==
 
==Jurisdiction==
 
Jurisdictions is a way to keep track of work done on behalf of others.
 
Jurisdictions is a way to keep track of work done on behalf of others.
−
Say you're a regional forensics lab and your boss asks you, "How much work did we do for Mayberry last quarter?"
+
Say you're a regional forensics lab and your boss asks you, "How much work did we do for [https://en.wikipedia.org/wiki/Mayberry Mayberry] last quarter?"
  
 
* [[truxton_jurisdiction_create]] - This will create a new jurisdiction object
 
* [[truxton_jurisdiction_create]] - This will create a new jurisdiction object
Line 626: Line 657:
  
 
==Media==
 
==Media==
−
These are the API's that allow you to add to the Media table in the database.
+
These are the API's that allow you to add to the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table in the database.
 
* [[truxton_media_create]] - Creates a new media object
 
* [[truxton_media_create]] - Creates a new media object
 +
* [[truxton_media_open_by_name]] - Opens an existing media in the database given the media's name.
 
* [[truxton_media_open_id]] - Opens an existing media in the database given the media's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].
 
* [[truxton_media_open_id]] - Opens an existing media in the database given the media's [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].
 
* [[truxton_media_destroy]] - Frees any resources allocated to this object
 
* [[truxton_media_destroy]] - Frees any resources allocated to this object
Line 665: Line 697:
 
* [[truxton_media_get_root_file_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the top level file in the media
 
* [[truxton_media_get_root_file_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the top level file in the media
 
* [[truxton_media_save]] - Saves the media information to the database
 
* [[truxton_media_save]] - Saves the media information to the database
 +
* [[truxton_delete_media_by_name]] - Deletes a piece of media given only a name
 +
* [[truxton_media_set_calculated_size]] - Calculates the size of the media and updates the database
  
 
===Derived Objects===
 
===Derived Objects===
Line 673: Line 707:
  
 
===Maintenance Functions===
 
===Maintenance Functions===
−
* [[truxton_media_update_cache_file_counts]] -  
+
* [[truxton_media_update_cache_file_counts]] - This will count the files in the different groups and cache them
−
* [[truxton_media_update_child_count]] -  
+
* [[truxton_media_update_child_count]] - This method updates the <code>[NumberOfChildren]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> for this media
 
* [[truxton_media_update_paths]] - This method updates the <code>[FullPathID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> for this media
 
* [[truxton_media_update_paths]] - This method updates the <code>[FullPathID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> for this media
  
Line 721: Line 755:
 
* [[truxton_message_address_destroy]] - Frees a message address
 
* [[truxton_message_address_destroy]] - Frees a message address
 
* [[truxton_message_address_save]] - Saves the message address to the <code>[MessageAddress]</code> table
 
* [[truxton_message_address_save]] - Saves the message address to the <code>[MessageAddress]</code> table
−
* [[truxton_message_address_get_id]] -  
+
* [[truxton_message_address_get_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the message address
−
* [[truxton_message_address_get_combined_id]] -  
+
* [[truxton_message_address_get_combined_id]] - Retrieves the combined identifier for the account and server
−
* [[truxton_message_address_get_combined_guid]] -  
+
* [[truxton_message_address_get_combined_guid]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the combined identifier for the address
−
* [[truxton_message_address_get_account]] -  
+
* [[truxton_message_address_get_account]] - Retrieves the account part of the address
−
* [[truxton_message_address_set_account]] -  
+
* [[truxton_message_address_set_account]] - Sets the account part of the address
−
* [[truxton_message_address_get_server]] -  
+
* [[truxton_message_address_get_server]] - Retrieves the server part of the address
−
* [[truxton_message_address_set_server]] -  
+
* [[truxton_message_address_set_server]] - Sets the server part of the address
−
* [[truxton_message_address_get_name]] -  
+
* [[truxton_message_address_get_name]] - Retrieves the name associated with the address
−
* [[truxton_message_address_set_name]] -  
+
* [[truxton_message_address_set_name]] - Sets the name to associate with the address
  
