truxwiki.com - User contributions [en]

Python Sample Exploitation ETL

2023-05-25T09:37:39Z

Admin: /* Code Walkthrough */

This sample shows the steps needed to implement a file exploitation ETL in Truxton.
You can see this same sample implemented in [[C Sample Exploitation ETL|C]].

=Sample File Format=
This sample will exploit a fake file format we call Acme.
[https://en.wikipedia.org/wiki/Acme_Corporation Acme Corporation] is a known supplier of nefarious devices and explosives.
Their file format begins with a five byte [https://en.wikipedia.org/wiki/Magic_number_(programming) magic value] followed by eleven bytes in a data structure.
If the sixth byte in the file is 0x11 then it is a serial number file that uniquely identifies the user.

<pre>
0000h: 88 77 66 55 00 11 22 33 44 55 66 77 88 99 AA BB
0010h: CC
</pre>

=Source Code=
<source line lang="python">
import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton

def main():

etl = truxton.etl()
etl.name = "Acme Exploitation"
etl.description = "This exploits Acme Corporation data files"
etl.queue = "wiley"
etl.stage = 40
etl.addtype(11111)

message = etl.getmessage()

while message is not None:
file_in_truxton = message.file()

file_in_truxton.seek(5)

next_byte = file_in_truxton.read(1)
if next_byte[0] == 0x11:
# Serial Number. The next 8 bytes are a serial number
file_in_truxton.seek(6)
serial_number = file_in_truxton.read(8)

artifact = file_in_truxton.newartifact()
artifact.type = truxton.ENTITY_TYPE_SERIAL_NUMBER
artifact.value = serial_number.hex()
artifact.datatype = truxton.DATA_TYPE_uint8_t
artifact.offset = 6
artifact.length = 8
artifact.save()

# Pause here until we get another message from the "wiley" message queue
message = etl.getmessage()

return None

if __name__ == "__main__":
main()
</source>

=Code Walkthrough=
Lines 7-12 setup the ETL. The message queue name will be "wiley", we are an early stage and want to receive Acme files (11111 was chosen as the identifier of Acme files).

Line 14 starts the ETL logic and waits until a message arrives on the "wiley" queue.

Line 17 opens the file so we can read from it.

Lines 21-22 read the sixth byte in the file and checks it for validity.

Lines 27-33 creates an artifact (which will be stored in the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table in the database) and saves it to Truxton.

Line 28 sets the [[Entity Types|type of artifact]] to a serial number.
This allows analysts to quickly find items of interest by their type.

Line 30 stores the [[DATA_TYPE|format]] of how the serial number was stored in the file.

Line 33 saves the data to Truxton.
It will create a record in the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table in the database.
Saving the artifact will cause Truxton to route it to any ETL that has subscribed to <code>[[Type_Artifact]]</code> messages.

Line 36 pauses your ETL until a new message arrives on it queue.

=Development and Debugging=
Truxton ETLs assume they are part of a processing stream instead of processing a file from the local system.
This can slow your development cycle down.
Here's one strategy that will make your development iterations quicker:
# Perform a load with your sample file in it
# Find the file using the desktop GUI, copy the file identifier.
# Stop the Truxton service. This will prevent a "real" ETL from grabbing your file.
# Modify your program to use the <code>[[TruxtonETL#sendmefileid.28file_id.29|sendmefileid()]]</code> function.
# Now every time you run your program you will immediately receive that file to play with.

<source lang="python" highlight="14">
import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton

def main():

etl = truxton.etl()
etl.name = "Acme Exploitation"
etl.description = "This exploits Acme Corporation data files"
etl.queue = "wiley"
etl.stage = 40
etl.addtype(11000)

etl.sendmefileid("5f06ef4d-03dd-5258-2758-378e00000011")

message = etl.getmessage()

while message is not None:
file_in_truxton = message.file()

file_in_truxton.seek(5)

next_byte = file_in_truxton.read(1)
if next_byte[0] == 0x11:
# Serial Number. The next 8 bytes are a serial number
file_in_truxton.seek(6)
serial_number = file_in_truxton.read(8)

artifact = file_in_truxton.newartifact()
artifact.type = truxton.ENTITY_TYPE_SERIAL_NUMBER
artifact.value = serial_number.hex()
artifact.datatype = truxton.DATA_TYPE_uint8_t
artifact.offset = 6
artifact.length = 8
artifact.save()

# Pause here until we get another message from the "wiley" message queue
message = etl.getmessage()

return None

if __name__ == "__main__":
main()
</source>

Python

2022-04-19T02:14:36Z

Admin:

Truxton supports Python 3.10 via the <code>Truxton.pyd</code> library.
This exposes the functionality of Truxton to Python.
Truxton does not limit Python's capabilities in any way.

=Overview=
You must use the "import" directive to load the Truxton Python provider in <code>truxton.pyd</code>.
This directive will search a variety of folders for the <code>[https://docs.python.org/3/faq/windows.html#is-a-pyd-file-the-same-as-a-dll pyd]</code> file for Truxton (<code>truxton.pyd</code>).
Normally, this file is installed in the SDK folder (<code>C:\Program Files\Truxton\SDK</code>) along with all of the dependent files. Be sure to include the full path (e.g. <code>c:\program files\truxton\sdk</code>)
in your PATH environment variable so that Windows can locate all the needed dependencies.

You can modify the <code>[https://docs.python.org/3/using/cmdline.html?highlight=pythonpath#envvar-PYTHONPATH PYTHONPATH]</code> environment variable to include the SDK folder and Python will automatically search this folder.
Doing so will allow you to simply specify the Truxton library at the top of your scripts:

<source lang="Python">
import truxton
</source>

If you don't have permission to modify environment variables, or you want to test your code with different versions of Truxton, you can manually modify Python's module search path.
Instead of using <code>PYTHONPATH</code> environment variable, you can tell Python which folder contains <code>truxton.pyd</code> by adding the following to the top of your scripts:

<source lang="Python">
import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton
</source>

You can, within code, change which version of Truxton will be used with your script.
This ensures your script will always work should a breaking change be introduced in a subsequent release of Truxton.

When you import <code>truxton</code> you will get all of the predefined constants for [[File Types Supported|file type,]] [[DATA TYPE|data type,]] [[Origin|origins,]] [[Location Types|locations,]]
[[Message Types|messages,]] [[Entity Types|entities,]] [[Relation Types|relations,]] [[Event Types|events,]] [[Media Types|media,]] [[Object Types|objects,]] [[URL Methods|url methods,]] and [[URL Types|urls.]]
You can see them all by issuing a <code>dir</code> command.

<source lang="Python">
>>> dir(truxton)
</source>

This will allow your Python code to use the same constant names as C, C++ and C# code.

<source lang="Python">
>>> print(truxton.Type_JPEG)
203
</source>

Once you have this working, you can start playing with Truxton.
<source lang="Python">
import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton

def main():
t = truxton.create()
print(t.version)

if __name__ == "__main__":
main()
</source>

=Style=
In general, when using a Truxton Python object, you will follow this pattern:
# Create the object
# Set the data members of the object
# Call <code>save()</code> to store the object in the Truxton database.

Until you call <code>save()</code>, nothing will appear in Truxton.

=Classes=
Truxton exposes several classes to Python.
* [[Truxton Top Level Object | Truxton]] - The top level object.
* [[TruxtonArtifact]] - For adding records to the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table.
* [[TruxtonArtifactType]] - For adding custom artifact types to Truxton. This will make an entry in the <code>[EntityType]</code> table.
* [[TruxtonBolo]] - For adding [https://en.wikipedia.org/wiki/All-points_bulletin#Policing BOLO] criteria to generate alerts.
* [[TruxtonChildFileIO]] - For writing a file to Truxton.
* [[TruxtonCommunication]] - For adding email, sms, mms, etc. communications to Truxton.
* [[TruxtonETL]] - For becoming a Truxton [https://en.wikipedia.org/wiki/Extract,_transform,_load ETL] process.
* [[TruxtonEvent]] - For adding records to the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table.
* [[TruxtonEventType]] - For adding custom event types to Truxton. This will make an entry in the <code>[EventType]</code> table.
* [[TruxtonExport]] - For exporting files out of Truxton.
* [[TruxtonEXIF]] - For adding records to the <code><nowiki>[</nowiki>[[EXIF Table|EXIF]]<nowiki>]</nowiki></code> table.
* [[TruxtonFileIO]] - For working with a read-only file stored in Truxton.
* [[TruxtonFileType]] - For adding new file types to Truxton. This will make an entry in the <code>[FileType]</code> table.
* [[TruxtonInvestigation]] - For creating new investigations in Truxton. This will make an entry in the <code>[Investigation]</code> table.
* [[TruxtonJurisdiction]] - For creating new jurisdictions in Truxton. This will make an entry in the <code>[Jurisdiction]</code> table.
* [[TruxtonLocation]] - For adding geographic coordinates to the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.
* [[TruxtonMedia]] - For adding media to Truxton. This will make an entry in the <code>[Media]</code> table.
* [[TruxtonMessage]] - The way Truxton [https://en.wikipedia.org/wiki/Extract,_transform,_load ETL] processes communicate.
* [[TruxtonObject]] - The object responsible for a connection to Truxton.
* [[TruxtonOptions]] - The object responsible for retrieving configuration variables from Truxton's [[Configuration System]].
* [[TruxtonRelation]] - For adding records to the <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> table for relating two items in Truxton.
* [[TruxtonSensitiveSiteList]] - For handling Sensitive Site Lists
* [[TruxtonSubject]] - For adding subjects of investigations, aka persons of interest, aka suspects. This will make an entry in the <code>[Suspect]</code> table.
* [[TruxtonUrl]] - For adding records to the <code><nowiki>[</nowiki>[[WebsiteVisit Table|WebsiteVisit]]<nowiki>]</nowiki></code> table.
* [[TruxtonUSB]] - For adding records to the <code><nowiki>[</nowiki>[[USBDevice Table|USBDevice]]<nowiki>]</nowiki></code> table.

=Remarks=
The Python API is designed primarily for programs to contribute to Truxton.

<code>Truxton.pyd</code> was developed using the [[Truxton C API | C API]] with a thin [https://docs.python.org/3/c-api/index.html adapter layer] of code to translate from Python provider semantics to Truxton calls.

=Samples=
* [[Python Sample Register a New File Type|Register a New File Type]] - Create your own type of file
* [[Python Sample Identification ETL|ETL for File Identification]] - Identify new file types
* [[Python Sample Exploitation ETL|ETL for File Exploitation]] - Exploit files
* [[Python Sample Export Videos|Export Videos]] - Export only unique videos from Truxton
* [[Helpful scripts#E01 of E01s|Export E01s]] - Exporting E01s from Truxton
* [[Creating a Rack#Display Machine Configuration|Rack Configuration]] - Displaying information about the configuration of a server in a rack
* [[Query Truxton|Query the Truxton Database]] - Using Python to pull information out of the Truxton database

TruxtonLocation

2022-04-18T18:53:59Z

Admin: /* Sample */

This class lets you add to the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table in Truxton.
=Attributes and Methods=

==altitude==
The altitude in meters.

==<code>fileid</code>==
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the file this location came from.
This corresponds to the <code>[FileID]</code> column of the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.

==<code>id</code>==
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the record.
It becomes non-zero after <code>save()</code> has been called.
This corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.

==<code>label</code>==
The short label for this location.
This corresponds to the <code>[Label]</code> column of the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.

==<code>latitude</code>==
The [https://en.wikipedia.org/wiki/Latitude latitude] portion of the geographic coordinate using the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] ellipsoid.
This corresponds to the <code>[Latitude]</code> column of the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.

==<code>longitude</code>==
The [https://en.wikipedia.org/wiki/Longitude longitude] portion of the geographic coordinate using the [https://en.wikipedia.org/wiki/World_Geodetic_System#WGS84 WGS84] ellipsoid.
Many thanks go to [https://en.wikipedia.org/wiki/John_Harrison John Harrison] for his work.
This corresponds to the <code>[Longitude]</code> column of the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.

==<code>mediaid</code>==
This is the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] of the media this location came from.
This corresponds to the <code>[MediaID]</code> column of the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.

==<code>save()</code>==
This will commit the information to the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.
It will return [https://docs.python.org/3/library/constants.html#True True] if the record was saved to the database, [https://docs.python.org/3/library/constants.html#False False] if there was an error.

==<code>tag(tag, reason, origin)</code>==
This creates a tag associated with this location in Truxton.
The <code>tag</code> parameter is a short, one or two word, bit of text that will be displayed in the UI.
The <code>reason</code> a sentence explaining why this location was tagged.
The <code>origin</code> is either <code>TAG_ORIGIN_AUTOMATIC</code> (1) or <code>TAG_ORIGIN_HUMAN</code> (2).
It will return
[https://docs.python.org/3.8/library/constants.html?highlight=false#True True] if the tag was associated with the location, [https://docs.python.org/3.8/library/constants.html?highlight=false#False False] on failure.

==<code>type</code>==
The type of the location.
This corresponds to the <code>[LocationTypeID]</code> column of the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table.
It must be a value listed in the <code>ID</code> column of the <code>[LocationType]</code> table.
You can also use a [[Location Types | predefined constant.]]

==<code>when</code>==
The time associated with this location in [https://docs.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-filetime FILETIME] ticks.

=Sample=
<source lang="Python" highlight="43-49">
import sys
sys.path.append('C:/Program Files/Truxton/SDK')
import truxton
import shutil

from datetime import datetime
from calendar import timegm
from pathlib import Path

EPOCH_AS_FILETIME = 116444736000000000
HUNDREDS_OF_NANOSECONDS = 10000000

def date_to_filetime(dt):
return EPOCH_AS_FILETIME + (timegm(dt.timetuple()) * HUNDREDS_OF_NANOSECONDS)

def add_file(parent_truxton_file, filename):
source_file = open(filename, "rb")
child = parent_truxton_file.newchild()
child.name = Path(filename).name
shutil.copyfileobj(source_file, child)
source_file.close()
child.save()
return child

def add_media(t):
media = t.newmedia()

media.name = "Public Documents"
media.description = "Publicly available documents"
media.case = "DC-SNAFU-2016.2020"
media.evidencebag = "EV-0937459386623-a"
media.originator = "Jeffrey Jensen"
media.latitude = 38.897661
media.longitude = -77.036458
media.type = truxton.MEDIA_TYPE_LOGICAL_FILES
media.save()

return media

def add_cs(parent_file ):
child_file = add_file(parent_file, "cs.jpg")

gps = child_file.newlocation()
gps.type = truxton.LOCATION_TYPE_MEETING
gps.latitude = 51.487329
gps.longitude = -0.124057
gps.label = "HQ"
gps.when = date_to_filetime(datetime.fromisoformat("2016-04-01T12:00:00-05:00"))
gps.save()

def main():
t = truxton.create()

media = add_media(t)

root_file = media.addroot()
root_file.save()

add_cs(root_file)

if __name__ == "__main__":
main()
</source>

TruxtonService.xml

2020-05-18T21:12:31Z

Admin: /* Configuration File */

This file contains the information for turning a machine into a Truxton Exploitation node.

=Truxton Service=
Checks once per minute to see if ETLs and Services are running.

=Configuration File=
The Truxton Service uses the [[Configuration System]] to gather options.

==Settings==
===purger===
Truxton has expiration dates for media.
The default expiration date of media is 99 years from when it was loaded.
This setting governs if this instance of the Truxton Service will query the database for expired media and automatically delete it.

===employed===
When set to true, this instance of Truxton Service will spawn ETL processes and monitor them.

===work_schedule===
This section specifies when ETL processes are allowed to run.
Each day of the week can have a different schedule.
When the services comes on duty, it will start the ETL processes.
When it goes off duty, it will gracefully stop the ETL processes.

===etl===
This section defines an ETL process.
the <code>exe</code> element describes how the ETL should run and what the name of the executable file is.

* <code>controllable</code> - This attribute tells the Truxton Service if the ETL was written using Truxton libraries. This allows

===service===
A service will run as long as the Truxton Service is running.
It is immune from the work schedule.

===shutdownmachine===
This setting will power the loader machine off when the ETLs go idle for a while.
This is handy if you have spun up several VMs and don't want them to run when there's nothing to do.

==Sample Configuration File==
This section contains a sample configuration file from a running machine.
One of the things we try to do in Truxton is to log where things came from.
Notice the first comment in the file, it logs who created the configuration file and when.

<syntaxhighlight lang="XML">
<root>
<truxton_options>

<service_configuration_version>1840023666788</service_configuration_version>

<purger>yes</purger>
<work_schedule>

<employed>yes</employed>
<monday>
<on_duty>0000-2359</on_duty>
</monday>
<tuesday>
<on_duty>0000-2359</on_duty>
</tuesday>
<wednesday>
<on_duty>0000-2359</on_duty>
</wednesday>
<thursday>
<on_duty>0000-2359</on_duty>
</thursday>
<friday>
<on_duty>0000-2359</on_duty>
</friday>
<saturday>
<on_duty>0000-2359</on_duty>
</saturday>
<sunday>
<on_duty>0000-2359</on_duty>
</sunday>
</work_schedule>
<emptyqueuethresholdseconds>3600</emptyqueuethresholdseconds>
<etls>
<etl>
<description>This consumes BOLOs and creates Alerts.</description>
<exe controllable="yes" instances="1" queue="alert">Alert</exe>
</etl>
<etl>
<description>This expands archive files.</description>
<exe controllable="yes" instances="1" queue="archives">Archives</exe>
</etl>
<etl>
<description>This carves free space for files.</description>
<exe controllable="yes" instances="1" queue="carve">Carve</exe>
<arguments>-carve_threads 0</arguments>
</etl>
<etl>
<description>This generates video contact sheets, the 10x10 grid of images taken throughout the video.</description>
<exe controllable="yes" instances="1" queue="contactsheet">ContactSheet</exe>
</etl>
<etl>
<description>This parses MIME email files.</description>
<exe controllable="yes" instances="1" queue="email">EMail</exe>
</etl>
<etl>
<description>This is the main file expander service.</description>
<exe controllable="yes" instances="4" queue="expand">Expand</exe>
</etl>
<etl>
<description>This performs final processing after all files are present. It performs count queries and updates statistics.</description>
<exe controllable="yes" instances="1" queue="finishedstage">Finished</exe>
</etl>
<etl>
<description>This identifies file contents and routes accordingly.</description>
<exe controllable="yes" instances="1" queue="identify">Identify</exe>
</etl>
<etl>
<description>This is a loader as an ETL. It has the responsibility to expand files and load media.</description>
<exe controllable="yes" instances="1" queue="load">Load</exe>
<arguments>-lq load</arguments>
</etl>
<etl>
<description>This coordinates the poly file expansion process.</description>
<exe controllable="yes" instances="1" queue="poly">Poly</exe>
</etl>
<etl>
<description>This finds the all of the pieces of multi-part archives and expands them.</description>
<exe controllable="yes" instances="1" queue="pfe">PolyFileExpander</exe>
</etl>
<etl>
<description>This exploits Windows registry files.</description>
<exe controllable="yes" instances="1" queue="registry">Registry</exe>
</etl>
<etl>
<description>This exports registry files to the local filesystem, spawns RegRipper.exe, grabs the result and makes it a child file of the registry file.</description>
<exe controllable="yes" instances="1" queue="regripper">RegRipper</exe>
</etl>
<etl>
<description>This spawns executables to expand files then kills them when done.</description>
<exe controllable="yes" instances="1" queue="remoteexpand">RemoteFileExpander</exe>
</etl>
<etl>
<description>This generates the reports.</description>
<exe controllable="yes" instances="1" queue="report">Report</exe>
</etl>
<etl>
<description>This keeps the SOLR service running.</description>
<exe controllable="yes" instances="1" queue="solrcontentstage">SOLR</exe>
</etl>
<etl>
<description>This sends files to SOLR for content indexing.</description>
<exe controllable="yes" instances="1" queue="solrfile">SOLRFile</exe>
</etl>
<etl>
<description>This reassembles fragments of carved files into the correct order for viewing.</description>
<exe controllable="yes" instances="1" queue="stitch">Stitch</exe>
</etl>
<etl>
<description>This extracts text from files.</description>
<exe controllable="yes" instances="1" queue="tqueue">TextExtract</exe>
</etl>
<etl>
<description>This generates small thumbnail images from larger images.</description>
<exe controllable="yes" instances="2" queue="thumbnail">Thumbnail</exe>
</etl>
<etl>
<description>This uses Yara to scan files for the rules you specify. Normally this is a malware scanner.</description>
<exe controllable="yes" instances="1" queue="yara">Yara</exe>
</etl>
</etls>
<services>{Solr 5 Server||$TextIndexerData$Search/bin/solr.cmd|start -p 8983 -m 5416m -a "-XX:-UsePerfData"|$TextIndexerData$Search/bin/solr.cmd|stop -p 8983|java.exe|jetty.port=8983},</services>

<shutdownmachine>false</shutdownmachine>
</truxton_options>
</root>
</syntaxhighlight>

Configuration System

2020-05-18T20:56:55Z

Admin:

=Description=

The way to communicate settings to Truxton is through a class called <code>Options</code>.
This is an interpretation of the Ye Olde "Command Line Options" of which much has been written.
In Truxton, an option is prefaced by a name followed by the value.
There is only one value per option.
In this article, we may refer to an option as a parameter or setting.

