Truxton file create artifact

This creates an artifact from this file that you can use in the Artifact API. An artifact object is how you add records to the Entity table.

Syntax

uint64_t truxton_file_create_artifact( uint64_t file_handle );

Parameters

file_handle

The handle created by the truxton_file_open_id or truxton_file_open_md5 call.

Return value

A handle to an artifact object.

Sample

void add_folder(uint64_t truxton, uint64_t parent_file)
{
   truxton_start_adding_files(truxton);

   uint64_t child = truxton_child_file_create(truxton);

   char id[40];

   truxton_file_get_id(parent_file, id, sizeof(id));
   truxton_child_file_set_parent_id(child, id);
   truxton_child_file_set_type(child, Type_Directory);
   truxton_child_file_set_name(child, "Custom Exploits Folder");

   FILETIME now;

   GetSystemTimeAsFileTime(&now);

   ULARGE_INTEGER ticks;

   ticks.LowPart = now.dwLowDateTime;
   ticks.HighPart = now.dwHighDateTime;

   truxton_child_file_set_created(child, ticks.QuadPart);
   truxton_child_file_set_accessed(child, ticks.QuadPart);
   truxton_child_file_set_modified(child, ticks.QuadPart);

   truxton_child_file_set_origin(child, ORIGIN_GENERATED);

   if ( truxton_child_file_save(child) == 0 )
   {
      printf( "Failed to add child to Truxton\n" );
   }

   uint64_t artifact = truxton_child_file_create_artifact(child);

   truxton_artifact_set_type(artifact, ENTITY_TYPE_SERIAL_NUMBER);
   truxton_artifact_set_value(artifact, "1234" );
   truxton_artifact_save(artifact);
   truxton_artifact_destroy(artifact);

   truxton_child_file_destroy(child);
}