 
==Message Participant==
 
==Message Participant==
−
* [[truxton_message_participant_create]] -  
+
This is basically a useless API.
−
* [[truxton_message_participant_destroy]] -  
+
It is used internally during the enumeration of the participants of a communication.
−
* [[truxton_message_participant_get_id]] -  
+
 
−
* [[truxton_message_participant_set_id]] -  
+
* [[truxton_message_participant_create]] - Creates a participant in a message
−
* [[truxton_message_participant_get_combined_id]] -  
+
* [[truxton_message_participant_destroy]] - Frees the participant object
−
* [[truxton_message_participant_get_combined_guid]] -  
+
* [[truxton_message_participant_get_id]] - Retrieves he globally unique identifier of the participant
−
* [[truxton_message_participant_get_account]] -  
+
* [[truxton_message_participant_set_id]] - Sets the globally unique identifier of the participant
−
* [[truxton_message_participant_set_account]] -  
+
* [[truxton_message_participant_get_combined_id]] - Retrieves the combined id of the message address
−
* [[truxton_message_participant_get_file_id]] -  
+
* [[truxton_message_participant_get_combined_guid]] - Retrieves the combined identifier as a globally unique identifier
−
* [[truxton_message_participant_set_file_id]] -  
+
* [[truxton_message_participant_get_account]] - Retrieves the account portion of the message address
−
* [[truxton_message_participant_get_media_id]] -  
+
* [[truxton_message_participant_set_account]] - Sets the account portion of the message address
−
* [[truxton_message_participant_set_media_id]] -  
+
* [[truxton_message_participant_get_file_id]] - Retrieves the globally unique identifier of the file containing this participant
−
* [[truxton_message_participant_get_message_address_id]] -  
+
* [[truxton_message_participant_set_file_id]] - Sets the globally unique identifier of the file containing this participant
−
* [[truxton_message_participant_set_message_address_id]] -  
+
* [[truxton_message_participant_get_media_id]] - Retrieves the globally unique identifier of the media containing this participant
−
* [[truxton_message_participant_get_message_id]] -  
+
* [[truxton_message_participant_set_media_id]] - Sets the globally unique identifier of the media containing this participant
−
* [[truxton_message_participant_set_message_id]] -  
+
* [[truxton_message_participant_get_message_address_id]] - Retrieved the globally unique identifier of the message address
−
* [[truxton_message_participant_get_server]] -  
+
* [[truxton_message_participant_set_message_address_id]] - Sets the globally unique identifier of the message address
−
* [[truxton_message_participant_set_server]] -  
+
* [[truxton_message_participant_get_message_id]] - Retrieves the globally unique identifier for the participant
−
* [[truxton_message_participant_get_name]] -  
+
* [[truxton_message_participant_set_message_id]] - Sets the globally unique identifier for the participant
−
* [[truxton_message_participant_set_name]] -  
+
* [[truxton_message_participant_get_server]] - Retrieves the server portion of the participant address
−
* [[truxton_message_participant_get_type]] -  
+
* [[truxton_message_participant_set_server]] - Sets the server portion of the participant address
−
* [[truxton_message_participant_set_type]] -  
+
* [[truxton_message_participant_get_name]] - Retrieves the name portion of the participant address
 +
* [[truxton_message_participant_set_name]] - Sets the name portion of the participant address
 +
* [[truxton_message_participant_get_type]] - Gets the [[Message Participants|role]] this participant took in the message
 +
* [[truxton_message_participant_set_type]] - Sets the [[Message Participants|role]] this participant took in the message
  
 
==Options==
 
==Options==
Line 771: Line 808:
 
* [[truxton_note_create]] - Creates a note
 
* [[truxton_note_create]] - Creates a note
 
* [[truxton_note_destroy]] - Frees a note
 
* [[truxton_note_destroy]] - Frees a note
−
* [[truxton_note_get_investigation_id]] - Retrives the identifier of the investigation that this note belongs
+
* [[truxton_note_get_investigation_id]] - Retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the investigation that this note belongs
−
* [[truxton_note_set_investigation_id]] - Sets the investigation of the note
+
* [[truxton_note_set_investigation_id]] - Sets the investigation [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the note
 
