This class provides read-only access to a file's contents in Truxton.

IOBase Methods

From IOBase it implements:

close()
closed
fileno()
flush() - Does nothing
isatty()
readable()
readline()
readlines()
seek()
seekable()
tell()
truncate() - - Always returns IOError
writable() - Always returns False
writelines() - Always returns IOError

RawIOBase

From RawIOBase it implements:

Truxton Methods

The above methods will let you read from a file in Truxton as if it were any other file in Python. The following methods are also present to make tasks of adding items extracted from a file easier.

newartifact() - Used to create a record in the [Entity] table and associated with this file.
newchild() - Creates a writable file that will be a child of this file.
newcommunication() - Creates a new communication object with this file as its source.
newevent() - Used to create a record in the [Event] table and associated with this file.
newexif() - Used to create a record in the [EXIF] table and associated with this file.
newlocation() - Used to create a record in the [Location] table and associated with this file.
newrelation() - Used to create a record in the [Relation] table and associated with this file.
newurl() - Used to create a record in the [WebsiteVisit] table and associated with this file.
newusb() - Used to create a record in the [USBDevice] table and associated with this file.
tag() - Used to associate a tag with this file.
changetype() - Used the change the type of the file.

Properties

`accessed`

When the file was last accessed in FILETIME ticks. This corresponds to the [LastAccess] column of the [File] table.

`attributes`

An integer value representing the attributes of the file. For a Microsoft filesystem, it can be a combination of the file attribute flags. This corresponds to the [Attributes] column of the [File] table.

`children`

The number of files that have this file as their parent. This corresponds to the [NumberOfChildren] column of the [File] table.

`created`

When the file was created in FILETIME ticks. This corresponds to the [Created] column of the [File] table.

`depot`

The name of the depot holding the file's contents. This corresponds to the [Filename] column of the [Depot] table.

`depotid`

The name of the depot holding the file's contents. This corresponds to the [DepotID] column of the [Content] table.

`depotlength`

The number of bytes in the depot used for this file's contents. This corresponds tot he [Length] column of the [Content] table.

`depotoffset`

The number of bytes in the depot used for this file's contents. This corresponds tot he [Offset] column of the [Content] table.

`diskoffset`

The offset, in bytes, of the first byte of the contents of the file on the physical disk. This corresponds to the [PhysicalDiskOffset] column of the [File] table.

`eliminated`

True when the original contents of the file were eliminated based on the hash matching one from a list of hashes of files known to have no investigative value. The NSRL is one such library. If this is False, the file's contents are available for use.

`entropy`

Shannon's entropy of the contents of the file. This corresponds to the [RawEntropy] column of the [File] table.

`hash`

The MD5 hash of the contents of the file. This corresponds to the [HashID] column of the [File] table.

`id`

The GUID of the file record. This corresponds to the [ID] column of the [File] table.

`mediaid`

The GUID of the media the child file came from. This corresponds to the [MediaID] column of the [File] table.

`modified`

When the file was last written in FILETIME ticks. This corresponds to the [LastWrite] column of the [File] table.

`name`

The name of the file.

`origin`

Where the file came from. It should be one of the origin values. This corresponds to the [OriginID] column of the [File] table.

`parentid`

The GUID of the parent of this file. This corresponds to the [ParentFileID] column of the [File] table.

`resident`

True if this file's contents exist contiguously within the contents of another file.

`size`

The size, in bytes, of the file. This corresponds to the [OSLength] column of the [File] table.

`status`

The status of the contents of the file. It should be one of the content status values. This corresponds to the [ContentStatusID] column of the [File] table.

`type`

The type of the file. This corresponds to the [FileTypeID] column of the [File] table.

Sample

This will retrieve a file from Truxton, print the name and hash as stored in the database then calculate a hash on the contents and print that.

import truxton
import hashlib

def main():
  t = truxton.create()
  file = t.getfileid("5ec2a123-74d6-5da7-0653-4e6800000000")
  print(file.hash + " is the hash in the database for " + file.name )
  bytes = file.readall()
  readable_hash = hashlib.md5(bytes).hexdigest()
  print(readable_hash + " is the calculated hash of the contents")

if __name__ == "__main__":
  main()

TruxtonFileIO

Contents