TruxtonUSB

This class lets you add to the [USBDevice] table in Truxton.

Attributes and Methods

addnote(text: str) -> boolean

This adds an investigator's note. The text parameter is the contents of the note. It will return True if the tag was associated with the device, False on failure. The note is stored in the [InvestigatorNote] table in the database.

deviceid: str

A GUID assigned to the device by Windows.

devicetype: int

This corresponds to the [USBDeviceTypeID] column of the [USBDevice] table. It should be a value from the [ID] column of the [USBDeviceType] table. Not used at this time.

fileid: str

The GUID of the file this device came from. This corresponds to the [FileID] column of the [USBDevice] table.

id: str

This is the GUID of the record. It becomes non-zero after save() has been called. This corresponds to the [ID] column of the [USBDevice] table.

mediaid: str

This is the GUID of the media this device came from. This corresponds to the [MediaID] column of the [USBDevice] table.

offset: int

The offset into the file where this device was found. This corresponds to the [Offset] column of the [USBDevice] table.

productid: int

The product id of the device. This corresponds to the [PID] column of the [USBDevice] table. This may contain a value in the [PID] column of the [USBPIDVID] table.

revision: int

The revision of the device.

save() -> boolean

This will commit the information to the [USBDevice] table. It will return True if the record was saved to the database, False if there was an error.

tag(tag: str, reason: str, origin: int) -> boolean

This creates a tag associated with this device in Truxton. The tag parameter is a short, one or two word, bit of text that will be displayed in the UI. The reason is a sentence explaining why this device was tagged. The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2). It will return True if the tag was associated with the device, False on failure.

vendorid: int

The vendor id (VID) of the device. This corresponds to the [VID] column of the [USBDevice] table.

when: datetime

The time associated with this device. This value can be set with either a datetime value or an integer representing FILETIME ticks.

Sample

 1 import sys
 2 sys.path.append('C:/Program Files/Truxton/SDK')
 3 import truxton
 4 import shutil
 5 
 6 from datetime import datetime
 7 from calendar import timegm
 8 from pathlib import Path
 9 
10 def add_file(parent_truxton_file, filename):
11   source_file = open(filename, "rb")
12   child = parent_truxton_file.newchild()
13   child.name = Path(filename).name
14   shutil.copyfileobj(source_file, child)
15   source_file.close()
16   child.save()
17   return child
18 
19 def add_media(t):
20   media = t.newmedia()
21 
22   media.name = "Public Documents"
23   media.description = "Publicly available documents"
24   media.case = "DC-SNAFU-2016.2020"
25   media.evidencebag = "EV-0937459386623-a"
26   media.originator = "Jeffrey Jensen"
27   media.latitude = 38.897661
28   media.longitude = -77.036458
29   media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
30   media.save()
31 
32   return media
33 
34 def add_cs(parent_file ):
35   child_file = add_file(parent_file, "480057685-2020-10-13-Submission-SJC-SSCI-Part-2-of-2.pdf")
36 
37   # Now add the SanDisk Cruzer Glide 8GB
38 
39   thumbdrive = child_file.newusb()
40   thumbdrive.vid = 1921
41   thumbdrive.pid = 21808
42   thumbdrive.when = datetime.fromisoformat("2016-12-20T11:00:00-05:00")
43   thumbdrive.save()
44 
45   return None
46 
47 def main():
48   t = truxton.create()
49 
50   media = add_media(t)
51 
52   root_file = media.addroot()
53   root_file.save()
54 
55   add_cs(root_file)
56 
57   return None
58 
59 if __name__ == "__main__":
60   main()