Truxton artifact set length

This records the number of bytes of raw data where the artifact was found. This corresponds to the [Length] column of the [Entity] table.

Syntax

void truxton_artifact_set_length( uint64_t entity_handle, uint64_t length );

Parameters

artifact_handle

The artifact instance. This handle comes from calling truxton_artifact_create().

length

The number of raw bytes that make up the artifact.

Sample

This sample supposes you are a file expander that knows a user's pin code is optionally stored at a fixed location in the file.

void expand_file(uint64_t file_handle)
{
   char pin_code[5];

   pin_code[0] = ' ';
   pin_code[1] = ' ';
   pin_code[2] = ' ';
   pin_code[3] = ' ';
   pin_code[4] = 0x00;

   truxton_file_seek( file_handle, 3772, SEEK_SET );

   if ( truxton_file_read( file_handle, pin_code, 4 ) == 4 )
   {
      if ( isdigit(pin_code[0]) &&
           isdigit(pin_code[1]) &&
           isdigit(pin_code[2]) &&
           isdigit(pin_code[3]) )
      {
         uint64_t artifact = truxton_file_create_artifact(file_handle);

         truxton_artifact_set_name( artifact, "PIN Code" );
         truxton_artifact_set_data_type( artifact, DATA_TYPE_ASCII );
         truxton_artifact_set_offset( artifact, 3772 );
         truxton_artifact_set_length( artifact, 4 );
         truxton_artifact_set_value( artifact, pin_code );
         truxton_artifact_set_type( artifact, ENTITY_TYPE_PASSWORD );

         if ( truxton_artifact_save( artifact ) != 0 )
         {
             char id[ 50 ];

             truxton_artifact_get_id( artifact, id, sizeof( id ) );

             printf( "Artifact saved as ID %s\n", id );
         }
         else
         {
             printf( "Could not save artifact\n" );
         {

         truxton_artifact_destroy( artifact );
      }
   }
}