Truxton group get created

This gets the creation date of the group.

Syntax

uint64_t truxton_group_get_created( uint64_t group_handle );

Parameters

group_handle

The handle created by truxton_group_create() or truxton_investigation_create_group().

Return value

The creation date of the group in FILETIME ticks.

Sample

void create_my_things(uint64_t investigation_handle)
{
    if (investigation_handle == 0)
    {
        return;
    }

    uint64_t truxton_handle = truxton_investigation_get_truxton( investigation_handle );
    uint64_t group_handle = truxton_group_create( truxton_handle );
 
    truxton_group_set_id( group_handle, "47726F75-7020-5361-6D70-6C65636F6465" );
    truxton_group_set_name( group_handle, "My Things" );
    truxton_group_set_description( group_handle, "These are my things" );
    truxton_group_set_is_default( group_handle, 1 );
    truxton_group_set_type( group_handle, GROUP_TYPE_USER );
    printf( "Type: %" PRIu64 "\n", truxton_group_get_created( group_handle ) );

    if ( truxton_group_save( group_handle ) != 0 )
    {
        char guid[MINIMUM_GUID_STRING_BUFFER_SIZE + 5];

        truxton_group_get_id( group_handle, guid, sizeof(guid) );
        truxton_investigation_set_active_group_id( investigation_handle, guid );
    }

    truxton_group_destroy( group_handle );
}

The PRIu64 in the sample code above is a standard way of formatting a 64-bit unsigned integer in C. Over the years, different compilers on different operating systems used different format specifiers for things, these PRI macros, along with some tricky string concatenation the compilers perform for you, allow you to maintain a single code base without a bunch of macro magic.