Truxton create investigation hashset

This will create a hash set file of every unique hash in an investigation.

Syntax

void truxton_create_investigation_hashset( uint64_t truxton_handle, char const * investigation_id, char const * filename );

Parameters

truxton_handle

The handle created by the truxton_create call.

investigation_id

The string representation of a globally unique identifier of the investigation to export the hashes from. This corresponds to the [ID] column of the [Investigation] table.

filename

The name of the file where the hashes will be written.

Sample

void save_truxton_hash_set( char const * investigation_id )
{
   char output_filename[ MAX_PATH ];

   strcpy_s( output_filename, sizeof( output_filename ), "\\\\Server\\Hashsets\\Investigation_" );
   strcat_s( output_filename, sizeof( output_filename ), investigation_id );
   strcat_s( output_filename, sizeof( output_filename ), ".hashset" );

   uint64_t truxton = truxton_create();

   truxton_create_investigation_hashset( truxton, investigation_id, output_filename );

   truxton_destroy( truxton );
}