Type Media Snippet

<< Details >>

Defined Constant	Type_Media_Snippet
File Type Value	9999
Parent Type	XML
Carve	No
Format Details	No
MIME Type	text/xml
Filename Extension	xml

Snippet

Description

A Media Snippet is an XML file that contains useful information that is difficult to get, but won't be queried. The database holds information that will be queried by an analyst. Reports contain collection of information that an analyst will read. In the middle are snippets. There is information that is useful in a report or forensic processing that isn't suitable to be stored in the database.

Details

A snippet is generated by Truxton during the exploitation of a file. It will contain information required to reproduce the results. When parsing a snippet file is faster than parsing the file that produced the snippet, Truxton will use a snippet. Snippets can be used in later stages to produce artifacts or events.

Sample - Current Control Set

When Truxton exploits a registry file, there are some tidbits of information that are useful but you wouldn't keep them around in the database. Here's a snippet produced by processing a registry file (system.sav).

<snippet hash="c0c74ce6da024453583d2ce1dda24e52" parent="5fb4f68b-d162-94ce-993a-3bc4000013cd" grandparent="5fb4f68b-d162-94ce-993a-3bc4000013bd" media="1719dda9-ac1b-96e3-db89-08a4a479d567">
 <CurrentControlSetNumber>
  <Number offset="4100" registrypath="Select\Current">0</Number>
  <When offset="377608" registrypath="Select">2008-01-30T05:29:13</When>
 </CurrentControlSetNumber>
</snippet>

The attributes of the snippet element give you the MD5 hash of the parent file, parent file id, parent file id of the parent file and the media id. The grandparent value is useful when you have to process multiple snippets produced by files that exist in the same folder. This snippet contains the CurrentControlSet as specified in the registry file. The offset attributes tell you where in the file the value was found and registrypath tells you the logical address of the value. The When element contains the FILETIME of the key the the value was found in.

Sample - syskey

In order for Truxton to produce a Windows Logon Password Dump file, it must do quite a bit of processing of data from several different registry files. The keys used to descramble the password hashes are stored in one registry files while others contains the scrambled hashes.

<snippet hash="7e7dd5025d9bbd25683b0c6358b28f30" parent="5fb4f68b-d162-94ce-993a-3bc400000497" grandparent="5fb4f68b-d162-94ce-993a-3bc40000048a" media="1719dda9-ac1b-96e3-db89-08a4a479d567">
 <syskey md5="7e7dd5025d9bbd25683b0c6358b28f30" path="ControlSet001\Control\Lsa" jd="f7704de8" skew1="3decb4a1" gbg="3593eea2" data="0edab3e2">35EC3D4DA293DAE8F7B4700EB3EEE2A1</syskey>
 <TimeZone>
  <Name offset="389460" registrypath="ControlSet001\Control\TimeZoneInformation\StandardName">Pacific Standard Time</Name>
  <When md5="7e7dd5025d9bbd25683b0c6358b28f30" offset="388744" registrypath="ControlSet001\Control\TimeZoneInformation">2008-01-31T04:32:17</When>
 </TimeZone>
 <syskey md5="7e7dd5025d9bbd25683b0c6358b28f30" path="ControlSet002\Control\Lsa" jd="f7704de8" skew1="3decb4a1" gbg="3593eea2" data="0edab3e2">35EC3D4DA293DAE8F7B4700EB3EEE2A1</syskey>
 <TimeZone>
  <Name offset="1318764" registrypath="ControlSet002\Control\TimeZoneInformation\StandardName">Pacific Standard Time</Name>
  <When md5="7e7dd5025d9bbd25683b0c6358b28f30" offset="1318624" registrypath="ControlSet002\Control\TimeZoneInformation">2008-01-30T05:33:45</When>
 </TimeZone>
 <CurrentControlSetNumber>
   <Number offset="4101" registrypath="Select\Current">1</Number>
   <When offset="923600" registrypath="Select">2008-01-30T13:41:52</When>
 </CurrentControlSetNumber>
</snippet>

Here you can see that Truxton extracted the syskey hash value as well as the jd, skew1, gbg and data pieces of the scrambling key.