TruxtonMedia

This class represents a piece of media in Truxton.

Attributes and Methods

addroot()

This method will create a root file in the media. All other files will ultimately be children of this file. The return value of this method is a child file object.

case

A case number for this media. Even though media came in under one case doesn't mean it can't be part of another. This corresponds to the CaseNumber column of the Media table.

configid

This is the path the media took through the exploitation process. This corresponds to the LoadConfigurationID column of the Media table. It should be set to one of the values in the ID column of the LoadConfiguration table or a predefined constant.

created

When the media was created in FILETIME ticks. This corresponds to the Created column of the Media table.

description

A description of the media. This corresponds to the Description column of the Media table.

evidencebag

A description of the media. This corresponds to the EvidenceBag column of the Media table.

expires

When the media should be automatically purged from Truxton in FILETIME ticks. This corresponds to the Expires column of the Media table. By default, the expiration date of media is 99 years from the creation of the media.

id

A GUID for the media. This corresponds to the ID column of the Media table.

latitude

The latitude portion of the geographic coordinate using the WGS84 ellipsoid of where this media was seized. This corresponds to the Latitude column of the Media table.

longitude

The longitude portion of the geographic coordinate using the WGS84 ellipsoid of where this media was seized. Many thanks go to John Harrison for his work. This corresponds to the Longitude column of the Media table.

name

This is a human friendly name for the media. This corresponds to the Name column of the Media table.

originator

The name of the organization or person who is responsible for this media. For example, if you are a regional center, this would identify the originating organization that asked you to look at the media. This corresponds to the Originator column of the Media table.

percentcomplete

An estimation of how far along the system is in the exploitation of this media. This corresponds to the PercentComplete column of the Media table.

save()

This will commit the information to the Media table. It will return True if the record was saved to the database, False if there was an error.

status

The represents the status of the media. This corresponds to the MediaStatusID column of the Media table. It should be a value from the ID column of the MediaStatus table or a predefined constant.

type

The is an identifier for the type of media that was loaded. This corresponds to the MediaTypeID column of the Media table. It should be a value from the ID column of the MediaType table or a predefined constant.

tag(tag, reason, origin)

This creates a tag associated with this media in Truxton. The tag parameter is a short, one or two word, bit of text that will be displayed in the UI. The reason a sentence explaining why this media was tagged. The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2). It will return True if the tag was associated with the media, False on failure.

updated

When the media was last updated in FILETIME ticks. This corresponds to the LastUpdated column of the Media table.

Sample

 1 import truxton
 2 import shutil
 3 
 4 from datetime import datetime
 5 from calendar import timegm
 6 from pathlib import Path
 7 
 8 EPOCH_AS_FILETIME = 116444736000000000
 9 HUNDREDS_OF_NANOSECONDS = 10000000
10 
11 EVENT_TYPE_FBI = 20001
12 
13 def date_to_filetime(dt):
14   return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)
15 
16 def add_file(parent_truxton_file, filename):
17   source_file = open(filename, "rb")
18   child = parent_truxton_file.newchild()
19   child.name = Path(filename).name
20   shutil.copyfileobj(source_file, child)
21   source_file.close()
22   child.save()
23   return child
24 
25 def add_media(t):
26   media = t.newmedia()
27 
28   media.name = "Public Documents"
29   media.description = "Publicly available documents"
30   media.case = "DC-SNAFU-2016.2020"
31   media.evidencebag = "EV-0937459386623-a"
32   media.originator = "Jeffrey Jensen"
33   media.latitude = 38.897661
34   media.longitude = -77.036458
35   media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
36   media.save()
37 
38   return media
39 
40 def add_cs(parent_file ):
41   child_file = add_file(parent_file, "cs.jpg")
42 
43   gps = child_file.newlocation()
44   gps.type = truxton.LOCATION_TYPE_MEETING
45   gps.latitude = 51.487329
46   gps.longitude = -0.124057
47   gps.label = "HQ"
48   gps.when= date_to_filetime(datetime.fromisoformat("2016-04-01T12:00:00-05:00"))
49   gps.save()
50 
51 def create_investigation(t):
52   investigation = t.newinvestigation()
53 
54   investigation.name = "Collusion"
55   investigation.description = "United States vs. John Smith"
56   investigation.case = "DC-SNAFU-2016.2020"
57   investigation.status = truxton.INVESTIGATION_STATUS_OPEN
58   investigation.type = truxton.INVESTIGATION_TYPE_FRAUD
59   investigation.save()
60 
61   return investigation
62 
63 def main():
64   t = truxton.create()
65 
66   new_type = t.neweventtype()
67   new_type.id = EVENT_TYPE_FBI
68   new_type.name = "FBI Actions"
69   new_type.save()
70 
71   investigation = create_investigation(t)
72 
73   media = add_media(t)
74 
75   root_file = media.addroot()
76   root_file.save()
77 
78   investigation.addmedia(media.id)
79 
80   add_cs(root_file)
81 
82 if __name__ == "__main__":
83   main()