TruxtonArtifact

This class lets you add to the [Entity] table in Truxton.

Attributes and Methods

datatype: int

The raw data type of the representation of the entity. This corresponds to the [DataTypeID] column of the [Entity] table.

fileid: str

The GUID of the file this artifact came from. This corresponds to the [FileID] column of the [Entity] table.

id: str

This is the GUID of the record. It becomes non-zero after save() has been called. This corresponds to the [ID] column of the [Entity] table.

length: int

The number of bytes in the raw representation of the artifact. This corresponds to the [Length] column of the [Entity] table.

mediaid: str

This is the GUID of the media this artifact came from. This corresponds to the [MediaID] column of the [Entity] table.

objectid: str

This is the GUID of the object this artifact came from. This combined with objecttype allows Truxton to track derivative entities such as a search term coming from a URL found in a browser cache. In this example, fileid would point to the browser cache [File] record and objectid would point to the record in the [WebsiteVisit] table.

objecttype: int

The type of the object. This corresponds to the [ObjectTypeID] column of the [Entity] table. It should contain one of the predefined constants.

offset: int

The offset from the beginning of the file where this artifact begins.

type: int

The type of the artifact is. This corresponds to the [EntityTypeID] column of the [Entity] table. It must be a value listed in the [ID] column of the [EntityType] table. You can also use a predefined constant.

value: str

The string representation of the artifact. This corresponds to the [Value] column of the [EntityString] table.

save() -> boolean

This will commit the information to the [Entity] table. It will return True if the record was saved to the database, False if there was an error.

tag(tag, reason, origin) -> boolean

This creates a tag associated with this artifact in Truxton. The tag parameter is a short, one or two word, bit of text that will be displayed in the UI. The reason a sentence explaining why this artifact was tagged. The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2). It will return True if the tag was associated with the artifact, False on failure.

Sample

Sample Code

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton
import shutil

from datetime import datetime
from calendar import timegm
from pathlib import Path

EPOCH_AS_FILETIME = 116444736000000000
HUNDREDS_OF_NANOSECONDS = 10000000

def date_to_filetime(dt):
  return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)

def create_event_type(t, id, name):
  event_type = t.neweventtype()
  event_type.id = id
  event_type.name = name
  event_type.save()

def add_file(parent_truxton_file, filename):
  source_file = open(filename, "rb")
  child = parent_truxton_file.newchild()
  child.name = Path(filename).name
  shutil.copyfileobj(source_file, child)
  source_file.close()
  child.save()

  return child

def add_media(t):
  media = t.newmedia()
  media.name = "Public Documents"
  media.description = "Publicly available documents"
  media.case = "DC-SNAFU-2016.2020"
  media.evidencebag = "EV-0937459386623-a"
  media.originator = "Jeffrey Jensen"
  media.latitude = 38.897661
  media.longitude = -77.036458
  media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
  media.save()

  return media

def add_ec(parent_file ):
  child_file = add_file(parent_file, "JW-v-DOJ-reply-02743.pdf")

  artifact = child_file.newartifact()
  artifact.type = truxton.ENTITY_TYPE_AUTHOR
  artifact.value = "Bob Smith"
  artifact.datatype = truxton.DATA_TYPE_ASCII
  artifact.length = 9
  artifact.save()

def main():
  t = truxton.create()

  media = add_media(t)

  root_file = media.addroot()
  root_file.save()

  add_ec(root_file)

if __name__ == "__main__":
  main()