TruxtonObject

This class give you access to Truxton at a global level.

Attributes and Methods

closed

It will return True if the the connection to Truxton is closed, False otherwise.

createtag(name, description)

This will create a new tag in Truxton. After calling this method, you can tag other items using only the name.

etlid

Returns the GUID of the ETL if it is running.

getbool(name)

This will retrieve a boolean setting from Truxton based on its name.

getfilehash(hash)

This will retrieve a file from Truxton based on its MD5 hash.

getfileid(id)

This will retrieve a file from Truxton based on its GUID.

getint(name)

This will retrieve an integer setting from Truxton based on its name.

getmediaid(id)

This will retrieve a media from Truxton based on its GUID.

getstring(name)

This will retrieve a string setting from Truxton based on its name.

machineid

Returns the GUID of the machine.

neweventtype()

This will create an event type object.

newexporter()

This will create an exporter object.

newinvestigation()

This will create an investigation object.

newmedia()

This will create a media object.

newrelation()

This will create a relation object.

version

Returns the version string.

Sample

 1 import truxton
 2 import shutil
 3 
 4 from datetime import datetime
 5 from calendar import timegm
 6 from pathlib import Path
 7 
 8 EPOCH_AS_FILETIME = 116444736000000000
 9 HUNDREDS_OF_NANOSECONDS = 10000000
10 
11 def date_to_filetime(dt):
12   return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)
13 
14 def create_event_type(t, id, name):
15   event_type = t.neweventtype()
16   event_type.id = id
17   event_type.name = name
18   event_type.save()
19 
20 def add_file(parent_truxton_file, filename):
21   source_file = open(filename, "rb")
22   child = parent_truxton_file.newchild()
23   child.name = Path(filename).name
24   shutil.copyfileobj(source_file, child)
25   source_file.close()
26   child.save()
27 
28   return child
29 
30 def add_media(t):
31   media = t.newmedia()
32   media.name = "Public Documents"
33   media.description = "Publicly available documents"
34   media.case = "DC-SNAFU-2016.2020"
35   media.evidencebag = "EV-0937459386623-a"
36   media.originator = "Jeffrey Jensen"
37   media.latitude = 38.897661
38   media.longitude = -77.036458
39   media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
40   media.save()
41 
42   return media
43 
44 def add_ec(parent_file ):
45   child_file = add_file(parent_file, "JW-v-DOJ-reply-02743.pdf")
46 
47   a = child_file.newartifact()
48   a.type = truxton.ENTITY_TYPE_ACCOUNT
49   a.value = "r0cker"
50   a.datatype = truxton.DATA_TYPE_ASCII
51   a.length = 6
52   a.save()
53 
54   b = child_file.newartifact()
55   b.type = truxton.ENTITY_TYPE_PERSON
56   b.value = "Bob Smith"
57   b.datatype = truxton.DATA_TYPE_ASCII
58   b.length = 9
59   b.save()
60 
61   relation = child_file.newrelation()
62   relation.a = a.id
63   relation.atype = truxton.OBJECT_TYPE_ENTITY
64   relation.b = b.id
65   relation.btype = truxton.OBJECT_TYPE_ENTITY
66   relation.relation = truxton.RELATION_LOGON_ACCOUNT
67   relation.save()
68 
69 def main():
70   t = truxton.create()
71 
72   print(t.version + '\n' );
73   print("Truxton will write to depot files in: " + t.getstring("datadir") + '\n');
74   print("The database port is: " + str(t.getint("dbport")) + '\n');
75   print("Database was created: " + str(t.getbool("CreateTheDatabase")) + '\n');
76 
77   media = add_media(t)
78 
79   root_file = media.addroot()
80   root_file.save()
81 
82   add_ec(root_file)
83 
84 if __name__ == "__main__":
85   main()