Truxton child file create artifact

This creates an artifact from this file that you can use in the Artifact API.

Syntax

uint64_t truxton_child_file_create_artifact( uint64_t child_handle );

Parameters

child_handle

The handle created by the truxton_child_file_create or truxton_file_create_child call.

Return value

A handle to an artifact object.

Sample

void add_folder(uint64_t truxton, uint64_t parent_file)
{
   truxton_start_adding_files(truxton);

   uint64_t child = truxton_child_file_create(truxton);

   char id[40];

   truxton_file_get_id(parent_file, id, sizeof(id));
   truxton_child_file_set_parent_id(child, id);
   truxton_child_file_set_type(child, Type_Directory);
   truxton_child_file_set_name(child, "Custom Exploits Folder");

   FILETIME now;

   GetSystemTimeAsFileTime(&now);

   ULARGE_INTEGER ticks;

   ticks.LowPart = now.dwLowDateTime;
   ticks.HighPart = now.dwHighDateTime;

   truxton_child_file_set_created(child, ticks.QuadPart);
   truxton_child_file_set_accessed(child, ticks.QuadPart);
   truxton_child_file_set_modified(child, ticks.QuadPart);

   truxton_child_file_set_origin(child, ORIGIN_GENERATED);

   if ( truxton_child_file_save(child) == 0 )
   {
      printf( "Failed to add child to Truxton\n" );
   }
   else
   {
      ticks.QuadPart = truxton_child_file_get_disk_offset(child_file);
      printf( "Physical Disk Offset was %d\n", ticks.QuadPart );
   }

   uint64_t artifact = truxton_child_file_create_artifact(child);

   truxton_artifact_set_type(artifact, ENTITY_TYPE_SERIAL_NUMBER);
   truxton_artifact_set_value(artifact, "1234" );
   truxton_artifact_save(artifact);

   truxton_child_file_destroy(child);
}