Difference between revisions of "Truxton event set start"
Jump to navigation
Jump to search
(Created page with "This sets the beginning of the event. =Syntax= <source lang="C"> void truxton_event_set_start( uint64_t event_handle, uint64_t ticks ); </source> =Parameters= ==<code>event_...") |
|||
| Line 1: | Line 1: | ||
This sets the beginning of the event. | This sets the beginning of the event. | ||
| + | This corresponds to the <code>[Start]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. | ||
=Syntax= | =Syntax= | ||
| Line 12: | Line 13: | ||
==<code>ticks</code>== | ==<code>ticks</code>== | ||
The date in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | The date in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks. | ||
| − | |||
=Sample= | =Sample= | ||
Revision as of 03:43, 13 November 2020
This sets the beginning of the event.
This corresponds to the [Start] column of the [Event] table.
Syntax
void truxton_event_set_start( uint64_t event_handle, uint64_t ticks );
Parameters
event_handle
The handle to an event created by the truxton_event_create call.
ticks
The date in FILETIME ticks.
Sample
void initialize_investigation(uint64_t truxton, char const * media_id, char const * file_id)
{
uint64_t event_handle = truxton_event_create(truxton);
truxton_event_set_title( event_handle, "Phase 1" );
truxton_event_set_description( event_handle, "As described by SA Barnett" );
truxton_event_set_start( event_handle, get_ticks( "2016-07-31T12:00:00-05:00" ) );
truxton_event_set_end( event_handle, get_ticks( "2017-01-04T12:00:00-05:00" ) );
truxton_event_set_type( event_handle, EVENT_TYPE_ADDED_BY_ANALYST );
truxton_event_set_media_id( event_handle, media_id );
truxton_event_set_file_id( event_handle, file_id );
truxton_event_save( event_handle );
char id[ 65 ];
truxton_event_get_id( event_handle, id, sizeof( id ) );
printf( "Event ID is %s\n", id );
truxton_event_destroy(artifact);
}
