Truxton child file add note

This will add a note to the child file. You can only tag a child file after truxton_child_file_save() has been called. This will cause a record to be created in the [InvestigatorNote] table.

Syntax

int truxton_child_file_add_note( uint64_t child_handle, char const * text );

Parameters

child_handle

The handle created by the truxton_child_file_create or truxton_file_create_child call.

text

The contents of the note.

Return value

A non-zero value on success, zero on failure.

Sample

void add_folder( uint64_t truxton, uint64_t parent_file )
{
   truxton_start_adding_files( truxton );

   uint64_t child = truxton_child_file_create( truxton );

   char id[40];

   truxton_file_get_id( parent_file, id, sizeof(id) );
   truxton_child_file_set_parent_id( child, id );
   truxton_child_file_set_type( child, Type_Directory );
   truxton_child_file_set_name( child, "Custom Exploits Folder" );

   FILETIME now;

   GetSystemTimePreciseAsFileTime( &now );

   ULARGE_INTEGER ticks;

   ticks.LowPart = now.dwLowDateTime;
   ticks.HighPart = now.dwHighDateTime;

   truxton_child_file_set_created( child, ticks.QuadPart );
   truxton_child_file_set_accessed( child, ticks.QuadPart );
   truxton_child_file_set_modified( child, ticks.QuadPart );

   truxton_child_file_set_disk_offset( child, 5464419 );
   truxton_child_file_set_path( child, "Files/This File" );

   if ( truxton_child_file_save( child ) == 0 )
   {
      printf( "Failed to add child to Truxton\n" );
   }

   truxton_child_file_add_note( child, "I really like this file." );
   truxton_child_file_destroy( child );
}