Truxton investigation get opened

This retrieves the create date of the investigation. This corresponds to the [Opened] column of the [Investigation] table. It represents when this investigation was created in Truxton.

Syntax

uint64_t truxton_investigation_get_opened( uint64_t investigation_handle );

Parameters

investigation_handle

The handle created by the truxton_investigation_create().

Return value

The creation date of the investigation in FILETIME ticks.

Sample

void print_valid( uint64_t investigation )
{
   uint64_t creation_date = truxton_investigation_get_opened( investigation );

   if ( creation_date == 0 )
   {
      printf( "The investigation has no opened date\n" );
   }
   else
   {
      printf( "The investigation has a opened date\n" );
   }
}