TruxtonMessage

This class encapsulates the message object that is the basis for the Truxton's ETL pipeline.

Attributes and Methods

depotid

This is the GUID of the depot file that stores the contents of the file. This identifier corresponds to the [ID] column of the [Depot] table.

depotlength

The number of bytes in the depot file that make up this file's contents. This corresponds to the [Length] column of the [Content] table.

depotname

The name of the depot that contains the file's contents. This corresponds to the [Filename] column of the [Depot] table.

depotoffset

The offset into the depot where the first byte of the file resides. This corresponds to the [Offset] column of the [Content] table.

dontroute

This integer controls whether the message should be further routed through the message bus. This is usually only set when debugging an ETL process.

file()

This method will return a read-only file that you can use to read the contents of the file.

fileid

This is the GUID of the file. This identifier corresponds to the [ID] column of the [File] table.

filetype

The type of the file. This corresponds to the [FileTypeID] column of the [File] table.

hash

The MD5 hash of the contents of the file. This corresponds to the [HashID] column of the [File] table.

media()

Retrieves the media object associated with this message.

mediaid

This is the GUID of the file. This identifier corresponds to the [MediaID] column of the [File] table.

parentid

This is the GUID of the file. This identifier corresponds to the [ParentID] column of the [File] table.

priority

This integer value controls the prioriy of the message. High values have greater priority than lower values.

queueempty

This integer tells you if your message queue is empty. When this value is non-zero, the message queue is empty.

route()

This method will send the message using the current route to the message bus.

routeid

This integer represents the path that files should take through the exploitation processes. It should be a value in the [LoadConfigurationID] column of the [ETLRoute] table.

signature

The first four bytes of the file stored as an integer. This corresponds to the [Signature] column of the [File] table.

Sample

import truxton

def main():
  etl = truxton.etl()
  etl.name = "My New ETL"
  etl.description = "This ETL processes files in the Truxton system"
  etl.queue = "anewetl"
  etl.stage = 40
  etl.expanderid = 0x05fc0bf6a57726a0
  etl.version = 0
  etl.depot = "thumbnail"
  etl.depotype = truxton.DEPOT_TYPE_THUMBNAILS
  etl.poly = 0

  etl.addarg("--verbose")
  etl.addarg("Yes")

  etl.sendmefileid("5ecbebc4-9937-2b88-f691-91a800000024")
  etl.sendmehash("baa51f0cc8361660df911e06e7637485")
  etl.sendmefiles(truxton.Type_JPEGWithExif, 100)
  etl.sendmefiles(truxton.Type_TIFFWithExif, 500)
  etl.sendmelocalfile( "C:/Test Files/Video/Fragmented/Recovered Video.mp4", truxton.Type_MPEG4Video, 0 )

  message = etl.getmessage()

  while message is not None:
    file_in_truxton = message.file()

    # YOUR FORENSIC CODE GOES HERE

    line_of_text = file_in_truxton.readline()

    if "[SetupAPI" in line_of_text:
      child = file_in_truxton.newchild()
      child.name = "Child file from New ETL"
      child.write("This is the file you were looking for.")
      child.save()

    message.type = 11000;
    message.route()

    # Pause here until we get another message from the "anewetl" message queue
    message = etl.getmessage()

if __name__ == "__main__":
  main()