TruxtonMessage

This class encapsulates the message object that is the basis for the Truxton's ETL pipeline.

Attributes and Methods

depotid

This is the GUID of the depot file that stores the contents of the file. This identifier corresponds to the ID of the Depot table.

depotlength

The number of bytes in the depot file that make up this file's contents.

depotname

The name of the depot that contains the file's contents.

depotoffset

The offset into the depot where the first byte of the file resides.

dontroute

This integer controls whether the message should be further routed through the message bus. This is usually only set when debugging an ETL process.

file()

This method will return a read-only file that you can use to read the contents of the file.

fileid

This is the GUID of the file. This identifier corresponds to the ID of the File table.

filetype

The [[File Types Supported | type of the file. This corresponds to the FileTypeID column of the File table.

hash

The MD5 hash of the contents of the file. This corresponds to the HashID column of the File table.

mediaid

This is the GUID of the file. This identifier corresponds to the MediaID of the File table.

parentid

This is the GUID of the file. This identifier corresponds to the ParentID of the File table.

priority

This integer value controls the prioriy of the message. High values have greater priority than lower values.

queueempty

This integer tells you if your message queue is empty. When this value is non-zero, the message queue is empty.

routeid

This integer represents the path that files should take through the exploitation processes. It should be a value in the LoadConfigurationID column of the ETLRoute table.

signature

The first four bytes of the file stored as an integer. This corresponds to the Signature column of the File table.

Sample

 1 import truxton
 2 
 3 def main():
 4   etl = truxton.etl()
 5   etl.name = "My New ETL"
 6   etl.description = "This ETL processes files in the Truxton system"
 7   etl.queue = "anewetl"
 8   etl.stage = 40
 9   etl.expanderid = 0x05fc0bf6a57726a0
10   etl.version = 0
11   etl.depot = "thumbnail"
12   etl.depotype = truxton.DEPOT_TYPE_THUMBNAILS
13   etl.poly = 0
14 
15   etl.addarg("--verbose")
16   etl.addarg("Yes")
17 
18   etl.sendmefileid("5ecbebc4-9937-2b88-f691-91a800000024")
19   etl.sendmehash("baa51f0cc8361660df911e06e7637485")
20   etl.sendmefiles(truxton.Type_JPEGWithExif, 100)
21   etl.sendmefiles(truxton.Type_TIFFWithExif, 500)
22   etl.sendmelocalfile( "C:/Test Files/Video/Fragmented/Recovered Video.mp4", truxton.Type_MPEG4Video, 0 )
23 
24   message = etl.getmessage()
25 
26   while message is not None:
27     file_in_truxton = message.file()
28 
29     # YOUR FORENSIC CODE GOES HERE
30 
31     line_of_text = file_in_truxton.readline()
32 
33     if "[SetupAPI" in line_of_text:
34       child = file_in_truxton.newchild()
35       child.name = "Child file from New ETL"
36       child.write("This is the file you were looking for.")
37       child.save()
38 
39 if __name__ == "__main__":
40   main()