=Sources=
The following are the nine different places that a parameter can come from. The lower the number, the greater the precedence that option has. The harder it is for a user to define an option, the greater weight that option will be given. It is harder for a user to specify an option on a command line because they must type it out. The user exerts no effort whatsoever to use a default value compiled into programs. Therefore, the command line option will be used instead of the compiled default.

# Command Line Parameters
# Command Line Configuration File
# Command Line Database
# Environment Variable
# ETL Configuration File
# ETL Machine File
# Database by Machine
# Truxton Settings File
# Compiled Defaults

==Command Line Parameters==
If a human takes the time to physically type parameters on a command line, they must really mean that they want this value to be used. Anything specified on a command line takes precedence over any other location. The format of command line parameters is parameter name followed by a space and the parameter value.

<syntaxhighlight lang="bat">
load.exe -w 1 --xx abc /z "3 4 and 5" disk.dat
</syntaxhighlight>

In the example above there are three options specified and one non-option.

{| class="wikitable"
|-
! Option Name
! Option Value
|-
| w
| 1
|-
| xx
| abc
|-
| z
| 3 4 and 5
|}

The non-option is "disk.dat" A command line is the only way to specify a non-option.

Option names can be prefaced with a single dash, double dash or a slash depending on your command line religion.

==Command Line Configuration File==
You can put the name of a configuration file on the command line.

<syntaxhighlight lang="bat">
Identify.exe my_settings.xml
</syntaxhighlight>

The <code>my_settings.xml</code> would be assumed to be a file name since it was not part of an option.
That file would then be opened, parsed as [https://en.wikipedia.org/wiki/XML XML] and anything found in a <code>truxton_options</code> section would be used as configuration options.
All XML element names used in Truxton are lower case.

The settings would look like this:
<syntaxhighlight lang="xml">
<truxton_options>
<w>1</w>
<xx>abc</xx>
<z>3 4 and 5</z>
</truxton_options>
</syntaxhighlight>

==Command Line Database==
If you specify a settings identifier on the command line, Truxton will retrieve that setting from the database and use it.
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] you specify should match the <code>ID</code> column of the <code>Setting</code> table.
If a record is found, it will then parse the XML contents of the <code>Value</code> column.

<syntaxhighlight lang="bat">
Identify.exe 51256fb4-c7f6-327a-2703-325e219ecc2b
</syntaxhighlight>

If you actually use a random value you will have no end of mistakes.
We suggest making fake ids for settings and using those.
It will make typing it in far easier. Here's a fake setting that can be easily typed and remembered by a human.

<syntaxhighlight lang="bat">
Identify.exe 12345678-1234-1234-1234-123456789abc
</syntaxhighlight>

==Environment Variable==
Configuration options can also be set using environment variables.
These variables must have names that begin with <code>Truxton_</code>
For example:
<syntaxhighlight lang="bat">
set Truxton_w=1
set Truxton_xx=abc
set Truxton_z="3 4 and 5"
Load.exe disk.dat
</syntaxhighlight>

==ETL Configuration File==
Another location is an XML configuration file specifically for this type of ETL process.
Truxton will look for a file in the same directory as the executable with <code>config</code> as the extension.
For example, the <code>Identify.exe</code> ETL process will look for a file named <code>Identify.config</code> and parse it if found.

==ETL Machine File==
This is a configuration file with customized settings valid for the machine that runs the ETL processes.
Truxton will look for a file in the same directory as the <code>TruxtonSettings.xml</code> file named <code>TruxtonSettings.machine</code> as the extension.

Machine configuration is usually used for specifying common settings that are unique to a machine.
For example, every ETL process needs some sort of temporary directory.
Some of your ETL machines may have RAM disks, others may have hard drives with differing drive letters.
Machine configuration files allow you to customize where the temp folder is for each machine.

==Database by Machine==
Each installation of Truxton has a globally unique machine identifier.
This can be found in the <code>machineid</code> element of the <code>TruxtonSettings.XML</code> file.
Truxton will connect to the database and query the <code>Setting</code> table for a record with the machine identifier in the <code>ID</code> column.
If found, the XML in the <code>Value</code> column will be parsed for options.

==Truxton Settings File==
Each installation has a <code>TruxtonSettings.xml</code> file.
It is found in the <code>%programdata%\Truxton\Settings</code> folder which usually expands to <code>C:\ProgramData\Truxton\Settings</code>

'''NOTE:''' The <code>ProgramData</code> folder is normally hidden and won't show up in directory listings (or File Explorer).

Its primary purpose is to store the [https://en.wikipedia.org/wiki/Universally_unique_identifier globally unique identifier] for the machine which was generated during installation.
The default database connection parameters are also stored here.

As you can see, the <code>TruxtonSettings.xml</code> file has very low priority.

==Compiled Defaults==
Each ETL member can have default options built into it. If the option is not specified anywhere above, whatever was compiled into the executable will be used. This is the last resort.

=Debugging the Options=
With nine different places to get options from, how could anything go wrong? If you need help debugging why an option isn't getting the value you want, use the <code>debugoptions</code> option.

<syntaxhighlight lang="bat">
Identify.exe -debugoptions 1
</syntaxhighlight>

This will cause an installation log to be created and the options written to it.
This log file is found in the <code>Truxton\OptionsDebugging</code> directory under the <code>%programdata%</code> folder (which usually expands to <code>C:\ProgramData</code>) folder.
An installation log is the only log that can be created safely if everything else fails.
==Sample Options Log==
<pre>
Log file created by "C:\Program Files\Truxton\Loader\Identify.exe"
2019-10-16T12:31:21Z 4454-6528 : Processing "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml" as TruxtonSettings.xml(C:\ProgramData\Truxton\Settings\TruxtonSettings.xml)
2019-10-16T12:31:21Z 4454-6528 : Getting Options from Truxton Database
2019-10-16T12:31:21Z 4454-6528 : Parsing 3 command line arguments
2019-10-16T12:31:21Z 4454-6528 : Beginning to parse the command line arguments at array index 0
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] = "identify"
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] ("identify") is being added as a NotOption.
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] ("identify") was added as a NotOption number 0.
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 1 ] = "-debugoptions"
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 2 ] = "1" is the value of option "debugoptions"
2019-10-16T12:31:21Z 4454-6528 : No existing option named "debugoptions" was found, creating a new one
2019-10-16T12:31:21Z 4454-6528 : Finished parsing 3 command line arguments, there are now 1 NotOptions
2019-10-16T12:31:21Z 4454-6528 : Processing "C:\Program Files\Truxton\Loader\Identify.config" as the ETL.config file
2019-10-16T12:31:21Z 4454-6528 : Can't parse "C:\Program Files\Truxton\Loader\Identify.config" as XML
2019-10-16T12:31:21Z 4454-6528 : Processing "C:\ProgramData\Truxton\Settings\TruxtonSettings.machine" as the ETL.machine file
2019-10-16T12:31:21Z 4454-6528 : Can't parse "C:\ProgramData\Truxton\Settings\TruxtonSettings.machine" as XML
2019-10-16T12:31:21Z 4454-6528 : All Option Dump (The first entry of duplicate lines is the value that will be used by the program.)
Process "C:\Program Files\Truxton\Loader\Identify.exe"
createthedatabase : "1" from TruxtonSettings.xml XML element name truxton_options.CreateTheDatabase beginning at line 15 column 3 byte 485 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
datadir : "C:\Truxton Data" from TruxtonSettings.xml XML element name truxton_options.datadir beginning at line 13 column 3 byte 384 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbname : "Truxton" from TruxtonSettings.xml XML element name truxton_options.dbname beginning at line 5 column 3 byte 123 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbpassword : "Truxton4n6" from TruxtonSettings.xml XML element name truxton_options.dbpassword beginning at line 7 column 3 byte 180 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbport : "5432" from TruxtonSettings.xml XML element name truxton_options.dbport beginning at line 4 column 3 byte 98 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbserver : "localhost" from TruxtonSettings.xml XML element name truxton_options.dbserver beginning at line 3 column 3 byte 64 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbsr1 :
dbuser : "postgres" from TruxtonSettings.xml XML element name truxton_options.dbuser beginning at line 6 column 3 byte 151 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
debugoptions : "1" from Command Line argument 2 (zero is the first)
filegroupshavebeeninitialized : "1" from TruxtonSettings.xml XML element name truxton_options.FileGroupsHaveBeenInitialized beginning at line 17 column 3 byte 593 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
machineid : "64B30278-F250-4896-82EB-1AC416DB30B2" from TruxtonSettings.xml XML element name truxton_options.machineid beginning at line 14 column 3 byte 422 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqname : "TruxtonMessageBus" from TruxtonSettings.xml XML element name truxton_options.mqname beginning at line 10 column 3 byte 278 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqpassword : "Truxton4n6" from TruxtonSettings.xml XML element name truxton_options.mqpassword beginning at line 12 column 3 byte 345 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqport : "5432" from TruxtonSettings.xml XML element name truxton_options.mqport beginning at line 9 column 3 byte 253 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqserver : "localhost" from TruxtonSettings.xml XML element name truxton_options.mqserver beginning at line 8 column 3 byte 219 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mquser : "postgres" from TruxtonSettings.xml XML element name truxton_options.mquser beginning at line 11 column 3 byte 316 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
solr_url : "http://localhost:8983/solr/truxton-core" from TruxtonSettings.xml XML element name truxton_options.solr_url beginning at line 16 column 3 byte 529 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
writesettings :

End of Options, Start of Non-Options
"identify"

End of All Option Dump

2019-10-16T12:31:21Z 4454-6528 : Processing "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml" as TruxtonSettings.xml(C:\ProgramData\Truxton\Settings\TruxtonSettings.xml)
2019-10-16T12:31:21Z 4454-6528 : Getting Options from Truxton Database
2019-10-16T12:31:21Z 4454-6528 : Parsing 3 command line arguments
2019-10-16T12:31:21Z 4454-6528 : Beginning to parse the command line arguments at array index 0
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] = "identify"
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] ("identify") is being added as a NotOption.
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] ("identify") was added as a NotOption number 0.
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 1 ] = "-debugoptions"
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 2 ] = "1" is the value of option "debugoptions"
2019-10-16T12:31:21Z 4454-6528 : No existing option named "debugoptions" was found, creating a new one
2019-10-16T12:31:21Z 4454-6528 : Finished parsing 3 command line arguments, there are now 1 NotOptions
2019-10-16T12:31:21Z 4454-6528 : Processing "C:\Program Files\Truxton\Loader\Identify.config" as the ETL.config file
2019-10-16T12:31:21Z 4454-6528 : Can't parse "C:\Program Files\Truxton\Loader\Identify.config" as XML
2019-10-16T12:31:21Z 4454-6528 : Processing "C:\ProgramData\Truxton\Settings\TruxtonSettings.machine" as the ETL.machine file
2019-10-16T12:31:21Z 4454-6528 : Can't parse "C:\ProgramData\Truxton\Settings\TruxtonSettings.machine" as XML
2019-10-16T12:31:21Z 4454-6528 : All Option Dump (The first entry of duplicate lines is the value that will be used by the program.)
Process "C:\Program Files\Truxton\Loader\Identify.exe"
aci : "10007" from Default definitions
alert_email_from_address : "Truxton@localhost" from Default definitions
alert_email_subject : "[Truxton Alert]" from Default definitions
carve : "1" from Default definitions
carve_threads : "1" from Default definitions
carvemode : "0" from Default definitions
carveoffset : "65536" from Default definitions
carveunknown : "0" from Default definitions
cmid : "0" from Default definitions
controlledby : "0" from Default definitions
createthedatabase : "1" from TruxtonSettings.xml XML element name truxton_options.CreateTheDatabase beginning at line 15 column 3 byte 485 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
cunk : "1" from Default definitions
cws : "10485760" from Default definitions
datadir : "C:\Truxton Data" from TruxtonSettings.xml XML element name truxton_options.datadir beginning at line 13 column 3 byte 384 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbname : "Truxton" from TruxtonSettings.xml XML element name truxton_options.dbname beginning at line 5 column 3 byte 123 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbname : "Truxton" from Default definitions
dbpassword : "Truxton4n6" from TruxtonSettings.xml XML element name truxton_options.dbpassword beginning at line 7 column 3 byte 180 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbport : "5432" from TruxtonSettings.xml XML element name truxton_options.dbport beginning at line 4 column 3 byte 98 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbport : "5432" from Default definitions
dbserver : "localhost" from TruxtonSettings.xml XML element name truxton_options.dbserver beginning at line 3 column 3 byte 64 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbserver : "127.0.0.1" from Default definitions
dbsr1 :
dbuser : "postgres" from TruxtonSettings.xml XML element name truxton_options.dbuser beginning at line 6 column 3 byte 151 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbuser : "postgres" from Default definitions
debugfileidmapping : "0" from Default definitions
debugoptions : "1" from Command Line argument 2 (zero is the first)
dedupemessages : "0" from Default definitions
deepsleep : "45007" from Default definitions
deletedfiles : "1" from Default definitions
depotpagesize : "4096" from Default definitions
ds : "0" from Default definitions
ee : "0" from Default definitions
excludefilesbytype : "0" from Default definitions
excludes : "0" from Default definitions
fct : "300" from Default definitions
filegroupshavebeeninitialized : "1" from TruxtonSettings.xml XML element name truxton_options.FileGroupsHaveBeenInitialized beginning at line 17 column 3 byte 593 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
fileslack : "1" from Default definitions
fqhi : "7500" from Default definitions
fqlo : "100" from Default definitions
hashsetall : "0" from Default definitions
iei : "1" from Default definitions
imagelength : "-1" from Default definitions
imageoffset : "0" from Default definitions
includefilesbytype : "0" from Default definitions
includes : "0" from Default definitions
istatus : "1" from Default definitions
itype : "0" from Default definitions
loadas : "0" from Default definitions
machineid : "64B30278-F250-4896-82EB-1AC416DB30B2" from TruxtonSettings.xml XML element name truxton_options.machineid beginning at line 14 column 3 byte 422 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
maxsleep : "600101" from Default definitions
metacarve : "1" from Default definitions
minsleep : "3011" from Default definitions
mlat : "0" from Default definitions
mlong : "0" from Default definitions
mqname : "TruxtonMessageBus" from TruxtonSettings.xml XML element name truxton_options.mqname beginning at line 10 column 3 byte 278 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqname : "TruxtonMessageBus" from Default definitions
mqpassword : "Truxton4n6" from TruxtonSettings.xml XML element name truxton_options.mqpassword beginning at line 12 column 3 byte 345 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqport : "5432" from TruxtonSettings.xml XML element name truxton_options.mqport beginning at line 9 column 3 byte 253 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqport : "0" from Default definitions
mqserver : "localhost" from TruxtonSettings.xml XML element name truxton_options.mqserver beginning at line 8 column 3 byte 219 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqserver : "127.0.0.1" from Default definitions
mquser : "postgres" from TruxtonSettings.xml XML element name truxton_options.mquser beginning at line 11 column 3 byte 316 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mquser : "postgres" from Default definitions
mr : "0" from Default definitions
nocontents : "0" from Default definitions
nohashsets : "0" from Default definitions
norouting : "0" from Default definitions
nostartdelay : "0" from Default definitions
nostore : "0" from Default definitions
numberofbuffers : "2048" from Default definitions
numberofbytesperbuffer : "65536" from Default definitions
numberoffiles : "9223372036854775807" from Default definitions
pfiles : "1" from Default definitions
pfree : "1" from Default definitions
priority : "1000" from Default definitions
rapid : "0" from Default definitions
recovery : "0" from Default definitions
reprocess : "0" from Default definitions
skipdupmedia : "0" from Default definitions
smtp_server : "localhost" from Default definitions
solr_url : "http://localhost:8983/solr/truxton-core" from TruxtonSettings.xml XML element name truxton_options.solr_url beginning at line 16 column 3 byte 529 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
startatmft : "0" from Default definitions
syslogport : "514" from Default definitions
timeout : "120" from Default definitions
triage : "0" from Default definitions
tsk_verbose : "0" from Default definitions
updatemedianumberofchildren : "1" from Default definitions
updatepathid : "1" from Default definitions
verbose : "0" from Default definitions
wait : "none" from Default definitions
writesettings :
xorcarve : "1" from Default definitions

End of Options, Start of Non-Options
"identify"

End of All Option Dump

2019-10-16T12:31:21Z 4454-6528 : application_name='Truxton Identify' dbname='Truxton' user='postgres' password='Truxton4n6' host='localhost' port=5432
2019-10-16T12:31:21Z 4454-6528 : application_name='Truxton Identify' dbname='TruxtonMessageBus' user='postgres' password='Truxton4n6' host='localhost' port=5432
2019-10-16T12:31:21Z 4454-6528 : Truxton Identify can't get connection string variable dbserver variable "logserver"
2019-10-16T12:31:21Z 4454-6528 : application_name='Truxton Identify' dbname='Truxton' user='postgres' password='Truxton4n6' host='localhost' port=5432
</pre>

TruxtonService.xml

2020-05-18T20:49:12Z

Admin:

This file contains the information for turning a machine into a Truxton Exploitation node.

=Truxton Service=
Checks once per minute to see if ETLs and Services are running.

