Python

Truxton supports Python 3.8 via the Truxton.pyd library.

You must use the "import" directive to load this. Got to the C:\Program Files\Truxton\SDK folder and start Python.

import truxton

When you import truxton you will get all of the predefined constants for file type, data type, origins, locations, messages, entities, relations, events, media, objects, url methods, and urls. You can see them all by issuing a dir command.

>>> dir(truxton)

This will allow your Python code to use the same constant names as C, C++ and C# code.

>>> print(truxton.Type_JPEG)
203

Once you have this working, you can start playing with Truxton.

import truxton

def main():
  t = truxton.create()
  print(t.version())

if __name__ == "__main__":
  main()

Style

In general, when using a Truxton API, you will follow this pattern:

1. Create the object
2. Set the data members of the object
3. Call save() to store the object in the Truxton database.

Until you call save(), nothing will appear in Truxton.

Classes

Truxton exposes several classes to Python.

• TruxtonArtifact - For adding records to the Entity table.
• TruxtonChildFileIO - For writing a file to Truxton.
• TruxtonETL - For becoming a Truxton ETL process.
• TruxtonEvent - For adding records to the Event table.
• TruxtonEventType - For adding custom event types to Truxton.
• TruxtonEXIF - For adding records to the EXIF table.
• TruxtonFileIO - For working with a read-only file stored in Truxton.
• TruxtonFileType - For adding new file types to Truxton.
• TruxtonInvestigation - For creating new investigations in Truxton.
• TruxtonLocation - For adding geographic coordinates to the Location table.
• TruxtonMedia - For adding media to Truxton.
• TruxtonMessage - The way Truxton ETL processes communicate.
• TruxtonObject - The object responsible for a connection to Truxton.
• TruxtonRelation - For adding records to the Relation table for relating two items in Truxton.
• TruxtonUrl - For adding records to the WebsiteVisit table.
• TruxtonUSB - For adding records to the USBDevice table.

Remarks

The Python API is designed primarily for programs to contribute to Truxton.

Truxton.pyd was developed using the C API with a thin adapter layer of code to translate from Python provider semantics to Truxton calls.

Samples

• Register a New File Type
• ETL for File Identification
• ETL for File Exploitation