Entity Table

The [Entity] table holds artifact information gleaned from exploited media.

SQL

CREATE TABLE "Entity"
(
  "ID" uuid NOT NULL,
  "MediaID" uuid NOT NULL,
  "FileID" uuid NOT NULL,
  "EntityTypeID" smallint NOT NULL,
  "EntityStringID" uuid NOT NULL,
  "Offset" bigint DEFAULT (-1) NOT NULL,
  "ObjectID" uuid NOT NULL,
  "ObjectTypeID" smallint DEFAULT 0 NOT NULL,
  "Length" bigint DEFAULT 0 NOT NULL,
  "DataTypeID" int NOT NULL
);

Columns

ID

The globally unique identifier for this entity.

MediaID

The ID of the media from whence this entity came. This corresponds to the ID column of the [Media] table.

FileID

The ID of the file from whence this entity came. This corresponds to the ID column of the [File] table.

EntityTypeID

The identifier of the type of entity. This corresponds to the ID column of the [EntityType] table. It should contain one of these values.

EntityStringID

The identifier of the string representation of the entity. This corresponds to the [ID] column of the [EntityString] table.

Offset

The offset into the file where this entity was found (if known).

ObjectID

The ID of the object that is the source of this entity.

ObjectTypeID

The identifier of the type of the object. This corresponds to the ID column of the [ObjectType] table. This should contains one of these values.

Length

The number of bytes in the entity.

DataTypeID

The identifier of the type of data the entity was stored as. This corresponds to the ID column of the [DataType] table. It should contain one of these values.