=Configuration File=
<syntaxhighlight lang="XML">
<root>
<truxton_options>

<service_configuration_version>1840023666788</service_configuration_version>

<purger>yes</purger>
<work_schedule>

<employed>yes</employed>
<monday>
<on_duty>0000-2359</on_duty>
</monday>
<tuesday>
<on_duty>0000-2359</on_duty>
</tuesday>
<wednesday>
<on_duty>0000-2359</on_duty>
</wednesday>
<thursday>
<on_duty>0000-2359</on_duty>
</thursday>
<friday>
<on_duty>0000-2359</on_duty>
</friday>
<saturday>
<on_duty>0000-2359</on_duty>
</saturday>
<sunday>
<on_duty>0000-2359</on_duty>
</sunday>
</work_schedule>
<emptyqueuethresholdseconds>3600</emptyqueuethresholdseconds>
<etls>
<etl>
<description>This consumes BOLOs and creates Alerts.</description>
<exe controllable="yes" instances="1" queue="alert">Alert</exe>
</etl>
<etl>
<description>This expands archive files.</description>
<exe controllable="yes" instances="1" queue="archives">Archives</exe>
</etl>
<etl>
<description>This carves free space for files.</description>
<exe controllable="yes" instances="1" queue="carve">Carve</exe>
<arguments>-carve_threads 0</arguments>
</etl>
<etl>
<description>This generates video contact sheets, the 10x10 grid of images taken throughout the video.</description>
<exe controllable="yes" instances="1" queue="contactsheet">ContactSheet</exe>
</etl>
<etl>
<description>This parses MIME email files.</description>
<exe controllable="yes" instances="1" queue="email">EMail</exe>
</etl>
<etl>
<description>This is the main file expander service.</description>
<exe controllable="yes" instances="4" queue="expand">Expand</exe>
</etl>
<etl>
<description>This performs final processing after all files are present. It performs count queries and updates statistics.</description>
<exe controllable="yes" instances="1" queue="finishedstage">Finished</exe>
</etl>
<etl>
<description>This identifies file contents and routes accordingly.</description>
<exe controllable="yes" instances="1" queue="identify">Identify</exe>
</etl>
<etl>
<description>This is a loader as an ETL. It has the responsibility to expand files and load media.</description>
<exe controllable="yes" instances="1" queue="load">Load</exe>
<arguments>-lq load</arguments>
</etl>
<etl>
<description>This coordinates the poly file expansion process.</description>
<exe controllable="yes" instances="1" queue="poly">Poly</exe>
</etl>
<etl>
<description>This finds the all of the pieces of multi-part archives and expands them.</description>
<exe controllable="yes" instances="1" queue="pfe">PolyFileExpander</exe>
</etl>
<etl>
<description>This exploits Windows registry files.</description>
<exe controllable="yes" instances="1" queue="registry">Registry</exe>
</etl>
<etl>
<description>This exports registry files to the local filesystem, spawns RegRipper.exe, grabs the result and makes it a child file of the registry file.</description>
<exe controllable="yes" instances="1" queue="regripper">RegRipper</exe>
</etl>
<etl>
<description>This spawns executables to expand files then kills them when done.</description>
<exe controllable="yes" instances="1" queue="remoteexpand">RemoteFileExpander</exe>
</etl>
<etl>
<description>This generates the reports.</description>
<exe controllable="yes" instances="1" queue="report">Report</exe>
</etl>
<etl>
<description>This keeps the SOLR service running.</description>
<exe controllable="yes" instances="1" queue="solrcontentstage">SOLR</exe>
</etl>
<etl>
<description>This sends files to SOLR for content indexing.</description>
<exe controllable="yes" instances="1" queue="solrfile">SOLRFile</exe>
</etl>
<etl>
<description>This reassembles fragments of carved files into the correct order for viewing.</description>
<exe controllable="yes" instances="1" queue="stitch">Stitch</exe>
</etl>
<etl>
<description>This extracts text from files.</description>
<exe controllable="yes" instances="1" queue="tqueue">TextExtract</exe>
</etl>
<etl>
<description>This generates small thumbnail images from larger images.</description>
<exe controllable="yes" instances="2" queue="thumbnail">Thumbnail</exe>
</etl>
<etl>
<description>This uses Yara to scan files for the rules you specify. Normally this is a malware scanner.</description>
<exe controllable="yes" instances="1" queue="yara">Yara</exe>
</etl>
</etls>
<services>{Solr 5 Server||$TextIndexerData$Search/bin/solr.cmd|start -p 8983 -m 5416m -a "-XX:-UsePerfData"|$TextIndexerData$Search/bin/solr.cmd|stop -p 8983|java.exe|jetty.port=8983},</services>

<shutdownmachine>false</shutdownmachine>
</truxton_options>
</root>
</syntaxhighlight>

Resource Group

2020-05-18T20:45:40Z

Admin: Created page with "A Resource Group in Azure is way of grouping resources into a manageable set. The neat thing about a Resource Group is when you delete it, all resources get deleted too. It is..."

A Resource Group in Azure is way of grouping resources into a manageable set.
The neat thing about a Resource Group is when you delete it, all resources get deleted too.
It is a simple way to test systems by putting them into a group that can be easily cleaned up.

==Creation==

In order to begin playing with practically anything in Azure, you must first create a Resource Group to hold things.

# Go to the Azure Portal Home
# In the left pane, select Resource Groups
# In the Resource Groups pane on the right, click "+Add" in the top menu bar
# Select the Subscription (billing)
# Give the new Resource Group workspace a name. While not a law, it is highly recommended to use only lower case letters in your Resource Group Name (truxlogs).
# Pick a Region to host the Resource Group (useast or useast2)
# Not required, but it is highly recommended to add tags to the resource group. '''CreatedBy''' and '''Description''' are quite helpful.
# Click "Review + create"
# If validation succeeds, press "Create"

You will be taken back to the list of Resource Groups screen.
Wait a minute or two then refresh the web page and you should see your new group listed.

Azure Log Analytics

2020-05-18T20:45:12Z

Admin: Created page with "==AKA== Log Analytics has also been known as: * Operational Insights * Monitor ==Creation== In order to begin playing with Azure Log Analytics, you must first create a Log A..."

==AKA==
Log Analytics has also been known as:
* Operational Insights
* Monitor

==Creation==

In order to begin playing with Azure Log Analytics, you must first create a Log Analytic Workspace (aka Operational Insights Workspace).
To do that, you must first have a [[Resource Group]].

# Go the Home page of Azure Portal
# In the "Search resources" edit control at the top of the page, type "Log Analytics" then select "Log Analytics workspaces" from the results.
# Click the "+ Add" button in the top menu bar
# Give the new workspace a name (truxlaw)
# Select the Subscription
# Select the [[Resource Group]] (truxlogs)
# Select the Location. For best results, use the same location as the [[Resource Group]] (US East or US East 2)
# Click OK
# Azure will go off and think about what you've done for a while, then tell you it succeeded. Wait a minute or two and refresh the web page to see the new workspace listed.

==Keys and ID==

In order for Truxton to log forensic items to Azure Monitor service, it must know where to send the log messages.

# Edit the <code>TruxtonSettings.xml</code> file in the "C:\ProgramData\Truxton\Settings" folder.
# Under the <code>truxton_options</code> element, create a new element named <code>AzureMonitor</code>
# Under the <code>AzureMonitor</code> element, create a new element named <code>LogAnalyticsWorkspaceID</code>
# Under the <code>AzureMonitor</code> element, create a new element named <code>APIKey</code>
# In a browser, go the Azure portal, locate your Log Analytics workspace.
# Select Advanced Settings and then Connected Sources.
# Under the "WORKSPACE ID" label, select the [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID], copy and then paste it into the <code>LogAnalyticsWorkspaceID</code> element in <code>TruxtonSettings.xml</code>.
# Under the "PRIMARY KEY" label, select the text, copy and then paste it into the <code>APIKey</code> element in <code>TruxtonSettings.xml</code>.
# Save <code>TruxtonSettings.xml</code>

===Sample Config File===
<syntaxhighlight lang="xml">
<?xml version="1.0" encoding="utf-8"?>
<truxton_options>
<AzureMonitor>
<LogAnalyticsWorkspaceID>7d70d995-c49d-43f2-80d0-1253ef811c73</LogAnalyticsWorkspaceID>
<APIKey>YxNXhS8oXCjTXp87DMpEZAcLv5od3dTaSR0xzm3xzQWT7svsytJ/WQyyejLn9lbxI4VbM/ByzuTV8dgqW0V2eg==</APIKey>
</AzureMonitor>
<dbserver>localhost</dbserver>
<dbport>5432</dbport>
<dbname>Truxton</dbname>
<dbuser>postgres</dbuser>
<dbpassword>password</dbpassword>
<mqserver>localhost</mqserver>
<mqport>5432</mqport>
<mqname>TruxtonMessageBus</mqname>
<mquser>postgres</mquser>
<mqpassword>password</mqpassword>
<datadir>C:\Truxton Data</datadir>
<machineid>9D29E664-A4F2-48C3-88D2-BCF7CB5DEBBC</machineid>
<CreateTheDatabase>1</CreateTheDatabase>
<solr_url>http://localhost:8983/solr/truxton-core</solr_url>
</truxton_options>
</syntaxhighlight>

==References==
* [https://docs.microsoft.com/en-us/cli/azure/monitor/log-analytics/workspace?view=azure-cli-latest az] - You can create a log analytic workspace using:
<syntaxhighlight lang="powershell">
az monitor log-analytics workspace create
</syntaxhighlight>

Azure

2020-05-18T20:44:50Z

Admin: Created page with "Azure is Microsoft's cloud. '''NOTE''' We will use the [https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest Azure CLI] (Command Line Interface) for all example..."

Azure is Microsoft's cloud.

'''NOTE''' We will use the [https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest Azure CLI] (Command Line Interface) for all example commands.

=Subscription=
A subscription is basically billing address.
A "subscription id" is a [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].

A subscription id is also known as:
* Tenant ID
* Directory ID

=Resource Group=
Resource groups belong to a subscription.
A "resource group id" is a [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].
Everything you create in Azure will belong to a resource group.
[https://en.wikipedia.org/wiki/Virtual_machine VMs], virtual networks, database servers, etc. that you create in Azure will belong to a resource group.
Making each of these things can be tricky.
The really nice thing about a resource group is you can easily kill them.
<syntaxhighlight lang="powershell">
az group delete --name truxtonrg --subscription 78E6D3E6-F7D7-4FDF-A9FC-40F014C3D78F --yes
</syntaxhighlight>
When you delete a resource group, Azure will conveniently destroy every resource in that group.
While you may have carefully toiled to create many intricately connected resources, they can all be killed in an instant.

=How To=

When we write [https://docs.microsoft.com/en-us/powershell/ Powershell] scripts to create the pieces of Truxton in Azure, we will typically provide as much information as possible to those scripts.
When creating a resource, the resource group id will be a mandatory parameter while the subscription id is an optional parameter.
We will always specify both.
We have encountered enough problems that were solved by providing both ids that we will forever provide both to the Azure CLI scripts.

*[[Azure Log Analytics]]

Developer's Guide

2020-05-18T20:43:48Z

Admin: /* Code Dependencies */

=Truxton Developer's Guide=

[[How to Write an ETL]]

=Truxton Stuff=

* [[How Truxton Works]]
* [[Truxton SDK]]
* [[Message Bus Drivers]]
* [[Connie]] - The Message Bus Concentrator
* [[Azure]]
* [[Debugging the Loader]]
* [[Add A New File Type]]
* [[Depot]] file format
* [[Load List]] file format
* [[Next Generation Database]]
* [[File Type Identification]]
* [[Database Schema]]
* [[VC Redistributables]]
* [[Configuration System]]
* [[Useful SQL Queries]]
* [[Temporary Filenames]]
* [[Watch Desktop Logs]]
* [[TruxtonService.xml]]
* [[ETL Stages]]
* [[Message Bus Messages]]
* [[How To Debug LE ETLs]]
* [[Installed Libraries]]

=Data Types=
Truxton uses lots of defined constants and enums.
Here's a list of them.

* [[Content Status]]
* [[DATA TYPE|Data Types]]
* [[Depot Types]]
* [[Entity Types]]
* [[Origin|File Content Origins]]
* [[Media Types]]
* [[Media Status]]
* [[Media Load Percentage]]

=Exploitation=
* [[File Format Research]]
* [[SQLite Queries]]
* [[Time Epochs]]

=Code Dependencies=
* [[vcpkg]]
* [https://github.com/SammyB428/WFC Win32 Foundation Classes]

Vcpkg

2020-05-18T20:41:24Z

Admin: Created page with "[https://github.com/Microsoft/vcpkg vcpkg] is Microsoft's C++ package manager. It ships as source code that you build. It includes several tools such as: * [https://cmake.org/..."

[https://github.com/Microsoft/vcpkg vcpkg] is Microsoft's C++ package manager.
It ships as source code that you build.
It includes several tools such as:
* [https://cmake.org/ CMake] - Because the other build tools that Microsoft ships ([https://docs.microsoft.com/en-us/cpp/build/reference/nmake-reference?view=vs-2019 nmake], [https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild?view=vs-2019 MSBuild]) just aren't good enough.
* [https://www.7-zip.org/ 7Zip] (7za)
* [https://en.wikipedia.org/wiki/Bash_%28Unix_shell%29 bash]
* [https://git-scm.com/ git]
* [http://mingw.org/ MinGW]
* [https://www.nuget.org/ nuget]

=What It Does=
[https://github.com/Microsoft/vcpkg vcpkg] performs three basic tasks:
# Download source code
# Compile source code into libraries/executables
# Copy files to well known folders

=Prerequisites=
* A [https://git-scm.com/download/win command line git] client.
* Powershell

=Getting vcpkg=

Here's how to put a C++ library project into a package.
These steps are derived from [https://github.com/microsoft/vcpkg/blob/master/docs/examples/packaging-github-repos.md this] article.

# Create a folder
#: <syntaxhighlight lang="bat">mkdir MyProject</syntaxhighlight>
# Go into that folder
#: <syntaxhighlight lang="bat">cd MyProject</syntaxhighlight>
# Get the vcpkg source code
#: <syntaxhighlight lang="bat">git clone https://github.com/Microsoft/vcpkg.git</syntaxhighlight>
# Go into the vcpkg folder
#: <syntaxhighlight lang="bat">cd vcpkg</syntaxhighlight>
# Start Powershell
#: <syntaxhighlight lang="bat">powershell</syntaxhighlight>
# Compile vcpkg
#: <syntaxhighlight lang="bat">.\bootstrap-vcpkg.bat</syntaxhighlight>
# As of this writing, 2019-10-24, vcpkg defaults to 32-bit builds. To get it to use 64-bit you must set a global environment variable to something called a [https://github.com/microsoft/vcpkg/blob/master/docs/users/triplets.md "triplet"] which is a long string with two fields in it.
#: <syntaxhighlight lang="bat">VCPKG_DEFAULT_TRIPLET=x64-windows</syntaxhighlight>
# [https://github.com/microsoft/vcpkg/blob/master/docs/users/integration.md Integrate] vcpkg with your build system
#: <syntaxhighlight lang="bat">.\vcpkg integrate install</syntaxhighlight>
#: You can uninstall the integration by:
#: <syntaxhighlight lang="bat">.\vcpkg integrate remove</syntaxhighlight>
# vcpkg is now ready to use. To get and compile a package, you use the <code>install</code> command.
#: <syntaxhighlight lang="bat">.\vcpkg install curl</syntaxhighlight>

=Recommended Environment Variables=
* <code>VCPKG_DEFAULT_TRIPLET=x64-windows</code>
* <code>VCPKG_PLATFORM_TOOLSET=v142</code>
* <code>VCPKG_TARGET_ARCHITECTURE=x64</code>

=How it Works=
The [https://github.com/Microsoft/vcpkg vcpkg] package manager gets the package information for packages it knows how to get from a folder named <code>ports</code>
The package name is the name of a folder in <code>ports</code>
That named folder will contain at least a <code>CONTROL</code> file and a <code>portfile.cmake</code>.
When you "install" a package, the compilation result will be written to a sub-folder named <code>packages</code> with the name of the package, an underscore and the [https://github.com/microsoft/vcpkg/blob/master/docs/users/triplets.md triplet] (the two-field string).

vcpkg uses [https://cmake.org CMake] as the primary build tool that can spawn other build tools to build your code.

==Sample==
<syntaxhighlight lang="bat">vcpkg install wfc</syntaxhighlight>

vcpkg will then:
# Read a file named <code>ports/wfc/portfile.cmake</code>
# Download the source code to a folder named <code>buildtrees/wfc/src</code>
# It will then build the source code
# It will copy the compiled results from step 2 to a folder named <code>packages/wfc_x64-windows</code>

If you want to delete an installed package:

<syntaxhighlight lang="bat">vcpkg remove wfc</syntaxhighlight>

=Adding a New Package=

Make a folder in the <code>ports</code> folder with the name of your new package (<code>wfc</code>).
Go into that folder to do your work.
You must create two files, <code>CONTROL</code> and <code>portfile.cmake</code>

==CONTROL==
This file gives you a description of the package (aka library).
<syntaxhighlight lang="text">
Source: wfc
Version: 77
Description: Win32 Foundation Classes is a C++ library to help with Win32 programming.
</syntaxhighlight>

==portfile.cmake==
This file is basically a build script, in yet another build-script language.
This one is in [https://cmake.org/ CMake].
<pre>
include(vcpkg_common_functions)

if (NOT VCPKG_TARGET_IS_WINDOWS)
message(FATAL_ERROR "\n${PORT} does not support your system, only Windows for now. Please open a ticket issue on github.com/microsoft/vcpkg if necessary\n")
endif()

vcpkg_from_github(
OUT_SOURCE_PATH SOURCE_PATH
REPO SammyB428/WFC
REF dd41bd5e3f2ed8daa9d87adde938b156317bc3b9
SHA512 d02c7cde8cfed24db5ca52e46e15f866d1dcec3f42013d059ad60fc98bedeec3409b8dad768ad53918a4f152ee07442dcbe9234aa2e625daba4038f1ef24efc9
HEAD_REF master
)

vcpkg_install_msbuild(
SOURCE_PATH ${SOURCE_PATH}
PROJECT_SUBPATH lib/WFC.sln
INCLUDES_SUBPATH INCLUDE
LICENSE_SUBPATH LICENSE
REMOVE_ROOT_INCLUDES
USE_VCPKG_INTEGRATION
PLATFORM x64
RELEASE_CONFIGURATION "STL Unicode Release"
DEBUG_CONFIGURATION "STL Unicode Debug"
)
</pre>

The really important fields are:

===vcpkg_from_github===
This is a [https://cmake.org CMake] function defined in <code>vcpkg\scripts\cmake\vcpkg_from_github.cmake</code> which will clone a [https://github.com/ GitHub] project so it can be built locally.

====REPO====
This field holds the github repository name (<code>SammyB428/WFC</code>) to retrieve.

====REF====
This is either the release name of the repository to get '''OR''' the hash of the commit to retrieve.
In our example, we are retrieving a specific commit <code>dd41bd5e3f2ed8daa9d87adde938b156317bc3b9</code>

====SHA512====
This is the [https://en.wikipedia.org/wiki/SHA-2 SHA-512] of the [https://en.wikipedia.org/wiki/Zip_(file_format) ZIP] file downloaded from github.

The get the correct [https://en.wikipedia.org/wiki/SHA-2 SHA-512] value for the <code>SHA512</code> line, just set it to "1" then run:
<syntaxhighlight lang="bat">vcpkg install wfc</syntaxhighlight>
This will generate an error message with the desired hash in it.

<syntaxhighlight lang="bat">
C:\Users\Sam\Documents\vcpkg\vcpkg>vcpkg.exe install wfc
The following packages will be built and installed:
wfc[core]:x86-windows
Starting package 1/1: wfc:x86-windows
Building package wfc[core]:x86-windows...
-- Using cached C:/Users/Sam/Documents/vcpkg/vcpkg/downloads/SammyB428-WFC-dd41bd5e3f2ed8daa9d87adde938b156317bc3b9.tar.gz
CMake Error at scripts/cmake/vcpkg_download_distfile.cmake:99 (message):

File does not have expected hash:

File path: [ C:/Users/Sam/Documents/vcpkg/vcpkg/downloads/SammyB428-WFC-dd41bd5e3f2ed8daa9d87adde938b156317bc3b9.tar.gz ]
Expected hash: [ 1 ]
Actual hash: [ d02c7cde8cfed24db5ca52e46e15f866d1dcec3f42013d059ad60fc98bedeec3409b8dad768ad53918a4f152ee07442dcbe9234aa2e625daba4038f1ef24efc9 ]

Please delete the file and retry if this file should be downloaded again.
</syntaxhighlight>

Copy the value from the <code>Actual hash:</code> field of the error message to the <code>SHA512</code> field.

