Truxton file export add criteria

This gives you the ability to specify criteria for selecting files to export from Truxton.

Syntax

void truxton_file_export_add_criteria(uint64_t export_handle, uint64_t field, char const * value);

Parameters

export_handle

The handle to an export instance created by the truxton_file_export_create() call.

field

Which criteria to set.

value

The string representation of the field criteria.

Criteria Fields

The following are the possible criteria to set.

TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE

The length of the file to export.

TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MINIMUM

The minimum number of bytes in the file to export.

TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MAXIMUM

The maximum number of bytes in the file to export.

TRUXTON_EXPORT_FILE_QUERY_FIELD_HASH

The hash or partial hash of the file to export.

TRUXTON_EXPORT_FILE_QUERY_FIELD_TYPE

The type of file to export. You can specify a comma separated list of file types if you want to export more than a single type.

TRUXTON_EXPORT_FILE_QUERY_FIELD_PARENT_ID

The identifier of the parent of the files to export. This is useful for exporting the files in a folder in the seized media.

TRUXTON_EXPORT_FILE_QUERY_FIELD_ID

The identifier of the file. You can specify a comma separated list of identifiers if you want to export more than a single file.

TRUXTON_EXPORT_FILE_QUERY_FIELD_MEDIA

The identifier of the media the exported files belong to.

TRUXTON_EXPORT_FILE_QUERY_FIELD_LIMIT

Sets the maximum number of files to export.

Sample

#include "TruxtonCAPI.h"
#pragma comment(lib, "TruxtonCAPI.lib")

#include "filetypes.h"
#include <stdlib.h>
#pragma hdrstop

int main()
{
    char temporary_string[256];

    truxton_start();

    uint64_t truxton = truxton_create();

    uint64_t export_handle = truxton_file_export_create(truxton);

    // We want a variety of file types
    sprintf_s(temporary_string, sizeof(temporary_string), "%d, %d, %d", Type_JPEGWithExif, Type_JPEG, Type_GIF);
    truxton_file_export_add_criteria(export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_TYPE, temp_string);

    // We only want files where the MD5 hash starts with "e4"
    truxton_file_export_add_criteria(export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_HASH, "e4");

    // We want a file that is at least 4MB long
    truxton_file_export_add_criteria(export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MINIMUM, "4194304");

    // We want a file that is no larger than 5MB
    truxton_file_export_add_criteria(export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_SIZE_MAXIMUM, "5242880");

    // Limit the output to a single file
    truxton_file_export_add_criteria(export_handle, TRUXTON_EXPORT_FILE_QUERY_FIELD_LIMIT, "1");

    truxton_file_export_where_clause(export_handle, temporary_string, sizeof(temporary_string));
    printf( "Will use the following WHERE clause to select files: %s\n", temporary_string);

    // Rename the file being exported to include the hash before the original name
    truxton_file_export_set_option(export_handle, TRUXTON_EXPORT_FILE_OPTION_NAME_FORMAT, "{hash}_{name}");

    // The files should be output to a particular folder
    truxton_file_export_set_option(export_handle, TRUXTON_EXPORT_FILE_OPTION_FOLDER, "C:\\temp");

    // We want them output to a TAR file in that particular folder
    truxton_file_export_set_option(export_handle, TRUXTON_EXPORT_FILE_OPTION_TAR, "JPGWithExif.tar");

    // Go find the files and output them to C:\temp\JPGWithExif.tar
    truxton_file_export_execute(export_handle);

    // Clean up
    truxton_file_export_destroy(export_handle);
    truxton_destroy(truxton);
    truxton_stop();
}