Difference between revisions of "TruxtonEXIF"

From truxwiki.com
Jump to navigation Jump to search
Line 116: Line 116:
 
=Sample=
 
=Sample=
  
<syntaxhighlight lang="Python" highlight="63-70">
+
<syntaxhighlight lang="Python" highlight="41-47">
 
import truxton
 
import truxton
 
import shutil
 
import shutil
Line 126: Line 126:
 
EPOCH_AS_FILETIME = 116444736000000000
 
EPOCH_AS_FILETIME = 116444736000000000
 
HUNDREDS_OF_NANOSECONDS = 10000000
 
HUNDREDS_OF_NANOSECONDS = 10000000
 
EVENT_TYPE_FBI = 20001
 
  
 
def date_to_filetime(dt):
 
def date_to_filetime(dt):
 
   return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)
 
   return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)
 
def create_event_type(t, id, name):
 
  event_type = t.neweventtype()
 
  event_type.id = id
 
  event_type.name = name
 
  event_type.save()
 
  
 
def add_file(parent_truxton_file, filename):
 
def add_file(parent_truxton_file, filename):
Line 146: Line 138:
 
   child.save()
 
   child.save()
 
   return child
 
   return child
 
def add_event(parent_file, start, end, title, description, type):
 
  event = parent_file.newevent()
 
  event.start = date_to_filetime(datetime.fromisoformat(start))
 
  event.end = date_to_filetime(datetime.fromisoformat(end))
 
  event.title = title
 
  event.description = description
 
  event.type = type
 
  event.save()
 
  return event
 
  
 
def add_media(t):
 
def add_media(t):
Line 168: Line 150:
 
   media.longitude = -77.036458
 
   media.longitude = -77.036458
 
   media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
 
   media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
 
+
   media.save()
   if media.save():
 
    print("Media saved")
 
  else:
 
    print("Media not saved")
 
  
 
   return media
 
   return media
  
def add_ec(parent_file ):
+
def add_cs(parent_file ):
   child_file = add_file(parent_file, "JW-v-DOJ-reply-02743.pdf")
+
   child_file = add_file(parent_file, "cs.jpg")
  
   url = child_file.newurl()
+
   exif = child_file.newexif()
   url.url = "https://www.judicialwatch.org/documents/jw-v-doj-reply-02743/"
+
   exif.latitude = 51.487329
   url.localfilename = "JW-v-DOJ-reply-02743.pdf"
+
   exif.longitude = -0.124057
   url.type = truxton.URL_TYPE_FIREFOX
+
   exif.make = "Universal"
   url.method = truxton.URL_METHOD_TYPE_CLICKED_ON_A_LINK
+
   exif.model = "Minute 16"
  url.format = truxton.URL_FORMAT_ASCII
+
   exif.devicetime = date_to_filetime(datetime.fromisoformat("2016-04-01T12:00:00-05:00"))
   url.when = date_to_filetime(datetime.fromisoformat("2020-05-20T00:00:00-05:00"))
+
   exif.save()
   url.save()
 
 
 
  add_event( child_file, "2016-07-31T12:00:00-05:00", "2016-07-31T12:00:00-05:00", "Crossfire Hurricane Created", "At FBI HQ", EVENT_TYPE_FBI )
 
  add_event( child_file, "2016-07-27T12:00:00-05:00", "2016-07-27T12:00:00-05:00", "Legat called needing to meet US ambassador", "In London", EVENT_TYPE_FBI )
 
  add_event( child_file, "2016-07-29T12:00:00-05:00", "2016-07-29T12:00:00-05:00", "FBI Receives Downer Info from Legat", "Probably legat London", EVENT_TYPE_FBI )
 
  
 
def main():
 
def main():
 
   t = truxton.create()
 
   t = truxton.create()
 
  create_event_type(t, EVENT_TYPE_FBI, "FBI Actions" )
 
  
 
   media = add_media(t)
 
   media = add_media(t)
Line 202: Line 173:
 
   root_file.save()
 
   root_file.save()
  
   add_ec(root_file)
+
   add_cs(root_file)
  
 
if __name__ == "__main__":
 
if __name__ == "__main__":
 
   main()
 
   main()
 
</syntaxhighlight>
 
</syntaxhighlight>

Revision as of 16:29, 28 May 2020

This class lets you add to the EXIF table in Truxton.

