TruxtonChildFileIO

This class provides a writable file to add to Truxton.

IOBase Methods

From IOBase it implements:

• close()
• closed
• fileno() - Will return ERROR
• flush()
• isatty()
• readable() - Always returns FALSE
• readline() - Do not use, will return ERROR
• readlines() - Do not use, will return ERROR
• seek() - Will return ERROR
• seekable() - returns FALSE
• tell()
• truncate()
• writable() - returns TRUE
• writelines()

RawIOBase Methods

From RawIOBase it implements:

• read()
• readall()
• readinto()
• write()

Truxton Methods

The above methods will let you read from a file in Truxton as if it were any other file in Python. The following methods are also present to make tasks of adding items extracted from a file easier.

• newartifact()
• newchild()
• newevent()
• newexif()
• newlocation()
• newrelation()
• newurl()
• newusb()

Sample

This will retrieve a file from Truxton, print the name and hash as stored in the database then calculate a hash on the contents and print that.

import truxton
import shutil
from pathlib import Path

def add_file(parent_truxton_file, filename):
  source_file = open(filename, "rb")
  child = parent_truxton_file.newchild()
  child.name = Path(filename).name
  shutil.copyfileobj(source_file, child)
  source_file.close()
  child.save()
  return child

def main():
  t = truxton.create()
  file = t.getfileid("5ec2a123-74d6-5da7-0653-4e6800000000")
  child = add_file(file, "C:\decrypts\PlainText.txt")

if __name__ == "__main__":
  main()