Release 2025-04-21

Truxton 4.3.1.50421

<< Released 2025-04-22 >>

Improvements

1. Generic SQLite exploitation. You can add your own SQLite exploitation scripts to Truxton and it will run them against every SQLite database it finds. Truxton includes all of the scripts from project APOLLO
2. Beginning to exploit Apple SEGB files. For now, we mostly just convert them to SEGB XML.
3. Better PList and protocol buffer conversion to XML. When a field looks like it may contain a timestamp, Truxton decodes and outputs a human-readable timestamp.
4. Better MPEG 2 Stream carving.
5. Truxton no longer pollutes the Camera Information section with Quicktime information.
6. In the GUI, when viewing a geographic location on an external map URL link, a label for that location is now included instead of just "You are here"
7. Better DataPilot integration
8. We now extract the Windows Advertising ID (WAID) from Windows machines.
9. Use PostgreSQL 17.4.1
10. Updated to Python 3.13.2
11. Fixed a high-compression ratio bug in KTX conversion.
12. We now pull contacts from Apple Calendar Databases.
13. Fixed a bug where duplicate Subjects were being displayed in communications display
14. Exploit AlpineQuest track logs. The tracks are written to the geographic report KMZ.
15. EXIF information was not being extracted from very large images.
16. Improved exploitation of Android Accounts
17. Fixed a bug where relationships with Subjects was not being deleted in the truxton_delete_subject() C API.
18. When expanding Protocol Buffers, if a file is found in an array field, it will become a child of the protocol buffer file. Usually these are JPG or PNG files.
19. Extract more contact information from Skype database
20. Fixed a bug in the Windows Event Log parser
21. Added the following C APIs
    1. truxton_delete_artifact_type
    2. truxton_delete_event_type
    3. truxton_delete_investigation_by_name
    4. truxton_delete_media_by_name
    5. truxton_delete_subject
    6. truxton_delete_tag
22. Added the following Python APIs
    1. deleteartifacttype
    2. deleteeventtype
    3. deleteinvestigationbyname
    4. deletemediabyname
    5. deletesubject
    6. deletetag
23. Fixed a bug where suspects in an investigation were not being deleted
24. Added ELF file carving
25. Better exploitation of prefetch files to include which files were opened by the application
26. Better exploitation of the UserAssist registry key. Better translation of GUIDs to something humanly readable.
27. Better exploitation of Cellebrite reports
28. Exploit Samsung CMH databases to produce geographic coordinates
29. The Maintenance ETL will clean up the database at 11pm nightly
30. Added more map providers to the Client:
    1. GeoHack
    2. OpenStreetMap
31. Fixed a bug in KMZ Report Generator where EXIF location types coming from Cellebrite Reports were producing a red X.
32. Fixed a bug where video contact sheets weren't being produced (ffmpeg update broke things)

New Types

File

1. Type_Generic_SQLite_Script_Results
2. Type_Generic_SQLite_Script_Details
3. Type_Apple_SEGB
4. Type_Apple_Icon_Cache
5. Type_Material_Exchange_Format
6. Type_ECW
7. Type_NetXray
8. Type_Waze_Roadmap_Data
9. Type_Maps_With_Me
10. Type_Apple_Encrypted_Archive
11. Type_Apple_SEGB_XML
12. Type_DataPilot_Database
13. Type_Numerical_Control
14. Type_NetCDF
15. Type_Android_Call_Log_Backup
16. Type_WebAssembly
17. Type_CPBitmap
18. Type_Protocol_Buffer_Archive
19. Type_Paint_Dot_Net
20. Type_Outlook_Express_DBT
21. Type_Discord_User_Information
22. Type_Discord_Message_Dump
23. Type_Olympus_Raw_Image
24. Type_EFTS
25. Type_Fuji_Raw_Image
26. Type_AlpineQuest_Track
27. Type_DEX
28. Type_FTK_Image
29. Type_Windows_Diagnostic_Telemetry
30. Type_Samsung_CMH
31. Type_Google_Takeout_My_Activity
32. Type_Gemini_Activity
33. Type_TensorFlow_Lite

Entity Types

1. ENTITY_TYPE_WAID - An identifier used by Microsoft Windows to target you with advertising.
2. ENTITY_TYPE_DISCORD_ACCOUNT_ID - An identifier for a Discord account
3. ENTITY_TYPE_REDDIT_ACCOUNT_ID - An identifier for a Reddit account
4. ENTITY_TYPE_AI_PROMPT - An AI prompt, user AI query
5. ENTITY_TYPE_UBER_ACCOUNT_ID - An Uber account identifier
6. ENTITY_TYPE_WAZE_ACCOUNT_ID - A Waze account identifier

Event Types

1. EVENT_TYPE_DEVICE_LOCKED - When a device enters a locked state
2. EVENT_TYPE_DEVICE_UNLOCKED - When a device has been unlocked
3. EVENT_TYPE_FAILED_LOGON - Someone tried and failed to log on
4. EVENT_TYPE_MEETING - A meeting

Location Type

1. LOCATION_TYPE_NETWORK_CONNECTION - When we know the location of a network that a user connected to.
2. LOCATION_TYPE_ALPINEQUEST_STARTING_POINT - AlpineQuest Starting Point.
3. LOCATION_TYPE_POINT_OF_INTEREST - Point of Interest (POI).

Message Type

1. MESSAGE_TYPE_LYNC - A Lync message