Difference between revisions of "Truxton artifact get file id"

From truxwiki.com
Jump to navigation Jump to search
(Created page with "This retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this artifact came from. This corresponds to the <code>[ID]</code> column of...")
 
Line 3: Line 3:
  
 
=Syntax=
 
=Syntax=
<syntaxhighlight lang="C">
+
<source lang="C">
 
void truxton_artifact_get_file_id( uint64_t artifact_handle, char * destination_string, size_t max_size );
 
void truxton_artifact_get_file_id( uint64_t artifact_handle, char * destination_string, size_t max_size );
</syntaxhighlight>
+
</source>
  
 
=Parameters=
 
=Parameters=
Line 24: Line 24:
 
   char guid_string[ 40 ];
 
   char guid_string[ 40 ];
  
   truxton_artifact_get_file_id( message_handle, guid_string, sizeof(guid_string));
+
   truxton_artifact_get_file_id( artifact_handle, guid_string, sizeof(guid_string) );
 +
  printf( "File ID is %s\n", guid_string );
  
   printf( "File ID is %s\n", guid_string);
+
  truxton_artifact_get_media_id( artifact_handle, guid_string, sizeof(guid_string) );
 +
  printf( "Media ID is %s\n", guid_string );
 +
 
 +
  truxton_artifact_get_object_id( artifact_handle, guid_string, sizeof(guid_string) );
 +
   printf( "Object ID is %s\n", guid_string );
 +
 
 +
  uint64_t value = truxton_artifact_get_object_type( artifact_handle );
 +
  printf( "Object type is %" PRIu64 "\n", value );
 +
 
 +
  value = truxton_artifact_get_data_type( artifact_handle );
 +
  printf( "Data type is %" PRIu64 "\n", value );
 +
 
 +
  value = truxton_artifact_get_offset( artifact_handle );
 +
  printf( "Offset is %" PRIu64 "\n", value );
 +
 +
  value = truxton_artifact_get_length( artifact_handle );
 +
  printf( "Length is %" PRIu64 "\n", value );
 +
 
 +
  value = truxton_artifact_get_type( artifact_handle );
 +
  printf( "Type is %" PRIu64 "\n", value );
 
}
 
}
 
</source>
 
</source>

Revision as of 15:07, 3 November 2020

This retrieves the GUID of the file this artifact came from. This corresponds to the [ID] column of the [File] table.

Syntax

void truxton_artifact_get_file_id( uint64_t artifact_handle, char * destination_string, size_t max_size );

Parameters

artifact_handle

The handle to a message created by the truxton_artifact_create call.

destination_string

The string to be written to.

max_size

The maximum number of characters that can be written to destination_string.

Sample

void dump_artifact(uint64_t artifact_handle)
{
   char guid_string[ 40 ];

   truxton_artifact_get_file_id( artifact_handle, guid_string, sizeof(guid_string) );
   printf( "File ID is %s\n", guid_string );

   truxton_artifact_get_media_id( artifact_handle, guid_string, sizeof(guid_string) );
   printf( "Media ID is %s\n", guid_string );

   truxton_artifact_get_object_id( artifact_handle, guid_string, sizeof(guid_string) );
   printf( "Object ID is %s\n", guid_string );

   uint64_t value = truxton_artifact_get_object_type( artifact_handle );
   printf( "Object type is %" PRIu64 "\n", value );

   value = truxton_artifact_get_data_type( artifact_handle );
   printf( "Data type is %" PRIu64 "\n", value );

   value = truxton_artifact_get_offset( artifact_handle );
   printf( "Offset is %" PRIu64 "\n", value );
 
   value = truxton_artifact_get_length( artifact_handle );
   printf( "Length is %" PRIu64 "\n", value );

   value = truxton_artifact_get_type( artifact_handle );
   printf( "Type is %" PRIu64 "\n", value );
}