TruxtonEvent

This class lets you add to the Event table in Truxton.

Attributes and Methods

id

This is the GUID of the event. It becomes non-zero after save() has been called.

description

The longer description of the event.

end

When the event ended in FILETIME ticks. This corresponds to the End column of the Event table.

fileid

The GUID of the file this event came from. This corresponds to the FileID column of the Event table.

mediaid

This is the GUID of the media this event came from. This identifier corresponds to the MediaID of the Event table.

save()

This will commit the information to the Event table.

tag(tag, reason, origin)

This creates a tag associated with this event in Truxton. The tag parameter is a short, one or two word, bit of text that will be displayed in the UI. The reason a sentence explaining why this event was tagged. The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2). It will return True if the tag was associated with the file, False on failure.

start

When the event began in FILETIME ticks. This corresponds to the Start column of the Event table.

title

This corresponds to the Title column of the Event table.

type

This corresponds to the EventTypeID column of the Event table. It should contain a value from the ID column of the EventType table.

Sample

 1 import truxton
 2 
 3 def main():
 4   etl = truxton.etl()
 5   etl.name = "My New ETL"
 6   etl.description = "This ETL processes files in the Truxton system"
 7   etl.queue = "anewetl"
 8   etl.stage = 40
 9   etl.expanderid = 0x05fc0bf6a57726a0
10   etl.version = 0
11   etl.depot = "thumbnail"
12   etl.depotype = truxton.DEPOT_TYPE_THUMBNAILS
13   etl.poly = 0
14 
15   etl.addarg("--verbose")
16   etl.addarg("Yes")
17 
18   etl.sendmefileid("5ecbebc4-9937-2b88-f691-91a800000024")
19   etl.sendmehash("baa51f0cc8361660df911e06e7637485")
20   etl.sendmefiles(truxton.Type_JPEGWithExif, 100)
21   etl.sendmefiles(truxton.Type_TIFFWithExif, 500)
22   etl.sendmelocalfile( "C:/Test Files/Video/Fragmented/Recovered Video.mp4", truxton.Type_MPEG4Video, 0 )
23 
24   message = etl.getmessage()
25 
26   while message is not None:
27     file_in_truxton = message.file()
28 
29     # YOUR FORENSIC CODE GOES HERE
30 
31     line_of_text = file_in_truxton.readline()
32 
33     if "[SetupAPI" in line_of_text:
34       child = file_in_truxton.newchild()
35       child.name = "Child file from New ETL"
36       child.write("This is the file you were looking for.")
37       child.save()
38 
39 if __name__ == "__main__":
40   main()