===vcpkg_install_msbuild===
This is a [https://cmake.org CMake] function defined in <code>vcpkg\scripts\cmake\vcpkg_install_msbuild.cmake</code> which will build then install an [https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild?view=vs-2019 MSBuild]-based project.

====PROJECT_SUBPATH====
The relative path from the root of the unzipped file where your solution file resides.

====PLATFORM====
The platform identifier that matches the platform identifier in your vcxproj file.

====RELEASE_CONFIGURATION====
The name of the configuration in your vcxproj file that will produce the "Release" build.

====DEBUG_CONFIGURATION====
The name of the configuration in your vcxproj file that will produce the "Debug" build.

Developer's Guide

2020-05-18T20:41:16Z

Admin: /* Code Dependencies */

Temporary Filenames

2020-05-18T20:39:44Z

Admin:

Truxton follows a pattern when it has to create temporary files.

{| class="wikitable"
|-
! First Three Letters
! ETL
|-
| style="text-align:center;" | CTS
| ContactSheet
|-
| style="text-align:center;" | RGR
| Regripper
|}

Temporary Filenames

2020-05-18T20:39:01Z

Admin: Created page with "Truxton follows a pattern when it has to create temporary files. {| class="wikitable" |- ! First Three Letters ! Author |- | style="text-align:center;" | CTS | [https://gith..."

Truxton follows a pattern when it has to create temporary files.

{| class="wikitable"
|-
! First Three Letters
! Author
|-
| style="text-align:center;" | CTS
| [https://github.com/Probity/Truxton/blob/master/ETL/ContactSheet/ContactSheet.cs#L553 ContactSheet]
|-
| style="text-align:center;" | RGR
| [https://github.com/Probity/Truxton/blob/master/ETL/RegRipper/Program.cs#L327 Regripper ]
|}

TruxtonService.xml

2020-05-18T20:38:24Z

Admin: Created page with "This file contains the information for turning a machine into a Truxton Exploitation node. =Truxton Service= Checks once per minute to see if ETLs and Services are running."

This file contains the information for turning a machine into a Truxton Exploitation node.

=Truxton Service=
Checks once per minute to see if ETLs and Services are running.

VC Redistributables

2020-05-18T20:37:29Z

Admin: Created page with "Microsoft will periodically screw you by changing the contents of the DLLs that implement the C/C++ runtime. Typically, they will add a new critical DLL to the package. Since..."

Microsoft will periodically screw you by changing the contents of the DLLs that implement the C/C++ runtime.
Typically, they will add a new critical DLL to the package.
Since we compile with the latest Visual Studio, we '''must''' update the installer to include the '''very latest''' C/C++ runtime installer.
* This [https://support.microsoft.com/en-us/help/2977003/the-latest-supported-visual-c-downloads page] contains the links to the different packages.
* This [https://aka.ms/vs/16/release/vc_redist.x64.exe link] should download the latest C/C++ installer.

ETL Stages

2020-05-18T20:35:59Z

Admin: Created page with "=Explanation= ETL Stages are key to solving the problem of process coordination. The Truxton exploitation process was broken down into a series of steps. These steps are perfo..."

=Explanation=
ETL Stages are key to solving the problem of process coordination.
The Truxton exploitation process was broken down into a series of steps.
These steps are performed in a stage.
When the stages are complete, Truxton is finished processing that media.

By associating a stage number (1-255) to an exploitation process, Truxton can manage the transition from chaotic to ordered processing.

==ETL Communications==
The ETL processes communicate using a [[Message Bus Messages|message bus]].
The messages contain information about a file needing processing and how to get the file contents.

==Simple Exploitation Walk Through==
The first stage is Load. It performs the following tasks:
# Navigate the source media (disk image, folder or file)
# Puts contents into [[Depot|depot]] files
# Puts meta data into the database
# Identifies the file's contents
# Based on the [[File Types Supported|file's type]], the file is routed to the ETL process by putting a message into that ETL's message queue.
The ETL process will:
# Wait until a message arrives for it to process
# Retrieve the contents of the file referenced in the message
# Report status to the Load Status Monitor (Les)
# Exploit those contents to produce more files, or entities, or messages, etc.
# Files produced by one ETL can be sent to another
When all ETLs have finished, the load is complete.

=Stages and Status Monitoring=
In order to process all of the data, we must begin with utter chaos and transition to a ordered steps that must be completed linearly.
Some ETLs can thrive in the chaos, some cannot and some live in both worlds.
There are ranges of stage values for an ETL.
The rule is, if two ETL processes have the same stage value, they can operate in parallel.
If one ETL has a higher stage value than another, it will execute '''after''' that other ETL.
This is ignored in the Chaos region, becomes relevant in the Semi-Chaotic region and becomes law in the Linear.

It is the job of the Load Status Monitor (Les) to watch all of the ETLs and advance the media through the stages of exploitation.

==Chaos==
The chaotic stages are where files are produced and/or atomically exploited.
If a file is stand-alone, not requiring any other files to exploit it, it is considered to be "atomic."
This is the easiest ETL to write.

One example of a chaotic file is a [[Type_ZIP|zip]] file.
An ETL process that unzips the file to produce child files is atomic in that all it needs to do its job is the contents of that one zip file.
ETL processes run in a parallel and operate on different media simultaneously (participate in different "loads").
Chaotic stages produce files in random order.

These stages can be thought of as executing in non-linear time.
Child files can be processed before their parents.
Files are processed in random order.

==Semi-Chaotic==
When the chaotic ETLs have finished producing files for a piece of media, the next stage of exploitation can begin.
Semi-chaotic ETLs produce files but in a more orderly fashion and after the chaos is finished.
When they produce files, everything falls down again into utter chaos.

The exploitation process enters this loop between Chaos and Semi-Chaotic until no Semi-Chaotic ETL produces any files, then the linear processing can take place.

One example of a semi-chaotic file is a [[Type_Spanned_Zip|spanned zip]] file.
This is a zip archive that spans several files.
It cannot reliably be exploited in the Chaotic stages because all of the files in the archive might not yet exist in Truxton.
By waiting until the chaos has subsided, we know that all of the files in the span will be present.
Truxton will notify the Poly File Expander when the chaos is complete.
Poly will then:
# Search the current media for any files known to be part of a type that requires more than one file to exploit
# It will then exploit that file during which, the other files can be queried for
# It produces child files which cause the chaos stage to reignite

For the spanned zip, Poly will find all pieces of the span, combine them together then expand the archive.
Since Poly will restart the chaos, it keeps track of which files it has processed.
When it is again told to process a piece of media, it can ignore files it has already processed.

Semi-chaotic ETLs operate in non-linear time but after chaos.
Once they are complete, processing enters the linear stage.

===Note: Stage Value Behavior===
Stitching (fragmented file carving) is another semi-chaotic ETL.
Poly is stage 32 while Stitch is stage 40.
This means that Stitch will not start until Poly is completely finished.
If Stitch was stage 32, it would be told to execute at the same time as Poly.

==Linear==
Linear stages are where some sort of sanity is brought to the process.
ETLs in this stage execute one after another.
For example, Alerts (stage 128) is executed before Reports (stage 160) because any alerts that were generated need to be included in reports.

==Untracked==
There is a class of ETLs that operate in a fashion that does not affect the status of media being processed.
Some examples include:
* Forensic Logging - log messages are sent to various destination such as [https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal Azure Log Analytics]
* SendGrid Notifier - When a load completes, the Media Summary report is emailed to a distribution list

=Stage Ranges=
Here are the values for all of the stages;.

{| class="wikitable"
! Name
! Value (Inclusive)
! Meaning
|-
| DoNotTrack
| style="text-align:center;" | 255
| This ETL should not be considered when determining the status of media
|-
| Load/Expand
| style="text-align:center;" | 1-31
| [[#Chaos | Chaos]]. ETLs in this stage range can produce files and artifacts in random order.
|-
| Poly File Expansion
| style="text-align:center;" | 32-63
| [[#Semi-Chaotic | Semi-Chaotic]]. ETLs in this stage range can produce files and artifacts in random order but only after previous stage ranges have completed.
|-
| Summarizing
| style="text-align:center;" | 64-96
| All files and artifacts (entities) have been produced. ETLs in this range query the data to produce summaries such as unique lists of artifacts.
|-
| Alerting
| style="text-align:center;" | 128-159
| ETLs in this range query the data to alerts any analysts may have wanted.
|-
| Reporting
| style="text-align:center;" | 160-191
| ETLs in this range query the data produced by any previous stage and create reports from it.
|-
| Feeding
| style="text-align:center;" | 192-223
| ETLs in this range query the data produced by any previous stage and feed it to external systems.
|-
| Finished
| style="text-align:center;" | 240-254
| ETLs perform any final tasks needed to make the media ready for the analyst. No further processing will take place.
|}

=ETLs and Their Stages=
Here's a list of ETLs, their stages and message bus queue names.
Remember, stage 255 means "do not track."

{| class="wikitable"
! ETL
! Executable
! Stage
! Percent
! Queue Name
|-
| DOCFILE
| <code>DOCFILE.exe</code>
| style="text-align:center;" | 8
| style="text-align:center;" | 48%
| docfile
|-
| Load
| <code>Load.exe</code>
| style="text-align:center;" | 1
| style="text-align:center;" | 48%
| loadq
|-
| RegRipper
| <code>RegRipper.exe</code>
| style="text-align:center;" | 8
| style="text-align:center;" | 48%
| regripper
|-
| Report
| <code>Report.exe</code>
| style="text-align:center;" | 160
| style="text-align:center;" | 80%
| report
|-
| Truxton Alert Generator
| <code>Alert.exe</code>
| style="text-align:center;" | 128
| style="text-align:center;" | 75%
| alert
|-
| Truxton Archive Expander
| <code>Archives.exe</code>
| style="text-align:center;" | 6
| style="text-align:center;" | 48%
| archives
|-
| Truxton Azure Image Analyzer
| <code>Azure.AnalyzeImage.exe</code>
| style="text-align:center;" | 9
| style="text-align:center;" | 48%
| azureanalyzeimage
|-
| Truxton Azure OCR
| <code>Azure.OCR.exe</code>
| style="text-align:center;" | 9
| style="text-align:center;" | 48%
| azureocr
|-
| Truxton Carve
| <code>Carve.exe</code>
| style="text-align:center;" | 4
| style="text-align:center;" | 48%
| carve
|-
| Truxton Contact Sheet Creator
| <code>ContactSheet.exe</code>
| style="text-align:center;" | 6
| style="text-align:center;" | 48%
| contactsheet
|-
| Truxton Email
| <code>EMail.exe</code>
| style="text-align:center;" | 12
| style="text-align:center;" | 48%
| email
|-
| Truxton Expand
| <code>Expand.exe</code>
| style="text-align:center;" | 3
| style="text-align:center;" | 48%
| expand
|-
| Truxton File Stitcher
| <code>Stitch.exe</code>
| style="text-align:center;" | 40
| style="text-align:center;" | 62%
| stitch
|-
| Truxton Finished Loads Monitor
| <code>Finished.exe</code>
| style="text-align:center;" | 240
| style="text-align:center;" | 94-100%
| finishedstage
|-
| Truxton Forensic Finding Logger
| <code>ForensicLogger.exe</code>
| style="text-align:center;" | 255
| style="text-align:center;" | N/A
| flogger
|-
| Truxton Identify
| <code>Identify.exe</code>
| style="text-align:center;" | 2
| style="text-align:center;" | 48%
| identify
|-
| Truxton Poly File Coordinator
| <code>Poly.exe</code>
| style="text-align:center;" | 32
| style="text-align:center;" | 60%
| poly
|-
| Truxton Registry Expander
| <code>Registry.exe</code>
| style="text-align:center;" | 9
| style="text-align:center;" | 48%
| registry
|-
| Truxton Remote Expand
| <code>RemoteFileExpander.exe</code>
| style="text-align:center;" | 3
| style="text-align:center;" | 48%
| remoteexpand
|-
| Truxton SOLR Contents Indexer
| <code>SOLR.exe</code>
| style="text-align:center;" | 192
| style="text-align:center;" | 90%
| solrcontentstage
|-
| Truxton SOLR File Indexer
| <code>SOLRFile.exe</code>
| style="text-align:center;" | 255
| style="text-align:center;" | N/A
| solrfile
|-
| Truxton Thumbnail Generator
| <code>Thumbnail.exe</code>
| style="text-align:center;" | 8
| style="text-align:center;" | 48%
| thumbnail
|-
| Truxton Yara Scanner
| <code>Yara.exe</code>
| style="text-align:center;" | 7
| style="text-align:center;" | 48%
| yara
|}

Time Epochs

2020-05-18T20:35:12Z

Admin: Created page with "Here's some of the time formats that Truxton can handle. =Apple Cocoa Core= [https://www.epochconverter.com/coredata Cocoa Core] is the number of seconds (32-bit value) since..."

Here's some of the time formats that Truxton can handle.

=Apple Cocoa Core=
[https://www.epochconverter.com/coredata Cocoa Core] is the number of seconds (32-bit value) since Jan 1, 2001.
The 64-bit version is the number of nanoseconds since 2001-01-01.

Type Google Hangout Database

2020-05-18T20:34:20Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Google_Hangout_Database</code> |- | File Type Value | 898 |- | Parent Type | Type_..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_Google_Hangout_Database</code>
|-
| File Type Value
| 898
|-
| Parent Type
| [[Type_SQLite_Database|SQLite]]
|-
| Expandable
| Yes
|-
| Carve
| Yes
|-
| Format Details
| Yes
|-
| MIME Type
| <code>application/x-sqlite3</code>
|-
| Filename Extension
| <code>db</code>
|}

Google Hangouts uses SQLite as a data storage format.

=Details=
Other sources of information:
* [https://github.com/bkerler/MR/blob/e27e5034265b4a2644cca013ea8c6677222a07f7/MobileRevelator/templates/Android%20-%20TomTom/com.google.android.talk.xml Mobile Revelator]

Filenames seen:
* <code>babel1.db</code>

=Queries=
Here are the queries Truxton uses to exploit Google Hangout.

==Gather the Chat Participants==
This query gathers the details for the participants in all messages.
<syntaxhighlight lang="sql">
SELECT DISTINCT [conversation_id], [author_chat_id], [participants].[full_name]
FROM [messages]
JOIN [participants] ON ([participants].[chat_id] = [messages].[author_chat_id])
WHERE [author_chat_id] IS NOT NULL
ORDER BY [conversation_id], [author_chat_id];
</syntaxhighlight>

==Gather Messages==
This query gathers the messages sorted by conversation and time.

<syntaxhighlight lang="sql">
SELECT [messages].[_id],
[messages].[message_id],
[messages].[conversation_id],
[messages].[author_chat_id],
[participants].[full_name],
[messages].[text],
[messages].[timestamp],
[messages].[latitude],
[messages].[longitude]
FROM [messages]
JOIN [participants] ON ([participants].[chat_id] = [messages].[author_chat_id])
ORDER BY [conversation_id],[timestamp]
</syntaxhighlight>

==Gather Contacts==
This query gathers the contact list.

<syntaxhighlight lang="sql">
SELECT [merged_contacts].[_id],
[merged_contacts].[contact_id],
[merged_contacts].[display_name],
[merged_contact_details].[lookup_data_standardized],
[merged_contact_details].[lookup_data_label]
FROM [merged_contacts]
JOIN [merged_contact_details] ON ([merged_contact_details].[merged_contact_id] = [merged_contacts].[_id])
ORDER BY [merged_contacts].[contact_id]
</syntaxhighlight>

SQLite Queries

2020-05-18T20:33:45Z

Admin: Created page with "Many man applications use SQLite to store important application information. This page lists the different queries Truxton uses to exploit them. * Type_Google_Hangout_Datab..."

Many man applications use SQLite to store important application information.
This page lists the different queries Truxton uses to exploit them.

* [[Type_Google_Hangout_Database|Google Hangout]]

File Format Research

2020-05-18T20:32:47Z

Admin: Created page with "When trying to figure out the type of a file... Here's some useful sites * [https://www.google.com/?tbm=pts Google Patent Search] * [https://github.com/zsx/ossbuild/blob/a510..."

When trying to figure out the type of a file...
Here's some useful sites

* [https://www.google.com/?tbm=pts Google Patent Search]
* [https://github.com/zsx/ossbuild/blob/a510b4fb1b15922c14dd6311a24f139b8a790699/Main/GStreamer/Source/gst-plugins-good/gst/qtdemux/qtdemux.c Great list of FourCCs]

See if there's existing code:

* [https://github.com/ Github] - Good place to search for "magic" values. Usually four bytes, search for the decimal and hexadecimal values both big and little endian.

Existing file format description:
* [https://www.loc.gov/preservation/digital/formats/fdd/descriptions.shtml Library of Congress]
* [https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-winprotlp/92b33e19-6fff-496b-86c3-d168206f9845 Microsoft Protocols]

Media Load Percentage

2020-05-18T20:31:23Z

Admin: Created page with "When media loads, we attempt to communicate an estimate of where in the process it is. We map this to a percentage but it is pretty horrible. {| class="wikitable" ! Percentag..."

When media loads, we attempt to communicate an estimate of where in the process it is.
We map this to a percentage but it is pretty horrible.

{| class="wikitable"
! Percentage
! Meaning
|-
| style="text-align:center;" | <48%
| <code>Load.exe</code> is currently processing the media.
|-
| style="text-align:center;" | 48%
| <code>Load.exe</code> has completed and only ETLs are now working.
|-
| style="text-align:center;" | 60% - 69%
| Poly files are being expanded in the ETL layer.
|-
| style="text-align:center;" | 70% - 74%
| Summarizing ETLs are now executing.
|-
| style="text-align:center;" | 75% - 79%
| Alerting ETLs are now executing.
|-
| style="text-align:center;" | 80% - 89%
| Reporting ETLs (report generators) are now executing.
|-
| style="text-align:center;" | 90% - 93%
| Feeding ETLs are now executing.
|-
| style="text-align:center;" | 94%
| <code>Finished.exe</code> is refreshing database materialized views.
|-
| style="text-align:center;" | 95%
| <code>Finished.exe</code> is updating the <code>NumberOfChildren</code> column for each record in the <code>File</code> table for this media.
|-
| style="text-align:center;" | 96%
| <code>Finished.exe</code> is calculating the full path and updating the <code>FullPathID</code> column for each record in the <code>File</code> table for this media.
|-
| style="text-align:center;" | 97%
| <code>Finished.exe</code> is updating the <code>Statistics</code> table for this media.
|-
| style="text-align:center;" | 98%
| <code>Finished.exe</code> is generating the loader log file for this media.
|-
| style="text-align:center;" | 99%
| <code>Finished.exe</code> is caching file counts.
|-
| style="text-align:center;" | 100%
| Everything is done.
|}

=Load Percentages Less Than 48%=
<code>Load Percentage = (Number of Bytes Processed / Size of the Media) * .48</code>

The formula for this calculation is 100% of the size of the media divided by the number of bytes processed scaled to 48%. You may see percentages well below 48% when <code>Load.exe</code> has skipped free space. If you load a 100GB image, <code>Load.exe</code> will use divide the number of bytes processed by 100GB to determine the percent complete of the media. It will then multiply that percentage by .48 to scale it to a number between 1 and 48. If the 100GB image only contains 25GB of files and no freespace (75GB) is processed, you will see a media load percentage of 12% when <code>Load.exe</code> exits.

