TruxtonFileIO

This class provides read-only access to a file's contents in Truxton.

IOBase Methods

From IOBase it implements:

• close()
• closed
• fileno()
• flush() - Does nothing
• isatty()
• readable()
• readline()
• readlines()
• seek()
• seekable()
• tell()
• truncate() - - Always returns IOError
• writable() - Always returns False
• writelines() - Always returns IOError

RawIOBase

From RawIOBase it implements:

• read()
• readall()
• readinto()
• write() - Always returns IOError

Truxton Methods

The above methods will let you read from a file in Truxton as if it were any other file in Python. The following methods are also present to make tasks of adding items extracted from a file easier.

• newartifact() - Used to create a record in the entity table and associated with this file.
• newchild() - Creates a writable file that will be a child of this file.
• newevent() - Used to create a record in the Event table and associated with this file.
• newexif() - Used to create a record in the EXIF table and associated with this file.
• newlocation() - Used to create a record in the Location table and associated with this file.
• newrelation() - Used to create a record in the Relation table and associated with this file.
• newurl() - Used to create a record in the WebsiteVisit table and associated with this file.
• newusb() - Used to create a record in the USBDevice table and associated with this file.
• tag() - Used to associate a tag with this file.

Sample

This will retrieve a file from Truxton, print the name and hash as stored in the database then calculate a hash on the contents and print that.

import truxton
import hashlib

def main():
  t = truxton.create()
  file = t.getfileid("5ec2a123-74d6-5da7-0653-4e6800000000")
  print(file.hash + " is the hash in the database for " + file.name )
  bytes = file.readall()
  readable_hash = hashlib.md5(bytes).hexdigest()
  print(readable_hash + " is the calculated hash of the contents")

if __name__ == "__main__":
  main()