Attributes and Methods

altitude

The altitude in meters.

altitudeoffset

The offset into the file where the altitude was found.

bodyserialnumber

The serial number of the body of the imaging device.

bodyserialnumberoffset

The offset into the file where the body serial number was found

devicetime

The timestamp of the image taken from the clock of the imaging device.

devicetimeoffset

The offset into the file where the device time was found.

fileid

The GUID of the file this camera information came from. This corresponds to the FileID column of the EXIF table.

focallength

The focal length of the lens in 35mm equivalent.

focallengthoffset

The offset in the file where focal length was found.

gpstime

The timestamp from a GPS unit in the imaging device.

gpstimeoffset

The offset in the file where the GPS time was found.

heading

The compass heading of the image. The direction the camera was pointing when the image was taken.

headingoffset

The offset into the file where the heading was found.

id

This is the GUID of the record. It becomes non-zero after save() has been called. This corresponds to the ID column of the EXIF table.

latitude

The latitude portion of the geographic coordinate using the WGS84 ellipsoid.

latitudeoffset

The offset into the file where the latitude was found.

lensserialnumber

The serial number of the lens.

lensserialnumberoffset

The offset into the file where the lens serial number was found.

longitude

The longitude portion of the geographic coordinate using the WGS84 ellipsoid. Many thanks go to John Harrison for his work.

longitudeoffset

The offset into the file where longitude was found.

make

The manufacturer of the imaging device.

makeoffset

The offset into the file where the make was found.

mediaid

This is the GUID of the media this artifact came from. This corresponds to the MediaID column of the Entity table.

model

The model of the imaging device.

modeloffset

The offset into the file where the model was found.

save()

This will commit the information to the Entity table. It will return True if the record was saved to the database, False if there was an error.

shuttercount

The number of times the shutter has been activated on the imaging device.

shuttercountoffset

The offset into the file where shutter count was found.

tag(tag, reason, origin)

This creates a tag associated with this camera information in Truxton. The tag parameter is a short, one or two word, bit of text that will be displayed in the UI. The reason a sentence explaining why this camera information was tagged. The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2). It will return True if the tag was associated with the camera information, False on failure.

thumbnaillength

The length of the thumbnail of this image.

thumbnaillengthoffset

The offset in the file where the length of the thumbnail image was found.

thumbnailoffset

The offset of the thumbnail image.

thumbnailoffsetoffset

The offset in the file where thumbnail offset was found.

Sample

import truxton
import shutil

from datetime import datetime
from calendar import timegm
from pathlib import Path

EPOCH_AS_FILETIME = 116444736000000000
HUNDREDS_OF_NANOSECONDS = 10000000

def date_to_filetime(dt):
  return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)

def add_file(parent_truxton_file, filename):
  source_file = open(filename, "rb")
  child = parent_truxton_file.newchild()
  child.name = Path(filename).name
  shutil.copyfileobj(source_file, child)
  source_file.close()
  child.save()
  return child

def add_media(t):
  media = t.newmedia()

  media.name = "Public Documents"
  media.description = "Publicly available documents"
  media.case = "DC-SNAFU-2016.2020"
  media.evidencebag = "EV-0937459386623-a"
  media.originator = "Jeffrey Jensen"
  media.latitude = 38.897661
  media.longitude = -77.036458
  media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
  media.save()

  return media

def add_cs(parent_file ):
  child_file = add_file(parent_file, "cs.jpg")

  exif = child_file.newexif()
  exif.latitude = 51.487329
  exif.longitude = -0.124057
  exif.make = "Universal"
  exif.model = "Minute 16"
  exif.devicetime = date_to_filetime(datetime.fromisoformat("2016-04-01T12:00:00-05:00"))
  exif.save()

def main():
  t = truxton.create()

  media = add_media(t)

  root_file = media.addroot()
  root_file.save()

  add_cs(root_file)

if __name__ == "__main__":
  main()