* [[truxton_note_get_object_id]] - Retrieves the identifier of the object that has the attached note
 
* [[truxton_note_get_object_id]] - Retrieves the identifier of the object that has the attached note
 
* [[truxton_note_set_object_id]] - Sets the identifier of the object to attach the note to
 
* [[truxton_note_set_object_id]] - Sets the identifier of the object to attach the note to
−
* [[truxton_note_get_object_type]] - Retrieves the type of the object id
+
* [[truxton_note_get_object_type]] - Retrieves the [[Object Types|type]] of the object id
−
* [[truxton_note_set_object_type]] - Sets the type of the object id
+
* [[truxton_note_set_object_type]] - Sets the [[Object Types|type]] of the object id
 
* [[truxton_note_get_text]] - Retrieves the contents of the investigator's note
 
* [[truxton_note_get_text]] - Retrieves the contents of the investigator's note
 
* [[truxton_note_set_text]] - Sets the contents of the investigator's note
 
* [[truxton_note_set_text]] - Sets the contents of the investigator's note
Line 784: Line 821:
 
These functions let you add to the <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> table in Truxton.
 
These functions let you add to the <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> table in Truxton.
 
This is how to establish some sort of [[Relation Types|relationship]] between items in Truxton to create a [https://en.wikipedia.org/wiki/Graph_(discrete_mathematics) graph.]
 
This is how to establish some sort of [[Relation Types|relationship]] between items in Truxton to create a [https://en.wikipedia.org/wiki/Graph_(discrete_mathematics) graph.]
−
Relations in Truxton adhere to the form of "A is a [[Relation Types|XXX]] of B"
+
Relations in Truxton adhere to the form of "A is a [[Relation Types|thing]] of B"
 
Truxton is not focused on exploring graphs ([https://en.wikipedia.org/wiki/Clique_(graph_theory) cliques] anyone?) but needed a way to establish simple relationships between objects.
 
Truxton is not focused on exploring graphs ([https://en.wikipedia.org/wiki/Clique_(graph_theory) cliques] anyone?) but needed a way to establish simple relationships between objects.
  
Line 842: Line 879:
 
* [[truxton_subject_set_birthday]] - Sets the birthday of the subject in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 
* [[truxton_subject_set_birthday]] - Sets the birthday of the subject in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks
 
* [[truxton_subject_save]] - Will commit the information in the subject object to the <code>[Suspect]</code> table.
 
* [[truxton_subject_save]] - Will commit the information in the subject object to the <code>[Suspect]</code> table.
 +
* [[truxton_delete_subject]] - Deletes a subject from the system
  
 
===Derived Objects===
 
===Derived Objects===
Line 853: Line 891:
 
Here's how to get a list of them.
 
Here's how to get a list of them.
  