<code>12 = ((25/100) * .48)</code>

Media Status

2020-05-18T20:31:00Z

Admin: Created page with "These defined constants represent the states of media in Truxton. {| class="wikitable" ! Name ! Value ! Meaning |- | <code>MEDIA_STATUS_UNKNOWN</code> | style="text-align:cen..."

These defined constants represent the states of media in Truxton.

{| class="wikitable"
! Name
! Value
! Meaning
|-
| <code>MEDIA_STATUS_UNKNOWN</code>
| style="text-align:center;" | 0
| We don't know what the status of the media is.
|-
| <code>MEDIA_STATUS_NOT_YET_IMAGED</code>
| style="text-align:center;" | 100
| A forensically sound copy of the media has not yet been made.
|-
| <code>MEDIA_STATUS_BEING_IMAGED</code>
| style="text-align:center;" | 101
| The media is currently in the process of being forensically imaged.
|-
| <code>MEDIA_STATUS_IMAGED</code>
| style="text-align:center;" | 102
| A forensically sound copy of the media has been made.
|-
| <code>MEDIA_STATUS_READY_FOR_LOADING</code>
| style="text-align:center;" | 150
| The media is ready to be loaded.
|-
| <code>MEDIA_STATUS_QUEUED_FOR_LOADING</code>
| style="text-align:center;" | 160
| The media has been queued for loading.
|-
| <code>MEDIA_STATUS_LOADING</code>
| style="text-align:center;" | 200
| The media is being processed by <code>Load.exe</code>
|-
| <code>MEDIA_STATUS_PAUSED</code>
| style="text-align:center;" | 203
| Processing of the media has been paused.
|-
| <code>MEDIA_STATUS_NOW_IN_ETL_LAYER</code>
| style="text-align:center;" | 205
| <code>Load.exe</code> has finished but the ETL layer is still processing.
|-
| <code>MEDIA_STATUS_COUNTING_CHILDREN</code>
| style="text-align:center;" | 220
| Counting the number of children of each file processed and storing that in the database.
|-
| <code>MEDIA_STATUS_RESOLVING_PATHS</code>
| style="text-align:center;" | 221
| Constructing the full path string of each file processes and storing that in the database.
|-
| <code>MEDIA_STATUS_PROCESSING_ALERTS</code>
| style="text-align:center;" | 223
| Generating any alerts from data in the media.
|-
| <code>MEDIA_STATUS_FINISHING</code>
| style="text-align:center;" | 225
| Performing housekeeping chores such as saving load statistics.
|-
| <code>MEDIA_STATUS_LOADED</code>
| style="text-align:center;" | 230
| The media has been loaded.
|-
| <code>MEDIA_STATUS_EXPIRED</code>
| style="text-align:center;" | 240
| The expiration date of the media has been reached.
|-
| <code>MEDIA_STATUS_PURGING</code>
| style="text-align:center;" | 245
| The media is in the process of being deleted due to expiration date.
|-
| <code>MEDIA_STATUS_PURGED</code>
| style="text-align:center;" | 249
| The media was deleted because the expiration date had been passed.
|}

Media Types

2020-05-18T20:30:44Z

Admin: Created page with "When Truxton stores media, you can assign a type of media to it. This allows the analyst to get more of a clue as to what they are looking at. This is stored in the <code>[Med..."

When Truxton stores media, you can assign a type of media to it.
This allows the analyst to get more of a clue as to what they are looking at.
This is stored in the <code>[MediaTypeID]</code> column of the <code>[Media]</code> table in the database.
The <code>[MediaType]</code> reference table in the database also contains this information.

{| class="wikitable"
! Name
! Value
! Meaning
|-
| <code>MEDIA_TYPE_UNKNOWN</code>
| style="text-align:center;" | 0
| We don't know what type of media this is.
|-
| <code>MEDIA_TYPE_LOGICAL_FILES</code>
| style="text-align:center;" | 1
| A folder on the loader machine.
|-
| <code>MEDIA_TYPE_PHYSICAL_HARD_DISK</code>
| style="text-align:center;" | 2
| The media is a physical hard drive connected, hopefully through a write-blocker, to the loader machine processed as a bag of sectors.
|-
| <code>MEDIA_TYPE_HARD_DISK_IMAGE</code>
| style="text-align:center;" | 3
| A forensic copy of a hard disk in a file.
|-
| <code>MEDIA_TYPE_HARD_DISK_FOLDER</code>
| style="text-align:center;" | 4
| A hard drive as a folder. Mounting a hard disk image is an example. Truxton relied on the host operating system to interpret the file system on the media.
|-
| <code>MEDIA_TYPE_PHYSICAL_CD</code>
| style="text-align:center;" | 5
| A compact disc attached to the loader machine processed as a bag of sectors.
|-
| <code>MEDIA_TYPE_CD_IMAGE</code>
| style="text-align:center;" | 6
| A forensic copy of a compact disc in a file.
|-
| <code>MEDIA_TYPE_CD_FOLDER</code>
| style="text-align:center;" | 7
| A compact disc mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
|-
| <code>MEDIA_TYPE_PHYSICAL_DVD</code>
| style="text-align:center;" | 8
| A DVD attached to the loader machine processed as a bag of sectors.
|-
| <code>MEDIA_TYPE_DVD_IMAGE</code>
| style="text-align:center;" | 9
| A forensic copy of a DVD in a file.
|-
| <code>MEDIA_TYPE_DVD_FOLDER</code>
| style="text-align:center;" | 10
| A DVD mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
|-
| <code>MEDIA_TYPE_PHYSICAL_BLURAY</code>
| style="text-align:center;" | 11
| A BluRay attached to the loader machine processed as a bag of sectors.
|-
| <code>MEDIA_TYPE_BLURAY_IMAGE</code>
| style="text-align:center;" | 12
| A forensic copy of a BluRay disc in a file.
|-
| <code>MEDIA_TYPE_BLURAY_FOLDER</code>
| style="text-align:center;" | 13
| A folder on a BluRay physically attached to the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
|-
| <code>MEDIA_TYPE_PHYSICAL_THUMB_DRIVE</code>
| style="text-align:center;" | 14
| A thumb drive attached to the loader machine processed as a bag of sectors.
|-
| <code>MEDIA_TYPE_THUMB_DRIVE_IMAGE</code>
| style="text-align:center;" | 15
| A forensic copy of a thumb drive in a file.
|-
| <code>MEDIA_TYPE_THUMB_DRIVE_FOLDER</code>
| style="text-align:center;" | 16
| A thumb drive mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
|-
| <code>MEDIA_TYPE_PHYSICAL_SIM_CARD</code>
| style="text-align:center;" | 17
| A SIM card attached to the loader machine.
|-
| <code>MEDIA_TYPE_SIM_CARD_IMAGE</code>
| style="text-align:center;" | 18
| A forensic copy of a SIM card in a file.
|-
| <code>MEDIA_TYPE_SIM_CARD_FOLDER</code>
| style="text-align:center;" | 19
| A SIM card mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
|-
| <code>MEDIA_TYPE_PHYSICAL_SD_CARD</code>
| style="text-align:center;" | 20
| An SD card attached to the loader machine.
|-
| <code>MEDIA_TYPE_SD_CARD_IMAGE</code>
| style="text-align:center;" | 21
| A forensic copy of an SD card in a file.
|-
| <code>MEDIA_TYPE_SD_CARD_FOLDER</code>
| style="text-align:center;" | 22
| An SD card mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
|-
| <code>MEDIA_TYPE_RAM</code>
| style="text-align:center;" | 23
| A dump of memory.
|-
| <code>MEDIA_TYPE_FLOPPY_DISK_IMAGE</code>
| style="text-align:center;" | 24
| A forensic copy of a [https://en.wikipedia.org/wiki/Floppy_disk floppy diskette].
|-
| <code>MEDIA_TYPE_FLASH</code>
| style="text-align:center;" | 25
| A dump of flash memory chips.
|-
| <code>MEDIA_TYPE_GPS</code>
| style="text-align:center;" | 26
| A dump of a GPS device.
|-
| <code>MEDIA_TYPE_TAR</code>
| style="text-align:center;" | 27
| A [https://en.wikipedia.org/wiki/Tar_(computing) TAR] file.
|-
| <code>MEDIA_TYPE_RAR</code>
| style="text-align:center;" | 28
| A [https://en.wikipedia.org/wiki/RAR_(file_format) RAR] file.
|-
| <code>MEDIA_TYPE_ZIP</code>
| style="text-align:center;" | 29
| A [https://en.wikipedia.org/wiki/Zip_(file_format) ZIP] file.
|-
| <code>MEDIA_TYPE_FORENSIC_DATA</code>
| style="text-align:center;" | 30
| Data pulled from evidence by forensic technicians.
|-
| <code>MEDIA_TYPE_ASSOCIATED_DATA</code>
| style="text-align:center;" | 31
| Data relevant to the case but doesn't come from seized media such as photos of the media, crime scene, etc.
|-
| <code>MEDIA_TYPE_PHONE</code>
| style="text-align:center;" | 32
| A dump of a phone.
|-
| <code>MEDIA_TYPE_TABLET</code>
| style="text-align:center;" | 33
| A dump of a tablet.
|-
| <code>MEDIA_TYPE_PHYSICAL_ITEMS</code>
| style="text-align:center;" | 34
| Non-digital evidence collected from the crime scene such as pieces of paper, writing on a wall, etc.
|-
| <code>MEDIA_TYPE_ABORT_LOAD</code>
| style="text-align:center;" | 32749
| A request has been made to abort any loading of this media.
|}

Origin

2020-05-18T20:30:25Z

Admin: Created page with "When Truxton stores files, it will tell you where the file came from. This is stored in the [Origin] column of the [File] table in the database. {| class="wikitable" ! Name !..."

When Truxton stores files, it will tell you where the file came from.
This is stored in the [Origin] column of the [File] table in the database.

{| class="wikitable"
! Name
! Value
! Meaning
|-
| <code>ORIGIN_UNKNOWN</code>
| style="text-align:center;" | 0
| We don't know where this file came from.
|-
| <code>ORIGIN_NORMAL</code>
| style="text-align:center;" | 1
| The file came from the media as an overt file. It was a normal entry in the media's filesystem.
|-
| <code>ORIGIN_UNDELETED</code>
| style="text-align:center;" | 2
| The file is the result of un-deleting it from the source filesystem.
|-
| <code>ORIGIN_CARVED</code>
| style="text-align:center;" | 3
| The file is the result of searching a byte stream for a file format (carving).
|-
| <code>ORIGIN_EXPANDED</code>
| style="text-align:center;" | 4
| The file came out of another file in Truxton. Child files of a [[Type_ZIP|Zip archive]] are <code>ORIGIN_EXPANDED</code>
|-
| <code>ORIGIN_ASSOCIATED</code>
| style="text-align:center;" | 5
| The file was uploaded to Truxton by a user and associated with media.
|-
| <code>ORIGIN_GENERATED</code>
| style="text-align:center;" | 6
| Truxton generated this file during exploitation. [[Type_Media_Snippet|Snippet]] files are an example.
|-
| <code>ORIGIN_EMAIL_BODY</code>
| style="text-align:center;" | 7
| The file is the body of an email parsed by Truxton.
|-
| <code>ORIGIN_EMAIL_ATTACHMENT</code>
| style="text-align:center;" | 8
| The file is an attachment to an email parsed by Truxton.
|-
| <code>ORIGIN_VOLUME_SHADOW_COPY</code>
| style="text-align:center;" | 9
| The file came from a [https://en.wikipedia.org/wiki/Shadow_Copy Volume Shadow] in [https://en.wikipedia.org/wiki/NTFS NTFS].
|-
| <code>ORIGIN_MMS_ATTACHMENT</code>
| style="text-align:center;" | 10
| The file is the payload of an [https://en.wikipedia.org/wiki/Multimedia_Messaging_Service MMS] message.
|-
| <code>ORIGIN_STITCHED</code>
| style="text-align:center;" | 11
| The file was stitched back together from fragments scattered throughout the media free space. It is a de-fragmented carved file.
|-
| <code>ORIGIN_SLACK</code>
| style="text-align:center;" | 12
| The file came from the slack space of a normal file in the filesystem of the media.
|}

Entity Types

2020-05-18T20:30:08Z

Admin: Created page with "This is an enumeration of the interesting tidbits of analytic value. {| class="wikitable" ! Name ! Value ! Meaning |- | <code>ENTITY_TYPE_UNKNOWN</code> | style="text-align:c..."

This is an enumeration of the interesting tidbits of analytic value.

{| class="wikitable"
! Name
! Value
! Meaning
|-
| <code>ENTITY_TYPE_UNKNOWN</code>
| style="text-align:center;" | 0
| The type of entity is not known.
|-
| <code>ENTITY_TYPE_ACCOUNT</code>
| style="text-align:center;" | 1
| Any form of account identifier.
|-
| <code>ENTITY_TYPE_CREDIT_CARD_NUMBER</code>
| style="text-align:center;" | 2
| A credit card number.
|-
| <code>ENTITY_TYPE_EMAIL_ADDRESS</code>
| style="text-align:center;" | 3
| An Email Address.
|-
| <code>ENTITY_TYPE_MAC_ADDRESS</code>
| style="text-align:center;" | 4
| A 40-bit [https://en.wikipedia.org/wiki/MAC_address MAC address] of a network card.
|-
| <code>ENTITY_TYPE_PERSON</code>
| style="text-align:center;" | 5
| The name of a person.
|-
| <code>ENTITY_TYPE_PHONE_NUMBER</code>
| style="text-align:center;" | 6
| A phone number.
|-
| <code>ENTITY_TYPE_SEARCH_TERM</code>
| style="text-align:center;" | 7
| Something the user searched for.
|-
| <code>ENTITY_TYPE_TRACKING_NUMBER</code>
| style="text-align:center;" | 8
| A package tracking number.
|-
| <code>ENTITY_TYPE_SERIAL_NUMBER</code>
| style="text-align:center;" | 9
| A serial number.
|-
| <code>ENTITY_TYPE_IMEI</code>
| style="text-align:center;" | 10
| [https://en.wikipedia.org/wiki/International_Mobile_Equipment_Identity International Mobile Equipment Identity.]
|-
| <code>ENTITY_TYPE_IMSI</code>
| style="text-align:center;" | 11
| [https://en.wikipedia.org/wiki/International_mobile_subscriber_identity International Mobile Subscriber Identity.]
|-
| <code>ENTITY_TYPE_TMSI</code>
| style="text-align:center;" | 12
| [https://en.wikipedia.org/wiki/Mobility_management#TMSI Temporary Mobile Subscriber Identity.]
|-
| <code>ENTITY_TYPE_ICCID</code>
| style="text-align:center;" | 13
| [https://en.wikipedia.org/wiki/SIM_card#ICCID Integrated Circuit Card ID or SIM card serial number.]
|-
| <code>ENTITY_TYPE_SPOOLED_DOCUMENT_TITLE</code>
| style="text-align:center;" | 14
| Spooled Document Title.
|-
| <code>ENTITY_TYPE_YOUTUBE_VIDEO_ID</code>
| style="text-align:center;" | 15
| YouTube Video ID.
|-
| <code>ENTITY_TYPE_FACEBOOK_ACCOUNT_NUMBER</code>
| style="text-align:center;" | 16
| Facebook Account Number.
|-
| <code>ENTITY_TYPE_AIRLINE_RESERVATION</code>
| style="text-align:center;" | 17
| Airline Reservation.
|-
| <code>ENTITY_TYPE_DELL_SERVICE_TAG</code>
| style="text-align:center;" | 18
| A Dell Computer Service Tag.
|-
| <code>ENTITY_TYPE_APPLE_UDID</code>
| style="text-align:center;" | 19
| An Apple [https://en.wikipedia.org/wiki/UDID Unique Device ID.]
|-
| <code>ENTITY_TYPE_FILE_PATH</code>
| style="text-align:center;" | 20
| A file path.
|-
| <code>ENTITY_TYPE_VOLUME_SERIAL_NUMBER</code>
| style="text-align:center;" | 21
| A serial number assigned to a logical volume by the operating system.
|-
| <code>ENTITY_TYPE_VOLUME_NAME</code>
| style="text-align:center;" | 22
| The name of a volume in a file system.
|-
| <code>ENTITY_TYPE_MACHINE_NAME</code>
| style="text-align:center;" | 23
| The name of a computer or device.
|-
| <code>ENTITY_TYPE_ANDROID_ADVERTISING_ID</code>
| style="text-align:center;" | 24
| The identifier assigned to Android devices for [http://www.androiddocs.com/google/play-services/id.html advertising.]
|-
| <code>ENTITY_TYPE_SSID</code>
| style="text-align:center;" | 25
| The WiFi [https://en.wikipedia.org/wiki/Service_set_(802.11_network)#Service_set_identifier_(SSID) Service Set ID] or network name.
|-
| <code>ENTITY_TYPE_PASSWORD</code>
| style="text-align:center;" | 26
| A password.
|-
| <code>ENTITY_TYPE_USB_DEVICE</code>
| style="text-align:center;" | 27
| A USB device.
|-
| <code>ENTITY_TYPE_SHARE_NAME</code>
| style="text-align:center;" | 28
| A windows file share name.
|-
| <code>ENTITY_TYPE_LIMEWIRE_CLIENT_ID</code>
| style="text-align:center;" | 29
| A LimeWire Client Identifier.
|-
| <code>ENTITY_TYPE_PRODUCT_KEY</code>
| style="text-align:center;" | 30
| A Windows product license key.
|-
| <code>ENTITY_TYPE_GOOGLE_PLUS_ID</code>
| style="text-align:center;" | 31
| A Google Plus Profile ID.
|-
| <code>ENTITY_TYPE_DISNEY_GUEST_ID</code>
| style="text-align:center;" | 32
| An identifier of a guest at Disney.
|-
| <code>ENTITY_TYPE_MACHINE_GUID</code>
| style="text-align:center;" | 33
| A [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] assigned to a machine by Microsoft.
|-
| <code>ENTITY_TYPE_STEAM_ACCOUNT_ID</code>
| style="text-align:center;" | 34
| A Steam game network account identifier.
|-
| <code>ENTITY_TYPE_STEAM_PERSONA</code>
| style="text-align:center;" | 35
| A persona on the Steam game network.
|-
| <code>ENTITY_TYPE_STEAM_NAME</code>
| style="text-align:center;" | 36
| A name used in a Steam game.
|-
| <code>ENTITY_TYPE_TOR_HIDDEN_SERVICE</code>
| style="text-align:center;" | 37
| An identifier of a [https://en.wikipedia.org/wiki/Tor_(anonymity_network)#Onion_services Tor Hidden Service.]
|-
| <code>ENTITY_TYPE_NT_PASSWORD_HASH</code>
| style="text-align:center;" | 38
| A [https://en.wikipedia.org/wiki/NT_LAN_Manager hash] of a Windows NT logon password.
|-
| <code>ENTITY_TYPE_AUTHOR</code>
| style="text-align:center;" | 39
| The author of a document.
|-
| <code>ENTITY_TYPE_OGG_SERIAL_NUMBER</code>
| style="text-align:center;" | 40
| The data stream serial number in an [https://en.wikipedia.org/wiki/Ogg#File_format Ogg] multimedia file.
|-
| <code>ENTITY_TYPE_CRYPTO_KEY_ID</code>
| style="text-align:center;" | 41
| The identifier of a cryptographic key.
|-
| <code>ENTITY_TYPE_WHATSAPP_ACCOUNT_NUMBER</code>
| style="text-align:center;" | 42
| The account number of a WhatsApp user.
|-
| <code>ENTITY_TYPE_BITLOCKER_RECOVERY_KEY</code>
| style="text-align:center;" | 43
| A recovery key for a BitLocker encrypted volume.
|-
| <code>ENTITY_TYPE_SNAPCHAT_ACCOUNT_ID</code>
| style="text-align:center;" | 44
| A Snapchat account identifier.
|-
| <code>ENTITY_TYPE_TWITTER_ACCOUNT_ID</code>
| style="text-align:center;" | 45
| A Twitter account identifier.
|-
| <code>ENTITY_TYPE_APPLE_AUTHENTICATION_ID</code>
| style="text-align:center;" | 46
| An Apple authentication identifier.
|-
| <code>ENTITY_TYPE_KIK_ACCOUNT_ID</code>
| style="text-align:center;" | 47
| A Kik Account identifier.
|-
| <code>ENTITY_TYPE_VIBER_ID</code>
| style="text-align:center;" | 48
| A Viber identifier.
|-
| <code>ENTITY_TYPE_VIBER_MEMBER_ID</code>
| style="text-align:center;" | 49
| A Viber Member identifier.
|-
| <code>ENTITY_TYPE_DISK_SIGNATURE</code>
| style="text-align:center;" | 50
| A 32-bit Master Boot Record [https://en.wikipedia.org/wiki/Master_boot_record#Sector_layout identifier] at offset 440 of the sector.
|}

DATA TYPE

2020-05-18T20:29:47Z

Admin:

This is an enumeration of the different ways of storing data in a byte stream.

