Truxton investigation remove media

Removes a piece of media from an investigation. This will delete a record in the [InvestigationMedia].

Syntax

int truxton_investigation_remove_media( uint64_t investigation_handle, char const * media_id );

Parameters

investigation_handle

The handle to the investigation object. This handle comes from calling truxton_investigation_create().

media_id

The string representation of a GUID. This value should be present in the [ID] column of the [Media] table.

Return value

A non-zero value on success, zero on failure.

Remarks

This does not delete the media from Truxton. It merely disassociates it from the investigation.

Sample

void drop_media( uint64_t truxton, char const * investigation_guid, char const * media_guid )
{
   uint64_t investigation = truxton_investigation_create( truxton );

   truxton_investigation_set_id( investigation, investigation_guid );

   if ( truxton_investigation_remove_media( investigation, media_guid ) != 0 )
   {
      printf("Removed Media %s from investigation %s.\n", media_guid, investigation_guid );
   }

   truxton_investigation_destroy( investigation );
}