−
* [[truxton_get_data_type_names]] - Retrieves mappings from <code>[DataType]</code> table
+
* [[truxton_get_content_status_names]] - Retrieves mappings from the <code>[ContentStatus]</code> table
−
* [[truxton_get_depot_status_names]] - Retrieves mappings from <code>[DepotStatus]</code> table
+
* [[truxton_get_data_type_names]] - Retrieves mappings from the <code>[DataType]</code> table
−
* [[truxton_get_depot_type_names]] - Retrieves mappings from <code>[DepotType]</code> table
+
* [[truxton_get_depot_status_names]] - Retrieves mappings from the <code>[DepotStatus]</code> table
−
* [[truxton_get_entity_type_names]] - Retrieves mappings from <code>[EntityType]</code> table
+
* [[truxton_get_depot_type_names]] - Retrieves mappings from the <code>[DepotType]</code> table
−
* [[truxton_get_event_type_names]] - Retrieves mappings from <code>[EventType]</code> table
+
* [[truxton_get_entity_type_names]] - Retrieves mappings from the <code>[EntityType]</code> table
−
* [[truxton_get_file_type_names]] - Retrieves mappings from <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code>  table
+
* [[truxton_get_event_type_names]] - Retrieves mappings from the <code>[EventType]</code> table
−
* [[truxton_get_file_type_mime_types]] - Retrieves mappings from <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code>  table
+
* [[truxton_get_file_type_names]] - Retrieves mappings from the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code>  table
−
* [[truxton_get_group_entry_type_names]] - Retrieves mappings from <code>[GroupEntryType]</code> table
+
* [[truxton_get_file_type_mime_types]] - Retrieves mappings from the <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code>  table
−
* [[truxton_get_group_status_names]] - Retrieves mappings from <code>[GroupStatus]</code> table
+
* [[truxton_get_group_entry_type_names]] - Retrieves mappings from the <code>[GroupEntryType]</code> table
−
* [[truxton_get_group_type_names]] - Retrieves mappings from <code>[GroupType]</code> table
+
* [[truxton_get_group_status_names]] - Retrieves mappings from the <code>[GroupStatus]</code> table
−
* [[truxton_get_investigation_status_names]] - Retrieves mappings from <code>[InvestigationStatus]</code> table
+
* [[truxton_get_group_type_names]] - Retrieves mappings from the the <code>[GroupType]</code> table
−
* [[truxton_get_investigation_type_names]] - Retrieves mappings from <code>[InvestigationType]</code> table
+
* [[truxton_get_investigation_status_names]] - Retrieves mappings from the <code>[InvestigationStatus]</code> table
−
* [[truxton_get_location_type_names]] - Retrieves mappings from <code>[LocationType]</code> table
+
* [[truxton_get_investigation_type_names]] - Retrieves mappings from the <code>[InvestigationType]</code> table
−
* [[truxton_get_media_status_names]] - Retrieves mappings from <code>[MediaStatus]</code> table
+
* [[truxton_get_location_type_names]] - Retrieves mappings from the <code>[LocationType]</code> table
−
* [[truxton_get_media_type_names]] - Retrieves mappings from <code>[MediaType]</code> table
+
* [[truxton_get_media_status_names]] - Retrieves mappings from the <code>[MediaStatus]</code> table
−
* [[truxton_get_message_address_type_names]] - Retrieves mappings from <code>[MessageAddressType]</code> table
+
* [[truxton_get_media_type_names]] - Retrieves mappings from the <code>[MediaType]</code> table
−
* [[truxton_get_message_type_names]] - Retrieves mappings from <code>[MessageType]</code> table
+
* [[truxton_get_message_address_type_names]] - Retrieves mappings from the <code>[MessageAddressType]</code> table
−
* [[truxton_get_object_type_names]] - Retrieves mappings from <code>[ObjectType]</code> table
+
* [[truxton_get_message_type_names]] - Retrieves mappings from the <code>[MessageType]</code> table
−
* [[truxton_get_origin_names]] - Retrieves mappings from <code>[Origin]</code> table
+
* [[truxton_get_object_type_names]] - Retrieves mappings from the <code>[ObjectType]</code> table
−
* [[truxton_get_relation_type_names]] - Retrieves mappings from <code>[RelationType]</code> table
+
* [[truxton_get_origin_names]] - Retrieves mappings from the <code>[Origin]</code> table
−
* [[truxton_get_url_type_names]] - Retrieves mappings from <code>[URLType]</code> table
+
* [[truxton_get_relation_type_names]] - Retrieves mappings from the <code>[RelationType]</code> table
−
* [[truxton_get_website_method_names]] - Retrieves mappings from <code>[WebsiteMethod]</code> table
+
* [[truxton_get_url_type_names]] - Retrieves mappings from the <code>[URLType]</code> table
 +
* [[truxton_get_website_method_names]] - Retrieves mappings from the <code>[WebsiteMethod]</code> table
  