{| class="wikitable"
! Name
! Value
! Meaning
|-
| <code>DATA_TYPE_UNKNOWN</code>
| style="text-align:center;" | 0
| The format of the data is not known
|-
| <code>DATA_TYPE_int8_t</code>
| style="text-align:center;" | 1
| A signed byte.
|-
| <code>DATA_TYPE_uint8_t</code>
| style="text-align:center;" | 2
| An unsigned byte.
|-
| <code>DATA_TYPE_ASCII</code>
| style="text-align:center;" | 3
| An [https://en.wikipedia.org/wiki/ASCII ASCII] character.
|-
| <code>DATA_TYPE_wchar_t</code>
| style="text-align:center;" | 4
| A sixteen bit [https://home.unicode.org/ Unicode] character in [https://en.wikipedia.org/wiki/Universal_Coded_Character_Set UCS-2] encoding. AKA "wide character"
|-
| <code>DATA_TYPE_GUID</code>
| style="text-align:center;" | 5
| A 128-bit (16 byte) [https://en.wikipedia.org/wiki/Universally_unique_identifier globally unique identifier].
|-
| <code>DATA_TYPE_ASCII_GUID</code>
| style="text-align:center;" | 6
| A 128-bit [https://en.wikipedia.org/wiki/Universally_unique_identifier globally unique identifier] in [https://en.wikipedia.org/wiki/ASCII ASCII] format.
|-
| <code>DATA_TYPE_wchar_t_GUID</code>
| style="text-align:center;" | 7
| A 128-bit [https://en.wikipedia.org/wiki/Universally_unique_identifier globally unique identifier] in wide character format.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_int16_t</code>
| style="text-align:center;" | 10
| A signed sixteen bit (two byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_uint16_t</code>
| style="text-align:center;" | 11
| An unsigned sixteen bit (two byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_int24_t</code>
| style="text-align:center;" | 12
| A signed twenty-four bit (three byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_uint24_t</code>
| style="text-align:center;" | 13
| An unsigned twenty-four bit (three byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_int32_t</code>
| style="text-align:center;" | 14
| A signed thirty-two bit (four byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_uint32_t</code>
| style="text-align:center;" | 15
| An unsigned thirty-two bit (four byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_int48_t</code>
| style="text-align:center;" | 16
| A signed forty-eight bit (six byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_uint48_t</code>
| style="text-align:center;" | 17
| An unsigned forty-eight bit (six byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_int64_t</code>
| style="text-align:center;" | 18
| A signed sixty-four bit (eight byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_uint64_t</code>
| style="text-align:center;" | 19
| An unsigned sixty-four bit (eight byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_DATA_FIELD</code>
| style="text-align:center;" | 20
| An arbitrary length integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_int16_t</code>
| style="text-align:center;" | 30
| A signed sixteen bit (two byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_uint16_t</code>
| style="text-align:center;" | 31
| An unsigned sixteen bit (two byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_int24_t</code>
| style="text-align:center;" | 32
| A signed twenty-four bit (three byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_uint24_t</code>
| style="text-align:center;" | 33
| An unsigned twenty-four bit (three byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_int32_t</code>
| style="text-align:center;" | 34
| A signed thirty-two bit (four byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_uint32_t</code>
| style="text-align:center;" | 35
| An unsigned thirty-two bit (four byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_int48_t</code>
| style="text-align:center;" | 36
| A signed forty-eight bit (six byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_uint48_t</code>
| style="text-align:center;" | 37
| An unsigned forty-eight bit (six byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_int64_t</code>
| style="text-align:center;" | 38
| A signed sixty-four bit (eight byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_uint64_t</code>
| style="text-align:center;" | 39
| An unsigned sixty-four bit (eight byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_Encoded_Integer</code>
| style="text-align:center;" | 40
| An arbitrary length encoded integer.
|-
| <code>DATA_TYPE_Double</code>
| style="text-align:center;" | 50
| A floating point number.
|-
| <code>DATA_TYPE_UCS4</code>
| style="text-align:center;" | 51
| A thirty-two bit (four byte) [https://home.unicode.org/ Unicode] character in [https://en.wikipedia.org/wiki/UTF-32#History UCS-4] encoding.
|}

DATA TYPE

2020-05-18T20:29:15Z

Admin: Created page with " Editing DATA TYPE Jump to navigation Jump to search This is an enumeration of the different ways of storing data in a byte stream. {| class="wikitable" ! Name ! Value ! Mean..."

Editing DATA TYPE
Jump to navigation
Jump to search
This is an enumeration of the different ways of storing data in a byte stream.

{| class="wikitable"
! Name
! Value
! Meaning
|-
| <code>DATA_TYPE_UNKNOWN</code>
| style="text-align:center;" | 0
| The format of the data is not known
|-
| <code>DATA_TYPE_int8_t</code>
| style="text-align:center;" | 1
| A signed byte.
|-
| <code>DATA_TYPE_uint8_t</code>
| style="text-align:center;" | 2
| An unsigned byte.
|-
| <code>DATA_TYPE_ASCII</code>
| style="text-align:center;" | 3
| An [https://en.wikipedia.org/wiki/ASCII ASCII] character.
|-
| <code>DATA_TYPE_wchar_t</code>
| style="text-align:center;" | 4
| A sixteen bit [https://home.unicode.org/ Unicode] character in [https://en.wikipedia.org/wiki/Universal_Coded_Character_Set UCS-2] encoding. AKA "wide character"
|-
| <code>DATA_TYPE_GUID</code>
| style="text-align:center;" | 5
| A 128-bit (16 byte) [https://en.wikipedia.org/wiki/Universally_unique_identifier globally unique identifier].
|-
| <code>DATA_TYPE_ASCII_GUID</code>
| style="text-align:center;" | 6
| A 128-bit [https://en.wikipedia.org/wiki/Universally_unique_identifier globally unique identifier] in [https://en.wikipedia.org/wiki/ASCII ASCII] format.
|-
| <code>DATA_TYPE_wchar_t_GUID</code>
| style="text-align:center;" | 7
| A 128-bit [https://en.wikipedia.org/wiki/Universally_unique_identifier globally unique identifier] in wide character format.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_int16_t</code>
| style="text-align:center;" | 10
| A signed sixteen bit (two byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_uint16_t</code>
| style="text-align:center;" | 11
| An unsigned sixteen bit (two byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_int24_t</code>
| style="text-align:center;" | 12
| A signed twenty-four bit (three byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_uint24_t</code>
| style="text-align:center;" | 13
| An unsigned twenty-four bit (three byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_int32_t</code>
| style="text-align:center;" | 14
| A signed thirty-two bit (four byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_uint32_t</code>
| style="text-align:center;" | 15
| An unsigned thirty-two bit (four byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_int48_t</code>
| style="text-align:center;" | 16
| A signed forty-eight bit (six byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_uint48_t</code>
| style="text-align:center;" | 17
| An unsigned forty-eight bit (six byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_int64_t</code>
| style="text-align:center;" | 18
| A signed sixty-four bit (eight byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_uint64_t</code>
| style="text-align:center;" | 19
| An unsigned sixty-four bit (eight byte) integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_LITTLE_ENDIAN_DATA_FIELD</code>
| style="text-align:center;" | 20
| An arbitrary length integer in little [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_int16_t</code>
| style="text-align:center;" | 30
| A signed sixteen bit (two byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_uint16_t</code>
| style="text-align:center;" | 31
| An unsigned sixteen bit (two byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_int24_t</code>
| style="text-align:center;" | 32
| A signed twenty-four bit (three byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_uint24_t</code>
| style="text-align:center;" | 33
| An unsigned twenty-four bit (three byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_int32_t</code>
| style="text-align:center;" | 34
| A signed thirty-two bit (four byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_uint32_t</code>
| style="text-align:center;" | 35
| An unsigned thirty-two bit (four byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_int48_t</code>
| style="text-align:center;" | 36
| A signed forty-eight bit (six byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_uint48_t</code>
| style="text-align:center;" | 37
| An unsigned forty-eight bit (six byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_int64_t</code>
| style="text-align:center;" | 38
| A signed sixty-four bit (eight byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_BIG_ENDIAN_uint64_t</code>
| style="text-align:center;" | 39
| An unsigned sixty-four bit (eight byte) integer in big [https://en.wikipedia.org/wiki/Endianness endian] (Intel) layout.
|-
| <code>DATA_TYPE_Encoded_Integer</code>
| style="text-align:center;" | 40
| An arbitrary length encoded integer.
|-
| <code>DATA_TYPE_Double</code>
| style="text-align:center;" | 50
| A floating point number.
|-
| <code>DATA_TYPE_UCS4</code>
| style="text-align:center;" | 51
| A thirty-two bit (four byte) [https://home.unicode.org/ Unicode] character in [https://en.wikipedia.org/wiki/UTF-32#History UCS-4] encoding.
|}
Summary:
This is a minor edit
Watch this page

Please note that all contributions to Truxton may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see Truxton:Copyrights for details). Do not submit copyrighted work without permission!
Editing help (opens in new window)
Navigation menu

Sam
Talk
Preferences
Watchlist
Contributions
Log out

Page
Discussion

Read
Edit
View history
Watch

More

Search

Main page
Recent changes
Random page
Help about MediaWiki

Tools

What links here
Related changes
Special pages
Page information

Privacy policy
About Truxton
Disclaimers

Powered by MediaWiki

Content Status

2020-05-18T20:28:56Z

Admin: Created page with "When Truxton processes the contents of a file, several things can happen. These defined constants represent the states of the contents of a file in Truxton. {| class="wikitab..."

When Truxton processes the contents of a file, several things can happen.
These defined constants represent the states of the contents of a file in Truxton.

{| class="wikitable"
! Name
! Value
! Meaning
|-
| <code>CONTENT_STATUS_UNKNOWN</code>
| style="text-align:center;" | 0
| We don't know what the status of the contents is.
|-
| <code>CONTENT_STATUS_ORIGINAL</code>
| style="text-align:center;" | 1
| The contents came from the source media.
|-
| <code>CONTENT_STATUS_VALID_DATA_LENGTH</code>
| style="text-align:center;" | 2
| In [https://en.wikipedia.org/wiki/NTFS NTFS], space for a file can be allocated on the filesystem but not yet written to. The [https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntddk/ns-ntddk-_file_valid_data_length_information Valid Data Length] is the offset into the file where the last byte was written.
|-
| <code>CONTENT_STATUS_SPARSE_COLLAPSED</code>
| style="text-align:center;" | 3
| The contents are the non-spare regions of the file.
|-
| <code>CONTENT_STATUS_ELIMINATED_BY_HASH</code>
| style="text-align:center;" | 4
| The contents were eliminated because the hash of the contents was found in a [[Hash Set|hash set]].
|-
| <code>CONTENT_STATUS_COPY_ELIMINATED</code>
| style="text-align:center;" | 5
| The contents are a copy of another file and therefore not stored.
|-
| <code>CONTENT_STATUS_NOT_EXPORTED</code>
| style="text-align:center;" | 6
| When importing media from another Truxton instance, the contents were not exported by that other instance of Truxton.
|-
| <code>CONTENT_STATUS_ELIMINATED_EMPTY</code>
| style="text-align:center;" | 7
| The file had an entropy of zero. Since it contains no information, the bytes were eliminated.
|-
| <code>CONTENT_STATUS_LENGTH_NEEDS_RECALCULATING</code>
| style="text-align:center;" | 99
| This value is used during carving to calculate file lengths that span freespace regions.
|}

Watch Desktop Logs

2020-05-18T20:28:27Z

Admin: Created page with "If you want to see what the desktop is logging as it runs, start Powershell, then: <syntaxhighlight lang="powershell"> Get-Content "$env:LOCALAPPDATA\probity\truxton\TruxtonCl..."

If you want to see what the desktop is logging as it runs, start Powershell, then:
<syntaxhighlight lang="powershell">
Get-Content "$env:LOCALAPPDATA\probity\truxton\TruxtonClient.log" -Tail 10 -wait
</syntaxhighlight>

Configuration System

2020-05-18T20:27:55Z

Admin: Created page with "=Description= The way to communicate settings to Truxton is through a class called <code>Options</code>. This is an interpretation of the Ye Olde "Command Line Options" of wh..."

=Description=

The way to communicate settings to Truxton is through a class called <code>Options</code>.
This is an interpretation of the Ye Olde "Command Line Options" of which much has been written.
In Truxton, an option is prefaced by a name followed by the value.
There is only one value per option.
In this article, we may refer to an option as a parameter or setting.

=Sources=
The following are the nine different places that a parameter can come from. The lower the number, the greater the precedence that option has. The harder it is for a user to define an option, the greater weight that option will be given. It is harder for a user to specify an option on a command line because they must type it out. The user exerts no effort whatsoever to use a default value compiled into programs. Therefore, the command line option will be used instead of the compiled default.

# Command Line Parameters
# Command Line Configuration File
# Command Line Database
# Environment Variable
# ETL Configuration File
# ETL Machine File
# Database by Machine
# Truxton Settings File
# Compiled Defaults

==Command Line Parameters==
If a human takes the time to physically type parameters on a command line, they must really mean that they want this value to be used. Anything specified on a command line takes precedence over any other location. The format of command line parameters is parameter name followed by a space and the parameter value.

<syntaxhighlight lang="bat">
load.exe -w 1 --xx abc /z "3 4 and 5" disk.dat
</syntaxhighlight>

In the example above there are three options specified and one non-option.

{| class="wikitable"
|-
! Option Name
! Option Value
|-
| w
| 1
|-
| xx
| abc
|-
| z
| 3 4 and 5
|}

The non-option is "disk.dat" A command line is the only way to specify a non-option.

Option names can be prefaced with a single dash, double dash or a slash depending on your command line religion.

==Command Line Configuration File==
You can put the name of a configuration file on the command line.

<syntaxhighlight lang="bat">
Identify.exe my_settings.xml
</syntaxhighlight>

The <code>my_settings.xml</code> would be assumed to be a file name since it was not part of an option.
That file would then be opened, parsed as [https://en.wikipedia.org/wiki/XML XML] and anything found in the first <code>truxton_options</code> section would be used as configuration options.
All XML element names used in Truxton are lower case.

The settings would look like this:
<syntaxhighlight lang="xml">
<truxton_options>
<w>1</w>
<xx>abc</xx>
<z>3 4 and 5</z>
</truxton_options>
</syntaxhighlight>

==Command Line Database==
If you specify a settings identifier on the command line, Truxton will retrieve that setting from the database and use it.
The [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] you specify should match the <code>ID</code> column of the <code>Setting</code> table.
If a record is found, it will then parse the XML contents of the <code>Value</code> column.

<syntaxhighlight lang="bat">
Identify.exe 51256fb4-c7f6-327a-2703-325e219ecc2b
</syntaxhighlight>

If you actually use a random value you will have no end of mistakes.
We suggest making fake ids for settings and using those.
It will make typing it in far easier. Here's a fake setting that can be easily typed and remembered by a human.

<syntaxhighlight lang="bat">
Identify.exe 12345678-1234-1234-1234-123456789abc
</syntaxhighlight>

==Environment Variable==
Configuration options can also be set using environment variables.
These variables must have names that begin with <code>Truxton_</code>
For example:
<syntaxhighlight lang="bat">
set Truxton_w=1
set Truxton_xx=abc
set Truxton_z="3 4 and 5"
Load.exe disk.dat
</syntaxhighlight>

==ETL Configuration File==
Another location is an XML configuration file specifically for this type of ETL process.
Truxton will look for a file in the same directory as the executable with <code>config</code> as the extension.
For example, the <code>Identify.exe</code> ETL process will look for a file named <code>Identify.config</code> and parse it if found.

==ETL Machine File==
This is a configuration file with customized settings valid for the machine that runs the ETL processes.
Truxton will look for a file in the same directory as the <code>TruxtonSettings.xml</code> file named <code>TruxtonSettings.machine</code> as the extension.

Machine configuration is usually used for specifying common settings that are unique to a machine.
For example, every ETL process needs some sort of temporary directory.
Some of your ETL machines may have RAM disks, others may have hard drives with differing drive letters.
Machine configuration files allow you to customize where the temp folder is for each machine.

==Database by Machine==
Each installation of Truxton has a globally unique machine identifier.
This can be found in the <code>machineid</code> element of the <code>TruxtonSettings.XML</code> file.
Truxton will connect to the database and query the <code>Setting</code> table for a record with the machine identifier in the <code>ID</code> column.
If found, the XML in the <code>Value</code> column will be parsed for options.

==Truxton Settings File==
Each installation has a <code>TruxtonSettings.xml</code> file.
It is found in the <code>%programdata%\Truxton\Settings</code> folder which usually expands to <code>C:\ProgramData\Truxton\Settings</code>

'''NOTE:''' The <code>ProgramData</code> folder is normally hidden and won't show up in directory listings (or File Explorer).

Its primary purpose is to store the [https://en.wikipedia.org/wiki/Universally_unique_identifier globally unique identifier] for the machine which was generated during installation.
The default database connection parameters are also stored here.

As you can see, the <code>TruxtonSettings.xml</code> file has very low priority.

==Compiled Defaults==
Each ETL member can have default options built into it. If the option is not specified anywhere above, whatever was compiled into the executable will be used. This is the last resort.

=Debugging the Options=
With nine different places to get options from, how could anything go wrong? If you need help debugging why an option isn't getting the value you want, use the <code>debugoptions</code> option.

