Difference between revisions of "Truxton artifact get file id"
Jump to navigation
Jump to search
(Created page with "This retrieves the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this artifact came from. This corresponds to the <code>[ID]</code> column of...") |
|||
| Line 3: | Line 3: | ||
=Syntax= | =Syntax= | ||
| − | < | + | <source lang="C"> |
void truxton_artifact_get_file_id( uint64_t artifact_handle, char * destination_string, size_t max_size ); | void truxton_artifact_get_file_id( uint64_t artifact_handle, char * destination_string, size_t max_size ); | ||
| − | </ | + | </source> |
=Parameters= | =Parameters= | ||
| Line 24: | Line 24: | ||
char guid_string[ 40 ]; | char guid_string[ 40 ]; | ||
| − | truxton_artifact_get_file_id( | + | truxton_artifact_get_file_id( artifact_handle, guid_string, sizeof(guid_string) ); |
| + | printf( "File ID is %s\n", guid_string ); | ||
| − | printf( " | + | truxton_artifact_get_media_id( artifact_handle, guid_string, sizeof(guid_string) ); |
| + | printf( "Media ID is %s\n", guid_string ); | ||
| + | |||
| + | truxton_artifact_get_object_id( artifact_handle, guid_string, sizeof(guid_string) ); | ||
| + | printf( "Object ID is %s\n", guid_string ); | ||
| + | |||
| + | uint64_t value = truxton_artifact_get_object_type( artifact_handle ); | ||
| + | printf( "Object type is %" PRIu64 "\n", value ); | ||
| + | |||
| + | value = truxton_artifact_get_data_type( artifact_handle ); | ||
| + | printf( "Data type is %" PRIu64 "\n", value ); | ||
| + | |||
| + | value = truxton_artifact_get_offset( artifact_handle ); | ||
| + | printf( "Offset is %" PRIu64 "\n", value ); | ||
| + | |||
| + | value = truxton_artifact_get_length( artifact_handle ); | ||
| + | printf( "Length is %" PRIu64 "\n", value ); | ||
| + | |||
| + | value = truxton_artifact_get_type( artifact_handle ); | ||
| + | printf( "Type is %" PRIu64 "\n", value ); | ||
} | } | ||
</source> | </source> | ||
Revision as of 15:07, 3 November 2020
This retrieves the GUID of the file this artifact came from.
This corresponds to the [ID] column of the [File] table.
Syntax
void truxton_artifact_get_file_id( uint64_t artifact_handle, char * destination_string, size_t max_size );
Parameters
artifact_handle
The handle to a message created by the truxton_artifact_create call.
destination_string
The string to be written to.
max_size
The maximum number of characters that can be written to destination_string.
Sample
void dump_artifact(uint64_t artifact_handle)
{
char guid_string[ 40 ];
truxton_artifact_get_file_id( artifact_handle, guid_string, sizeof(guid_string) );
printf( "File ID is %s\n", guid_string );
truxton_artifact_get_media_id( artifact_handle, guid_string, sizeof(guid_string) );
printf( "Media ID is %s\n", guid_string );
truxton_artifact_get_object_id( artifact_handle, guid_string, sizeof(guid_string) );
printf( "Object ID is %s\n", guid_string );
uint64_t value = truxton_artifact_get_object_type( artifact_handle );
printf( "Object type is %" PRIu64 "\n", value );
value = truxton_artifact_get_data_type( artifact_handle );
printf( "Data type is %" PRIu64 "\n", value );
value = truxton_artifact_get_offset( artifact_handle );
printf( "Offset is %" PRIu64 "\n", value );
value = truxton_artifact_get_length( artifact_handle );
printf( "Length is %" PRIu64 "\n", value );
value = truxton_artifact_get_type( artifact_handle );
printf( "Type is %" PRIu64 "\n", value );
}