 
==URL==
 
==URL==
Line 940: Line 979:
 
==Debugging==
 
==Debugging==
 
* [[truxton_dump_black_box]] - Dumps the [[Black Box|black box]] of the given process id
 
* [[truxton_dump_black_box]] - Dumps the [[Black Box|black box]] of the given process id
 +
* [[truxton_set_black_box_activity]] - Sets the activity taking place at a location in the [[Black Box|black box]]
 
* [[truxton_set_black_box_source_code_location]] - Sets a location in the [[Black Box|black box]]
 
* [[truxton_set_black_box_source_code_location]] - Sets a location in the [[Black Box|black box]]
 +
* [[truxton_set_black_box_thread_type]] - Sets type of the thread in the [[Black Box|black box]]
 
* [[truxton_set_black_box_value]] - Sets a debugging value in the [[Black Box|black box]]
 
* [[truxton_set_black_box_value]] - Sets a debugging value in the [[Black Box|black box]]
  

Latest revision as of 06:21, 20 February 2026

Truxton functionality is exposed to the C programming world as a DLL named TruxtonCAPI.dll in the C:\Program Files\Truxton\SDK folder. This DLL can be called from any programming language that has the ability to make operating system calls.

Philosophy

The API is considered to be "flat" in that only integers and ASCII character strings are used in the interface. This was chosen to make it easy for other languages to call the API. The coding convention is all lower case names with underscores separating words. Truxton is a member of the east const posse.

Preparing for Use

Truxton does not ship a linker library for TruxtonCAPI.dll in order to free the developer to use any particular compiler. If you want to link TruxtonCAPI.dll with your own C/C++ code, you will need to generate a linker library.

Alternatively, you can use a plugin pattern of calling LoadLibrary followed by many calls to GetProcAddress to get the function pointers. This is a lot of work and very prone to errors.

Generating a Linker Library for Microsoft Compilers

You can download a free Visual Studio from Microsoft. The steps to produce a LIB file from a DLL are:

  1. Generate a module definition (DEF) file from TruxtonCAPI.dll.
  2. Use the DEF file to create the linker library (LIB) file.

The following Powershell script will create the lib file for you. 

$msvc = "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x64\"
$dumpbin = $msvc + "dumpbin.exe"
$lib = $msvc + "lib.exe"

$lines = (& $dumpbin /exports "C:\Program Files\Truxton\SDK\TruxtonCAPI.dll")

Add-Content TruxtonCAPI.def "EXPORTS"

foreach ( $line in $lines )
{
   if ( $line.Contains(" = ") -EQ $true )
   {
      Add-Content TruxtonCAPI.def $line.SubString($line.IndexOf(" = ") + 3)
   }
}

(& $lib /def:TruxtonCAPI.def /out:TruxtonCAPI.lib /machine:x64)

Remove-Item TruxtonCAPI.def, TruxtonCAPI.exp

In your project folder, execute the script from Powershell to create TruxtonCAPI.lib: 

.\MakeDef.ps1

API Groups

The API is broken down into the different areas of Truxton.

Initialization

Functions

Maintenance

These functions are used to perform periodic maintenance tasks in Truxton. These will send messages to the maintenance ETL which will carry out the tasks.

Hash Sets

These functions handle the creation of hash set files

Database Identification

File Identification

Triage Loads

GUI Colors

Artifacts

Artifacts are pieces of information that are also known as entities.

Derived Objects

The following APIs are used to create objects with an artifact as their parent.

Artifact Type

This API is used to create custom types of artifacts. If one of the default artifact types don't suite your purpose, you are free to create your own.

BOLOs

These are the APIs used to create a be-on-the-lookout alert criteria.

Child Files

A child file is one that you have created and need to save in Truxton.

Derived Objects

Communications

These are the APIs that deal with humans communicating via email, SMS, chat, etc.

Derived Objects

Enumeration

This set of functions allow you to get things out of Truxton.