<syntaxhighlight lang="bat">
Identify.exe -debugoptions 1
</syntaxhighlight>

This will cause an installation log to be created and the options written to it.
This log file is found in the <code>Truxton\OptionsDebugging</code> directory under the <code>%programdata%</code> folder (which usually expands to <code>C:\ProgramData</code>) folder.
An installation log is the only log that can be created safely if everything else fails.
==Sample Options Log==
<pre>
Log file created by "C:\Program Files\Truxton\Loader\Identify.exe"
2019-10-16T12:31:21Z 4454-6528 : Processing "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml" as TruxtonSettings.xml(C:\ProgramData\Truxton\Settings\TruxtonSettings.xml)
2019-10-16T12:31:21Z 4454-6528 : Getting Options from Truxton Database
2019-10-16T12:31:21Z 4454-6528 : Parsing 3 command line arguments
2019-10-16T12:31:21Z 4454-6528 : Beginning to parse the command line arguments at array index 0
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] = "identify"
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] ("identify") is being added as a NotOption.
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] ("identify") was added as a NotOption number 0.
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 1 ] = "-debugoptions"
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 2 ] = "1" is the value of option "debugoptions"
2019-10-16T12:31:21Z 4454-6528 : No existing option named "debugoptions" was found, creating a new one
2019-10-16T12:31:21Z 4454-6528 : Finished parsing 3 command line arguments, there are now 1 NotOptions
2019-10-16T12:31:21Z 4454-6528 : Processing "C:\Program Files\Truxton\Loader\Identify.config" as the ETL.config file
2019-10-16T12:31:21Z 4454-6528 : Can't parse "C:\Program Files\Truxton\Loader\Identify.config" as XML
2019-10-16T12:31:21Z 4454-6528 : Processing "C:\ProgramData\Truxton\Settings\TruxtonSettings.machine" as the ETL.machine file
2019-10-16T12:31:21Z 4454-6528 : Can't parse "C:\ProgramData\Truxton\Settings\TruxtonSettings.machine" as XML
2019-10-16T12:31:21Z 4454-6528 : All Option Dump (The first entry of duplicate lines is the value that will be used by the program.)
Process "C:\Program Files\Truxton\Loader\Identify.exe"
createthedatabase : "1" from TruxtonSettings.xml XML element name truxton_options.CreateTheDatabase beginning at line 15 column 3 byte 485 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
datadir : "C:\Truxton Data" from TruxtonSettings.xml XML element name truxton_options.datadir beginning at line 13 column 3 byte 384 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbname : "Truxton" from TruxtonSettings.xml XML element name truxton_options.dbname beginning at line 5 column 3 byte 123 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbpassword : "Truxton4n6" from TruxtonSettings.xml XML element name truxton_options.dbpassword beginning at line 7 column 3 byte 180 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbport : "5432" from TruxtonSettings.xml XML element name truxton_options.dbport beginning at line 4 column 3 byte 98 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbserver : "localhost" from TruxtonSettings.xml XML element name truxton_options.dbserver beginning at line 3 column 3 byte 64 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbsr1 :
dbuser : "postgres" from TruxtonSettings.xml XML element name truxton_options.dbuser beginning at line 6 column 3 byte 151 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
debugoptions : "1" from Command Line argument 2 (zero is the first)
filegroupshavebeeninitialized : "1" from TruxtonSettings.xml XML element name truxton_options.FileGroupsHaveBeenInitialized beginning at line 17 column 3 byte 593 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
machineid : "64B30278-F250-4896-82EB-1AC416DB30B2" from TruxtonSettings.xml XML element name truxton_options.machineid beginning at line 14 column 3 byte 422 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqname : "TruxtonMessageBus" from TruxtonSettings.xml XML element name truxton_options.mqname beginning at line 10 column 3 byte 278 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqpassword : "Truxton4n6" from TruxtonSettings.xml XML element name truxton_options.mqpassword beginning at line 12 column 3 byte 345 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqport : "5432" from TruxtonSettings.xml XML element name truxton_options.mqport beginning at line 9 column 3 byte 253 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqserver : "localhost" from TruxtonSettings.xml XML element name truxton_options.mqserver beginning at line 8 column 3 byte 219 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mquser : "postgres" from TruxtonSettings.xml XML element name truxton_options.mquser beginning at line 11 column 3 byte 316 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
solr_url : "http://localhost:8983/solr/truxton-core" from TruxtonSettings.xml XML element name truxton_options.solr_url beginning at line 16 column 3 byte 529 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
writesettings :

End of Options, Start of Non-Options
"identify"

End of All Option Dump

2019-10-16T12:31:21Z 4454-6528 : Processing "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml" as TruxtonSettings.xml(C:\ProgramData\Truxton\Settings\TruxtonSettings.xml)
2019-10-16T12:31:21Z 4454-6528 : Getting Options from Truxton Database
2019-10-16T12:31:21Z 4454-6528 : Parsing 3 command line arguments
2019-10-16T12:31:21Z 4454-6528 : Beginning to parse the command line arguments at array index 0
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] = "identify"
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] ("identify") is being added as a NotOption.
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 0 ] ("identify") was added as a NotOption number 0.
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 1 ] = "-debugoptions"
2019-10-16T12:31:21Z 4454-6528 : command_line_argument[ 2 ] = "1" is the value of option "debugoptions"
2019-10-16T12:31:21Z 4454-6528 : No existing option named "debugoptions" was found, creating a new one
2019-10-16T12:31:21Z 4454-6528 : Finished parsing 3 command line arguments, there are now 1 NotOptions
2019-10-16T12:31:21Z 4454-6528 : Processing "C:\Program Files\Truxton\Loader\Identify.config" as the ETL.config file
2019-10-16T12:31:21Z 4454-6528 : Can't parse "C:\Program Files\Truxton\Loader\Identify.config" as XML
2019-10-16T12:31:21Z 4454-6528 : Processing "C:\ProgramData\Truxton\Settings\TruxtonSettings.machine" as the ETL.machine file
2019-10-16T12:31:21Z 4454-6528 : Can't parse "C:\ProgramData\Truxton\Settings\TruxtonSettings.machine" as XML
2019-10-16T12:31:21Z 4454-6528 : All Option Dump (The first entry of duplicate lines is the value that will be used by the program.)
Process "C:\Program Files\Truxton\Loader\Identify.exe"
aci : "10007" from Default definitions
alert_email_from_address : "Truxton@localhost" from Default definitions
alert_email_subject : "[Truxton Alert]" from Default definitions
carve : "1" from Default definitions
carve_threads : "1" from Default definitions
carvemode : "0" from Default definitions
carveoffset : "65536" from Default definitions
carveunknown : "0" from Default definitions
cmid : "0" from Default definitions
controlledby : "0" from Default definitions
createthedatabase : "1" from TruxtonSettings.xml XML element name truxton_options.CreateTheDatabase beginning at line 15 column 3 byte 485 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
cunk : "1" from Default definitions
cws : "10485760" from Default definitions
datadir : "C:\Truxton Data" from TruxtonSettings.xml XML element name truxton_options.datadir beginning at line 13 column 3 byte 384 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbname : "Truxton" from TruxtonSettings.xml XML element name truxton_options.dbname beginning at line 5 column 3 byte 123 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbname : "Truxton" from Default definitions
dbpassword : "Truxton4n6" from TruxtonSettings.xml XML element name truxton_options.dbpassword beginning at line 7 column 3 byte 180 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbport : "5432" from TruxtonSettings.xml XML element name truxton_options.dbport beginning at line 4 column 3 byte 98 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbport : "5432" from Default definitions
dbserver : "localhost" from TruxtonSettings.xml XML element name truxton_options.dbserver beginning at line 3 column 3 byte 64 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbserver : "127.0.0.1" from Default definitions
dbsr1 :
dbuser : "postgres" from TruxtonSettings.xml XML element name truxton_options.dbuser beginning at line 6 column 3 byte 151 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
dbuser : "postgres" from Default definitions
debugfileidmapping : "0" from Default definitions
debugoptions : "1" from Command Line argument 2 (zero is the first)
dedupemessages : "0" from Default definitions
deepsleep : "45007" from Default definitions
deletedfiles : "1" from Default definitions
depotpagesize : "4096" from Default definitions
ds : "0" from Default definitions
ee : "0" from Default definitions
excludefilesbytype : "0" from Default definitions
excludes : "0" from Default definitions
fct : "300" from Default definitions
filegroupshavebeeninitialized : "1" from TruxtonSettings.xml XML element name truxton_options.FileGroupsHaveBeenInitialized beginning at line 17 column 3 byte 593 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
fileslack : "1" from Default definitions
fqhi : "7500" from Default definitions
fqlo : "100" from Default definitions
hashsetall : "0" from Default definitions
iei : "1" from Default definitions
imagelength : "-1" from Default definitions
imageoffset : "0" from Default definitions
includefilesbytype : "0" from Default definitions
includes : "0" from Default definitions
istatus : "1" from Default definitions
itype : "0" from Default definitions
loadas : "0" from Default definitions
machineid : "64B30278-F250-4896-82EB-1AC416DB30B2" from TruxtonSettings.xml XML element name truxton_options.machineid beginning at line 14 column 3 byte 422 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
maxsleep : "600101" from Default definitions
metacarve : "1" from Default definitions
minsleep : "3011" from Default definitions
mlat : "0" from Default definitions
mlong : "0" from Default definitions
mqname : "TruxtonMessageBus" from TruxtonSettings.xml XML element name truxton_options.mqname beginning at line 10 column 3 byte 278 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqname : "TruxtonMessageBus" from Default definitions
mqpassword : "Truxton4n6" from TruxtonSettings.xml XML element name truxton_options.mqpassword beginning at line 12 column 3 byte 345 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqport : "5432" from TruxtonSettings.xml XML element name truxton_options.mqport beginning at line 9 column 3 byte 253 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqport : "0" from Default definitions
mqserver : "localhost" from TruxtonSettings.xml XML element name truxton_options.mqserver beginning at line 8 column 3 byte 219 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mqserver : "127.0.0.1" from Default definitions
mquser : "postgres" from TruxtonSettings.xml XML element name truxton_options.mquser beginning at line 11 column 3 byte 316 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
mquser : "postgres" from Default definitions
mr : "0" from Default definitions
nocontents : "0" from Default definitions
nohashsets : "0" from Default definitions
norouting : "0" from Default definitions
nostartdelay : "0" from Default definitions
nostore : "0" from Default definitions
numberofbuffers : "2048" from Default definitions
numberofbytesperbuffer : "65536" from Default definitions
numberoffiles : "9223372036854775807" from Default definitions
pfiles : "1" from Default definitions
pfree : "1" from Default definitions
priority : "1000" from Default definitions
rapid : "0" from Default definitions
recovery : "0" from Default definitions
reprocess : "0" from Default definitions
skipdupmedia : "0" from Default definitions
smtp_server : "localhost" from Default definitions
solr_url : "http://localhost:8983/solr/truxton-core" from TruxtonSettings.xml XML element name truxton_options.solr_url beginning at line 16 column 3 byte 529 of "C:\ProgramData\Truxton\Settings\TruxtonSettings.xml"
startatmft : "0" from Default definitions
syslogport : "514" from Default definitions
timeout : "120" from Default definitions
triage : "0" from Default definitions
tsk_verbose : "0" from Default definitions
updatemedianumberofchildren : "1" from Default definitions
updatepathid : "1" from Default definitions
verbose : "0" from Default definitions
wait : "none" from Default definitions
writesettings :
xorcarve : "1" from Default definitions

End of Options, Start of Non-Options
"identify"

End of All Option Dump

2019-10-16T12:31:21Z 4454-6528 : application_name='Truxton Identify' dbname='Truxton' user='postgres' password='Truxton4n6' host='localhost' port=5432
2019-10-16T12:31:21Z 4454-6528 : application_name='Truxton Identify' dbname='TruxtonMessageBus' user='postgres' password='Truxton4n6' host='localhost' port=5432
2019-10-16T12:31:21Z 4454-6528 : Truxton Identify can't get connection string variable dbserver variable "logserver"
2019-10-16T12:31:21Z 4454-6528 : application_name='Truxton Identify' dbname='Truxton' user='postgres' password='Truxton4n6' host='localhost' port=5432
</pre>

Load List

2020-05-18T20:27:07Z

Admin: Created page with "A load list is a simple text file that allows you to script the load process. These are usually used when you have many pieces of media to load on a single machine. You can li..."

A load list is a simple text file that allows you to script the load process. These are usually used when you have many pieces of media to load on a single machine. You can list the path to the media to load and Truxton will load as many of them as possible at a time until they are all loaded. You don’t have to hang around and start the next piece of media when one finishes.

It is not user friendly in that it is not self-explanatory. It was designed to be generated by scripts. The format of the file is a single letter record identifier followed by a colon followed by the parameters for that record type.

=Fields=
==Investigation==
The investigation line specifies the investigation that the following media should belong to. You may specify a globally unique identifier if you wish otherwise Truxton will generate one for you. If you want the media in this load list file to belong to an existing investigation, simply put the identifier of that investigation on this line. Once an investigation has been set, all media specified in the load list will belong to that investigation until another investigation line is present.

===Samples===
<syntaxhighlight lang="text">
I: This is My Case
</syntaxhighlight>
A new investigation will be created with the name "This is My Case" with a random identifier.
<hr />

<syntaxhighlight lang="text">
I: Case 14 2CBA17E4-038A-4828-8A0D-D221F943B3F9
</syntaxhighlight>
A new investigation will be created with the name of "Case 14" and an identifier of "2CBA17E4-038A-4828-8A0D-D221F943B3F9"
<hr />

<syntaxhighlight lang="text">
i: {2CBA17E4-038A-4828-8A0D-D221F943B3F9}
</syntaxhighlight>
The media specified in this load list file will be made part of an existing investigation with the id of "2CBA17E4-038A-4828-8A0D-D221F943B3F9."

==Number of Loaders==
The loaders line controls the number of load processes that will be used to load the media specified in the load list. This setting will remain in effect until the next loaders line or the end of file has been reached.
===Samples===
<syntaxhighlight lang="text">
L: 4
</syntaxhighlight>
This will use four load processes to get the media in this list loaded.
<hr />

<syntaxhighlight lang="text">
L: 0
</syntaxhighlight>
This will set the number of load processes equal to the number of CPUs in the loader machine.

==Configuration==
You can specify a configuration file to use. This can be used in conjunction with the path to media option. They are not exclusive.
===Samples===
<syntaxhighlight lang="text">
C: c:\Configs\Triage.xml
</syntaxhighlight>
This will cause the loaders to use configuration parameters as specified in the "c:\Configs\Triage.xml" file.

==Hash List Directory==
The hash list directory line sets the path to the folder that contains hash lists for eliminating file contents during the load.

===Samples===
<syntaxhighlight lang="text">
H: c:\Hashes
</syntaxhighlight>
This will use all hash sets found in the "C:\Hashes" folder
<hr />
<syntaxhighlight lang="text">
H: \\hashserver\files\2016
</syntaxhighlight>
This will use all hash sets found in the shared folder "\\hashserver\files\2016"

==Media==
This line contains the name and optional identifier for the media to be loaded. If no identifier is specified, one will be generated for you.
===Samples===
<syntaxhighlight lang="text">
M: Laptop Drive
</syntaxhighlight>
This will set the name of the media to "Laptop Drive." The identifier for the media will be completely random.
<hr />
<syntaxhighlight lang="text">
M: Bob's Phone 2CBA17E4-038A-4828-8A0D-D221F943B3F9
</syntaxhighlight>
This will set the name of the media to "Bob's Phone" and set the identifier to "2CBA17E4-038A-4828-8A0D-D221F943B3F9"

==Command Line Arguments==
This allows you to set any command line argument for use with this media.

===Samples===
<syntaxhighlight lang="text">
G: -loadas 514
</syntaxhighlight>
This will add the <code>loadas</code> command line argument when the load process is spawned.

==Execute Before==
This allows you to specify a PowerShell script or batch file to execute before the load process is spawned. Once the script completes, the loader is free to execute.

===Samples===
<syntaxhighlight lang="text">
A: BeforeBobLoads.ps1
</syntaxhighlight>
This script will execute before the loader process is spawned.

==Execute After==
This allows you to specify a PowerShell script or batch file to execute after the load process exits.
===Samples===
<syntaxhighlight lang="text">
Z: AfterBobLoads.cmd
</syntaxhighlight>
This script will execute once the load completes.

==Path==
This is the line that causes the load process to be spawned. This holds the path to the media to be loaded.
===Samples===
<syntaxhighlight lang="text">
P: c:\Images\WinXP.E01
</syntaxhighlight>
This will load the "WinXP.E01" file.
<hr />

<syntaxhighlight lang="text">
P: P: c:\Data\Files 1
</syntaxhighlight>
This will load the folder "Files 1"

==Complete Sample Load List==
The following load list will use one load process to exhaust the load list. Two pieces of media will be loaded as part of the [https://comicvine.gamespot.com/hong-kong-cavaliers/4060-57943/ "Hong Kong Cavaliers"] investigation. A PowerShell script will be executed before [https://www.imdb.com/title/tt0086856/characters/nm0000289 Penny Priddy's] phone is loaded. [https://www.imdb.com/title/tt0086856/characters/nm0001475 Emilio Lizardo's] hard drive will be loaded after Penny’s phone load completes. It will be loaded as a Master Boot Record ([[Type_Master_Boot_Record|file type 514]]) and [[Media Types|media type]] of Hard Drive (3).

<syntaxhighlight lang="text">
L: 1
I: Hong Kong Cavaliers

A: AddPhone.ps1
M: Penny Priddy’s Phone
P: \\ImageServer\Phones\PP.E01

M: Emilio Lizardo’s Hard Drive
G: -loadas 514 -mt 3
P: \\ImageServer\Hard Drives\EML.dd

</syntaxhighlight>

TGUID

2020-05-18T20:26:05Z

Admin: Created page with "A TGUID (Truxton GUID) is a 128-bit identifier used throughout Truxton. It can be stored and interoperate with a [https://en.wikipedia.org/wiki/Universally_unique_identifier G..."

A TGUID (Truxton GUID) is a 128-bit identifier used throughout Truxton.
It can be stored and interoperate with a [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] data type.
However, it is not a [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID].
It does not adhere to any specification at all.
It is merely the same size as a [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] but easier to debug.

=In Memory Layout=
A TGUID differs from [https://en.wikipedia.org/wiki/Universally_unique_identifier GUID] in that the string/logical value of a TGUID is the same as the series of bytes in memory.
Think of it as a 128-bit [https://en.wikipedia.org/wiki/Endianness big-endian] in RAM.
Consider the following bytes as they appear in RAM:

<code>0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF</code>

Converting those bytes to a TGUID will yield:
<code>{00112233-4455-6677-8899-AABBCCDDEEFF}</code>

Converting those same bytes to a GUID will yield:
<code>{33221100-5544-7766-8899-AABBCCDDEEFF}</code>

=Types of TGUIDs=
Truxton takes a very liberal interpretation of "globally unique identifier."
Truxton's view of a TGUID is "128 bits that I can do whatever I want with."

==File ID==
A file identifier in Truxton can be totally random but it usually generated by the loader or an ETL process.
In that case, the identifier is made up of a time, random and a counter value.
This satisfies a couple of requirements we have of file identifiers (other than being globally unique):
* Quickly Created. Generating purely random data is a lengthy process when you are generating millions of them.
* Make database partitioning possible. By having part of the identifier being a timestamp, we can partition the <code>File</code> table by algorithm.

Let's take apart a sample file identifier:

<code>5da98fe7-14e6-f663-7143-a0e80000000a</code>

{| class="wikitable"
|+ File ID Fields
!
! Field A
! Field B
! Field C
|-
! Value
| style="text-align:center;" | 5da98fe7
| style="text-align:center;" | 14e6-f663-7143-a0e8
| style="text-align:center;" | 0000000a
|-
! Type
| style="text-align:center;" | Time
| style="text-align:center;" | Random
| style="text-align:center;" | Counter
|-
! Meaning
| style="text-align:center;" | 2019-10-18T10:11:51
| style="text-align:center;" | Random
| style="text-align:center;" | ID number 10
|}

===Field A===
The first field is a [https://en.wikipedia.org/wiki/Endianness big endian] representation of a [https://en.wikipedia.org/wiki/Unix_time Unix timestamp].
<code>5da98fe7</code> is 1,571,393,511 seconds since January 1, 1970 or October 18, 2019 10:11:51 AM.
This makes it possible to construct a query to find out what was loaded on a particular date.
To see load activity on October 18, 2019:
<syntaxhighlight lang="sql">
SELECT * FROM "File" WHERE "ID" BETWEEN '5da90080-0000-0000-0000-000000000000'::uuid AND '5da9b74f-ffff-ffff-ffff-ffffffff'::uuid
</syntaxhighlight>

===Field B===
The second field is sixty four bits of random data.
This is generated using the secure random number generator function <code>[https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/rand-s?view=vs-2019 rand_s]</code> which uses the <code>[https://docs.microsoft.com/en-us/windows/win32/api/ntsecapi/nf-ntsecapi-rtlgenrandom RtlGenRandom]</code>.

