Stitch
| Executable | Stitch.exe
|
| Stage | 40 |
| Percent Complete | 62% |
| Message Queue | stitch
|
The Stitch ETL performs the task of gathering files from a piece of media and producing something from it. This ETL will only run once per media.
Contents
Description
The purpose of stitching is to review a piece of media, gather files and information and produce output that is useful to the user. Like Poly, it will use multiple files to produce output files that will get expanded but subsequent calls to Stitch will produce nothing. While Poly is triggered by the presence of certain file types, Stitch is triggered by all ETLs in previous stages having completed their processing. All media processing after Stitch will be in serial while before Stitch, exploitation executes in parallel.
Tasks
Stitch performs these tasks.
Fragmented File Carving
Stitch takes fragments of carved files and puts them back together again. The fragments of the file are put back in order and added as a complete file even though the individual pieces could be randomly scattered throughout the drive.
File Types
Stitch can defragment the following types of files.
File Reference Fixup
Fixing up file references is the task where a reference to a file was found in the media but the file being referenced may not have been. For example, in email or chat, a file (JPG) may have been sent. When Truxton processes the SQLite file containing the chat, it may also contain information about the file that was sent but not the contents of that file. The expander can fill out all that is known about the file like File Name, File Size. Fixing up this reference means we have to query this media to see if there is an original file that matches the reference. It will attempt to fix references from:
- EMail Attachments
- MMS Attachments
- vCard Attachments
Apple Filesystem Event Consolidation
Stitch will gather all of the Apple Filesystem Events files and produce a single FSEvents.sql file that can be used to create a SQLite database compatible with other tools.