ETL Application Creation

Debugging

Event

If you need to save a significant place in time, use the following functions. The data structure these API encapsulate is similar to the one used in the event message. These will create a record in the [Event] table.

Derived Objects

The following APIs are used to create objects with an event as their parent.

  • truxton_event_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_event_tag - Creates a tag and puts it on this event. This data will be saved to the [Tagged] table.

Event Type

This API is used to create custom types of events. If one of the default event types don't suite your purpose, you are free to create your own.

EXIF (Camera Information)

This set if APIs deal with information from the EXIF section of files. The primary file types that contain EXIF are JPG and TIFF. Not all of the fields of this object are stored in the database. Internally, Truxton has one parser for EXIF and uses that information to perform other forensic tasks.

These functions give you access to a data structure equivalent to the one used in EXIF messages.

Persisted in Database

The following APIs deal with things that are stored in the database.

Not in Database

The following APIs are useful for forensic processing but not saved in the database. Internally, when Truxton finds EXIF data, it will create and populate an object with that information. All forensic processing is performed on that object. The information presented here, while not stored in the database, was used by Truxton to exploit the camera information data.

Derived Objects

  • truxton_exif_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_exif_tag - Creates a tag and puts it on this EXIF object. This data will be saved to the [Tagged] table.

File

File Actions

These are things your can do to a file. These are not data items stored in the database.

File IO

File Record Fields

Derived Objects

The following APIs are used to create objects with a file as their parent.

File Export

File Type

Group

A group is a collection of things scoped to an investigation and investigator. This is the technology behind marking things as Findings.

Investigation

Investigation Event

This set of API's allow you to add records to the [InvestigationEvent] table.

Jurisdiction

Jurisdictions is a way to keep track of work done on behalf of others. Say you're a regional forensics lab and your boss asks you, "How much work did we do for Mayberry last quarter?"

Geographic Location

Derived Objects

The following APIs are used to create objects with a location as their parent.

Media

These are the API's that allow you to add to the [Media] table in the database.

Derived Objects

The following APIs are used to create objects with a media as their parent.

Maintenance Functions

Message

This is the message sent on the message bus between the ETL processes.

Derived Objects

The following APIs are used to create objects from the given message.

Message Addresses

Message Participant

This is basically a useless API. It is used internally during the enumeration of the participants of a communication.

Options

Truxton "options" are otherwise known as configuration settings, command line options, etc. They are configuration items that your program can use.

Note

This set of API's allow you to add records to the [InvestigatorNote] table.

Relation

These functions let you add to the [Relation] table in Truxton. This is how to establish some sort of relationship between items in Truxton to create a graph. Relations in Truxton adhere to the form of "A is a thing of B" Truxton is not focused on exploring graphs (cliques anyone?) but needed a way to establish simple relationships between objects.

Sensitive Site List

These are the API's that allow you to manipulate a sensitive site list for Truxton. These will add records to the [SensitiveSiteList] and [SensitiveSite] tables.

Subject

These are the API's that allow you to add an investigative subject to Truxton. These will add records to the [Suspect] table.

Derived Objects

The following APIs are used to create objects with a subject as their parent.

  • truxton_subject_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_subject_tag - Associating a tag with this subject. This data will be saved to the [Tagged] table.

Types

Truxton has many different types in it. They are generally integer values that have meanings. Here's how to get a list of them.

URL

These functions encapsulate a data structure similar to the one used in the Website Visit message.

Derived Objects

The following APIs are used to create objects with an event as their parent.

  • truxton_url_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_url_tag - Creates a tag and puts it on this location. This data will be saved to the [Tagged] table.

USB Device

Derived Objects

  • truxton_usb_add_note - Creates an investigator's note. This data will be saved to the [InvestigatorNote] table.
  • truxton_usb_tag - Associate a tag with this USB device. This data will be saved to the [Tagged] table.

Debugging

Samples

Retrieved from "https://truxwiki.com/index.php?title=Truxton_C_API&oldid=10807"