TruxtonArtifact

This class lets you add to the [Entity] table in Truxton.

Attributes and Methods

datatype: int

The raw data type of the representation of the entity. This corresponds to the [DataTypeID] column of the [Entity] table.

fileid: str

The GUID of the file this artifact came from. This corresponds to the [FileID] column of the [Entity] table.

id: str

This is the GUID of the record. It becomes non-zero after save() has been called. This corresponds to the [ID] column of the [Entity] table.

length: int

The number of bytes in the raw representation of the artifact. This corresponds to the [Length] column of the [Entity] table.

mediaid: str

This is the GUID of the media this artifact came from. This corresponds to the [MediaID] column of the [Entity] table.

objectid: str

This is the GUID of the object this artifact came from. This combined with objecttype allows Truxton to track derivative entities such as a search term coming from a URL found in a browser cache. In this example, fileid would point to the browser cache [File] record and objectid would point to the record in the [WebsiteVisit] table.

objecttype: int

The type of the object. This corresponds to the [ObjectTypeID] column of the [Entity] table. It should contain one of the predefined constants.

offset: int

The offset from the beginning of the file where this artifact begins.

type: int

The type of the artifact is. This corresponds to the [EntityTypeID] column of the [Entity] table. It must be a value listed in the [ID] column of the [EntityType] table. You can also use a predefined constant.

value: str

The string representation of the artifact. This corresponds to the [Value] column of the [EntityString] table.

save() -> boolean

This will commit the information to the [Entity] table. It will return True if the record was saved to the database, False if there was an error.

addnote(text: str) -> boolean

This adds an investigator's note. The text parameter is the contents of the note. It will return True if the tag was associated with the artifact, False on failure.

tag(tag: str, reason: str, origin: int) -> boolean

This creates a tag associated with this artifact in Truxton. The tag parameter is a short, one or two word, bit of text that will be displayed in the UI. The reason a sentence explaining why this artifact was tagged. The origin is either TAG_ORIGIN_AUTOMATIC (1) or TAG_ORIGIN_HUMAN (2). It will return True if the tag was associated with the artifact, False on failure.

Sample

Sample Code

import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton
import shutil

from datetime import datetime
from calendar import timegm
from pathlib import Path

EPOCH_AS_FILETIME = 116444736000000000
HUNDREDS_OF_NANOSECONDS = 10000000

def date_to_filetime(dt):
  return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)

def create_event_type(t, id, name):
  event_type = t.neweventtype()
  event_type.id = id
  event_type.name = name
  event_type.save()
  return None

def add_file(parent_truxton_file, filename):
  source_file = open(filename, "rb")
  child = parent_truxton_file.newchild()
  child.name = Path(filename).name
  shutil.copyfileobj(source_file, child)
  source_file.close()
  child.save()

  return child

def add_media(t):
  media = t.newmedia()
  media.name = "Public Documents"
  media.description = "Publicly available documents"
  media.case = "DC-SNAFU-2016.2020"
  media.evidencebag = "EV-0937459386623-a"
  media.originator = "Jeffrey Jensen"
  media.latitude = 38.897661
  media.longitude = -77.036458
  media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
  media.save()

  return media

def add_ec(parent_file ):
  child_file = add_file(parent_file, "JW-v-DOJ-reply-02743.pdf")

  artifact = child_file.newartifact()
  artifact.type = truxton.ENTITY_TYPE_AUTHOR
  artifact.value = "Bob Smith"
  artifact.datatype = truxton.DATA_TYPE_ASCII
  artifact.length = 9
  artifact.save()

  artifact.addnote('I think this was the filing that mentioned dead squirrels')

  return None

def main():
  t = truxton.create()

  media = add_media(t)

  root_file = media.addroot()
  root_file.save()

  add_ec(root_file)

  return None

if __name__ == "__main__":
  sys.exit(main())