===Field C===
The last field is a thirty two bit counter value.
Every time an identifier is generated, this field is incremented.
In our example, we can tell this is the tenth identifier that was generated.

==Media ID==
The media ID in Truxton is based on time.
A clock tick is six hours.
The epoch is 2016-11-01.
The rollover will happen September 18, 2061.

The first two bytes of the identifier is the number of clock ticks since 2016-11-01.
The remaining 30 bytes are random using the cryptographicaly secure random number generator in Windows.

Example:
<code>10e7b286-4f9f-3e2e-10da-07d5db37944c</code>

The time field is <code>10e7</code>

Having a Media ID that can be sorted on time allows for the partitioning of data in the database.
You can partition your data by year if you want to.

==ETL ID==
The job of an ETL ID is to identify an ETL on the network.
ETL IDs are used in status messages when reporting to [[Les]].

===Fields===
The format of an ETL ID is as follows:

SSIIRRRR-PPPP-PPTT-TTTT-AAAAAAAAAAAA

{| class="wikitable"
! Field
! Meaning
|-
| <code>SS</code>
| The stage of the ETL.
|-
| <code>II</code>
| The instance of the ETL on the machine running the process.
|-
| <code>RRRR</code>
| A random value.
|-
| <code>PPPPPP</code>
| The process ID of the ETL process.
|-
| <code>TTTTTT</code>
| The thread ID of the ETL process. A single process can host multiple ETLs.
|-
| <code>AAAAAAAAAAAA</code>
| The IP address of the machine running the ETL process.
|}

Example:
<code>03015678-0079-C400-7514-192168001014</code>

{| class="wikitable"
! Field
! Value
! Meaning
|-
| <code>SS</code>
| style="text-align:center;" | 03
| Stage 3
|-
| <code>II</code>
| style="text-align:center;" | 01
| First instance of the ETL
|-
| <code>RRRR</code>
| style="text-align:center;" | 5678
| A random value
|-
| <code>PPPPPP</code>
| style="text-align:center;" | 0079C4
| Process ID 31172
|-
| <code>TTTTTT</code>
| style="text-align:center;" | 007514
| The thread ID 29972
|-
| <code>AAAAAAAAAAAA</code>
| style="text-align:center;" | 192168001014
| The IP address is 192.168.1.14
|}

Using this information, you can attach a debugger to the machine using the IP address and debug the process using the process id and thread id.
From our example:
<syntaxhighlight lang="CMD">
C:\> mydbg /ip:192.168.1.14 /pid:31172
</syntaxhighlight>

==Customer ID==
Customer identifiers are proprietary.

=API Considerations=
Internally, Truxton uses TGUIDs.
The external API intended for use by customers, uses [https://en.wikipedia.org/wiki/Universally_unique_identifier GUIDs] as trying to explain this to them would lead to never ending confusion.
It is far better if the Truxton libraries keep TGUIDs to themselves.
Like a family secret.

Depot Types

2020-05-18T20:25:10Z

Admin: Created page with "There are several types of depot files in Truxton. {| class="wikitable" ! Name ! Value ! Meaning |- | <code>DEPOT_TYPE_UNKNOWN</code> | style="text-align:center;" | 0 | The t..."

There are several types of depot files in Truxton.

{| class="wikitable"
! Name
! Value
! Meaning
|-
| <code>DEPOT_TYPE_UNKNOWN</code>
| style="text-align:center;" | 0
| The type is not known. You should never see this.
|-
| <code>DEPOT_TYPE_FILE_CONTENTS</code>
| style="text-align:center;" | 1
| The depot contains the contents of logical files.
|-
| <code>DEPOT_TYPE_FREE_SPACE</code>
| style="text-align:center;" | 2
| The depot contains unused space from media. This is typically aligned on a 512-byte boundary.
|-
| <code>DEPOT_TYPE_THUMBNAILS</code>
| style="text-align:center;" | 3
| The depot contains thumbnail images.
|-
| <code>DEPOT_TYPE_REPORT_TEMPLATES</code>
| style="text-align:center;" | 4
| The depot contains report templates. This is deprecated.
|-
| <code>DEPOT_TYPE_OTHER</code>
| style="text-align:center;" | 5
| The depot contains some form of un-typed data.
|-
| <code>DEPOT_TYPE_SLACK</code>
| style="text-align:center;" | 6
| The depot contains the slack space of logical files.
|-
| <code>DEPOT_TYPE_NOT_DEPOT_FORMAT</code>
| style="text-align:center;" | 7
| The file is not a depot. Only seen in the database.
|}

Depot

2020-05-18T20:24:35Z

Admin: Created page with "Truxton stores file contents in large files called depots. When you store a stream of bytes in a depot, the offset of the beginning of the stream in the depot and the depot le..."

Truxton stores file contents in large files called depots.
When you store a stream of bytes in a depot, the offset of the beginning of the stream in the depot and the depot length are recorded in the database.

=General Format=
The depot file format is very simple.
The header of the file is 64KB.
The remainder of the file is streams of bytes aligned on a page boundary, 4KB by default.

==Header==

The depot file header is a 32-byte signature followed by XML padded with enough spaces to fill out the 64KB beginning region.
The signature is:

<syntaxhighlight lang="text">
This is a Truxton Depot File!!<CR><LF>
</syntaxhighlight>

===Sample===
<syntaxhighlight lang="xml">
This is a Truxton Depot File!!
<?xml version="1.0" standalone="yes"?>
<truxton>
<depot_id>5D72324E-A079-1A6A-0E80-D81600000010</depot_id>
<page_size>4096</page_size>
<createdby>C:\Program Files\Truxton\Loader\Expand.exe</createdby>
<created>2019-09-06T10:17:50.744432Z</created>
<ipaddress>172.18.92.241</ipaddress>
<version>3.1.0.902</version>
<command_line>"Expand.exe" -controlledby 9622956017505175439</command_line>
<process_id>4244</process_id>
<bios_id>4C4C4544-0046-5310-804D-B2C04F515132</bios_id>
<machine_sid_hash>F7CD1C0A-F558-41EB-8994-8DC9F83F5896</machine_sid_hash>
<bios_serial_number>2FSMCC2</bios_serial_number>
<user_name>SYSTEM</user_name>
<computer_name>DESKTOP-5NRI5PO</computer_name>
<filename>5D72324E-A079-1A6A-0E80-D81600000010_expand.file.depot</filename>
<type>1</type>
<customer>D0814FE2-7794-5E33-DDD4-B6BB588CB6D4</customer>
</truxton>
</syntaxhighlight>

===XML Fields===
We store a lot of information in the XML to aid anyone who has the unenviable task of recovering a depot file.

{| class="wikitable"
! Name
! Meaning
|-
| <code>depot_id</code>
| The identifier for this depot file. This should correspond to the <code>ID</code> column of the <code>[[Depot Table|Depot]]</code> table in the database.
|-
| <code>page_size</code>
| The boundary on which entries in the depot will be aligned. It can be altered via the <code>depotpagesize</code> setting.
|-
| <code>createdby</code>
| The full path to the executable that created this file.
|-
| <code>created</code>
| The time the depot file was created.
|-
| <code>ipaddress</code>
| The TCP/IP v4 address of the machine where the executable that created this file was running.
|-
| <code>version</code>
| The version number of the process that created this file.
|-
| <code>command_line</code>
| The contents of the command line of the process that created this file.
|-
| <code>process_id</code>
| The id of the process that created this file.
|-
| <code>bios_id</code>
| The unique id retrieved from the [https://en.wikipedia.org/wiki/BIOS BIOS] firmware.
|-
| <code>machine_sid_hash</code>
| This is the <code>MachineGuid</code> value retrieved from the registry key <code>HKLM/SOFTWARE/Microsoft/Cryptography</code>
|-
| <code>bios_serial_number</code>
| The serial number of the machine running the process that created this file as reported by the [https://en.wikipedia.org/wiki/BIOS BIOS].
|-
| <code>user_name</code>
| The name of the account the process was running under.
|-
| <code>computer_name</code>
| The name of the computer the process that created this file was running on.
|-
| <code>filename</code>
| The original name of the depot file.
|-
| <code>type</code>
| The [[Depot Types|type]] of depot file.
|-
| <code>customer</code>
| The [[TGUID#Customer_ID|identifier]] (license) of the customer that created this depot file.
|}

===BIOS Fields===
Here's where Truxton gets the [https://en.wikipedia.org/wiki/BIOS BIOS] fields.

====bios_id====
This [https://en.wikipedia.org/wiki/Universally_unique_identifier uuid] is retrieved from the [https://en.wikipedia.org/wiki/BIOS BIOS] using an [https://docs.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-getsystemfirmwaretable API] call.
Specifically, the [https://www.dmtf.org/sites/default/files/standards/documents/DSP0134_2.7.1.pdf 'RSMB'] firmware table is retrieved and the <code>UUID</code> field of the System Information (Type 1) structure is used.

It can also be retrieved via:
<syntaxhighlight lang="bat">
wmic path Win32_ComputerSystemProduct get UUID
</syntaxhighlight>

====bios_serial_number====
This string is retrieved from the [https://en.wikipedia.org/wiki/BIOS BIOS] using an [https://docs.microsoft.com/en-us/windows/win32/api/sysinfoapi/nf-sysinfoapi-getsystemfirmwaretable API] call.
Specifically, the [https://www.dmtf.org/sites/default/files/standards/documents/DSP0134_2.7.1.pdf 'RSMB'] firmware table is retrieved and the <code>SerialNumber</code> field of the System Information (Type 1) structure is used.

Dell will store their service tags in this field.

==Data Alignment==
While data is normally aligned on a 4KB boundary, it can be modified by the <code>depotpagesize</code> setting which can be put into <code>TruxtonSettings.xml</code>

A special case of alignment is free space depots.
They are aligned on a 512 byte boundary as this most closely matches hard drive sectors.
If we were to align on 4KB or 8KB boundaries, carving would be nearly impossible.

Developer's Guide

2020-05-18T20:24:04Z

Admin: /* Truxton Stuff */

Type Icing MMS SMS

2020-05-18T20:22:30Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Icing_MMS_SMS</code> |- | File Type Value | 975 |- | Parent Type | Type_SQLite_Datab..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_Icing_MMS_SMS</code>
|-
| File Type Value
| 975
|-
| Parent Type
| [[Type_SQLite_Database|SQLite]]
|-
| Carve
| Yes
|-
| Format Details
| Yes
|-
| MIME Type
| <code>application/x-sqlite3</code>
|-
| Filename Extension
| <code>db</code>
|}

Icing MMS SMS

=Description=
Android Icing MMS data

=Details=

We have seen several versions of this database.

=Queries=
Here's the queries Truxton uses to exploit the Icing MMS/SMS databases.

==SMS==
Sometimes the <code>[sms]</code> table doesn't exist in the database.

<syntaxhighlight lang="sql">
SELECT [address],[date],[body],[type] FROM [sms]
</syntaxhighlight>

Other times you must pull the SMS messages from the <code>[mmssms]</code> table.
We do this when the <code>[mmssms]</code> tables does not contain a column named <code>[attachment_data]</code>.

<syntaxhighlight lang="sql">
SELECT [_id],[msg_type],[address],[date],[body] FROM [mmssms] WHERE [msg_type] = 'sms'
</syntaxhighlight>

Or

<syntaxhighlight lang="sql">
SELECT [address],[date],[date_sent],[body],[attachment_data],[_id] FROM [mmssms]
</syntaxhighlight>

Type Cygwin Symlink

2020-05-18T20:21:57Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Cygwin_Symlink</code> |- | File Type Value | 976 |- | Parent Type | None |- | Carve |..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_Cygwin_Symlink</code>
|-
| File Type Value
| 976
|-
| Parent Type
| None
|-
| Carve
| Yes
|-
| Format Details
| No
|-
| MIME Type
| <code>application/octet-stream</code>
|-
| Filename Extension
| <code>dat</code>
|}

Cygwin Symlink

=Description=
Cygwin Symbolic Link

=Details=

* [https://stackoverflow.com/questions/18654162/enable-native-ntfs-symbolic-links-for-cygwin symlink]

Type MPEG4Video With DRM

2020-05-18T20:21:31Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_MPEG4Video_With_DRM</code> |- | File Type Value | 978 |- | Parent Type | Type_MPEG4V..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_MPEG4Video_With_DRM</code>
|-
| File Type Value
| 978
|-
| Parent Type
| [[Type_MPEG4Video|MP4]]
|-
| Carve
| Yes
|-
| Format Details
| Yes
|-
| MIME Type
| <code>video/mp4</code>
|-
| Filename Extension
| <code>mp4</code>
|}

MPEG 4 Video with DRM

=Description=
MPEG 4 Video protected with DRM

=Details=

* [http://www.ftyps.com/ ftyps]

Type HEIF

2020-05-18T20:21:17Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_HEIF</code> |- | File Type Value | 977 |- | Parent Type | MP4 |- |..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_HEIF</code>
|-
| File Type Value
| 977
|-
| Parent Type
| [[Type_MPEG4Video|MP4]]
|-
| Carve
| Yes
|-
| Format Details
| Yes
|-
| MIME Type
| <code>image/heif</code>
|-
| Filename Extension
| <code>heif</code>
|}

HEIF

=Description=
High Efficiency Image File

=Details=

* [https://en.wikipedia.org/wiki/High_Efficiency_Image_File_Format Wikipedia]

Type XMP

2020-05-18T20:19:58Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_XMP</code> |- | File Type Value | 551 |- | Parent Type | XML |- | Carve |..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_XMP</code>
|-
| File Type Value
| 551
|-
| Parent Type
| [[Type_XML|XML]]
|-
| Carve
| Yes
|-
| Format Details
| No
|-
| MIME Type
| <code>text/xml</code>
|-
| Filename Extension
| <code>xmp</code>
|}

XMP

=Description=
Extensible Metadata Platform

=Details=
* [https://en.wikipedia.org/wiki/Extensible_Metadata_Platform XMP]

Type Base64 Encoded Data

2020-05-18T20:19:44Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Base64_Encoded_Data</code> |- | File Type Value | 550 |- | Parent Type | Type_ASCII_..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_Base64_Encoded_Data</code>
|-
| File Type Value
| 550
|-
| Parent Type
| [[Type_ASCII_Text|ASCII Text]]
|-
| Carve
| No
|-
| Format Details
| No
|-
| MIME Type
| <code>application/octet-stream</code>
|-
| Filename Extension
| <code>b64</code>
|}

Base64 Encoded Data

=Description=
Base 64 encoded data

=Details=

Type UUEncoded Data

2020-05-18T20:19:26Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_UUEncoded_Data</code> |- | File Type Value | 549 |- | Parent Type | Type_ASCII_Text|..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_UUEncoded_Data</code>
|-
| File Type Value
| 549
|-
| Parent Type
| [[Type_ASCII_Text|ASCII Text]]
|-
| Carve
| No
|-
| Format Details
| No
|-
| MIME Type
| <code>application/octet-stream</code>
|-
| Filename Extension
| <code>uue</code>
|}

UUEncoded Data

=Description=
Unix-to-Unix encoded data

=Details=

Type Credential History

2020-05-18T20:19:11Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Credential_History</code> |- | File Type Value | 548 |- | Parent Type | None |- | Carv..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_Credential_History</code>
|-
| File Type Value
| 548
|-
| Parent Type
| None
|-
| Carve
| Yes
|-
| Format Details
| No
|-
| MIME Type
| <code>application/octet-stream</code>
|-
| Filename Extension
| <code>bin</code>
|}

CREDHIST

=Description=
Windows DPAPI Credential History

=Details=
* [http://www.passcape.com/windows_password_recovery_dpapi_credhist CREDHIST]

Type ipconfig Report

2020-05-18T20:18:57Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_ipconfig_Report</code> |- | File Type Value | 547 |- | Parent Type | Type_ASCII_Text..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_ipconfig_Report</code>
|-
| File Type Value
| 547
|-
| Parent Type
| [[Type_ASCII_Text|ASCII Text]]
|-
| Carve
| Yes
|-
| Format Details
| No
|-
| MIME Type
| <code>text/plain</code>
|-
| Filename Extension
| <code>txt</code>
|}

ipconfig Report

=Description=
Windows TCP/IP Configuration Report

=Details=

Type Chrome Extension

2020-05-18T20:18:45Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Chrome_Extension</code> |- | File Type Value | 546 |- | Parent Type | None |- | Carve..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_Chrome_Extension</code>
|-
| File Type Value
| 546
|-
| Parent Type
| None
|-
| Carve
| Yes
|-
| Format Details
| No
|-
| MIME Type
| <code>application/octet-stream</code>
|-
| Filename Extension
| <code>crx</code>
|}

Chrome Extension

=Description=
Chrome Browser Extension

=Details=
* [https://developer.chrome.com/extensions/crx Chrome Extension]

Type CodeView Section

2020-05-18T20:18:29Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_CodeView_Section</code> |- | File Type Value | 545 |- | Parent Type | None |- | Carve..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_CodeView_Section</code>
|-
| File Type Value
| 545
|-
| Parent Type
| None
|-
| Carve
| No
|-
| Format Details
| No
|-
| MIME Type
| <code>application/octet-stream</code>
|-
| Filename Extension
| <code>pdb</code>
|}

CodeView Section

=Description=
Windows Executable Debugging Info

=Details=
* [http://waleedassar.blogspot.com/2014/02/pe-timedatestamp-viewer.html CodeView Section]

Type Git Pack Index

2020-05-18T20:18:13Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Git_Pack_Index</code> |- | File Type Value | 544 |- | Parent Type | None |- | Carve |..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_Git_Pack_Index</code>
|-
| File Type Value
| 544
|-
| Parent Type
| None
|-
| Carve
| No
|-
| Format Details
| No
|-
| MIME Type
| <code>application/octet-stream</code>
|-
| Filename Extension
| <code>idx</code>
|}

Git Pack Index

=Description=
Git Pack Index

=Details=
* [https://codewords.recurse.com/issues/three/unpacking-git-packfiles/ Git Pack Index]

Type Git Pack

2020-05-18T20:17:57Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Git_Pack</code> |- | File Type Value | 543 |- | Parent Type | None |- | Carve | No |-..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_Git_Pack</code>
|-
| File Type Value
| 543
|-
| Parent Type
| None
|-
| Carve
| No
|-
| Format Details
| No
|-
| MIME Type
| <code>application/octet-stream</code>
|-
| Filename Extension
| <code>pack</code>
|}

Git Pack

=Description=
Git Pack

=Details=
* [https://codewords.recurse.com/issues/three/unpacking-git-packfiles/ Git Pack]

Type Apple Core Audio

2020-05-18T20:17:42Z

Admin: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Apple_Core_Audio</code> |- | File Type Value | 542 |- | Parent Type | None |- | Carve..."

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_Apple_Core_Audio</code>
|-
| File Type Value
| 542
|-
| Parent Type
| None
|-
| Carve
| No
|-
| Format Details
| No
|-
| MIME Type
| <code>audio/x-caf</code>
|-
| Filename Extension
| <code>caf</code>
|}

Apple Core Audio

=Description=
Apple Core Audio

=Details=
* [https://developer.apple.com/library/mac/documentation/MusicAudio/Reference/CAFSpec/CAF_spec/CAF_spec.html#//apple_ref/doc/uid/TP40001862-CH210-SW1 Apple Core Audio]