Investigation Types - Revision history

Sam at 16:30, 18 August 2021

2021-08-18T16:30:07Z

Sam at 13:46, 17 August 2021

2021-08-17T13:46:53Z

Sam at 18:00, 18 February 2021

2021-02-18T18:00:05Z

Sam at 12:32, 29 December 2020

2020-12-29T12:32:43Z

Sam at 15:32, 3 December 2020

2020-12-03T15:32:59Z

Sam at 18:02, 29 May 2020

2020-05-29T18:02:26Z

Show changes

Sam: Created page with "When Truxton stores media, you can assign a type of media to it. This allows the analyst to get more of a clue as to what they are looking at. This is stored in the `[Med..."`


2020-05-29T17:43:11Z
Created page with "When Truxton stores media, you can assign a type of media to it. This allows the analyst to get more of a clue as to what they are looking at. This is stored in the <code>[Med..."
New page
When Truxton stores media, you can assign a type of media to it.

This allows the analyst to get more of a clue as to what they are looking at.

This is stored in the <code>[MediaTypeID]</code> column of the <code>[Media]</code> table in the database.

The <code>[MediaType]</code> reference table in the database also contains this information.



This information is also kept in the <code>MediaType</code> database table.



{| class="wikitable"

! Name

! Value

! Meaning

|-

| <code>MEDIA_TYPE_UNKNOWN</code>

| style="text-align:center;" | 0

| We don't know what type of media this is.

|-

| <code>MEDIA_TYPE_LOGICAL_FILES</code>

| style="text-align:center;" | 1

| A folder on the loader machine.

|-

| <code>MEDIA_TYPE_PHYSICAL_HARD_DISK</code>

| style="text-align:center;" | 2

| The media is a physical hard drive connected, hopefully through a write-blocker, to the loader machine processed as a bag of sectors.

|-

| <code>MEDIA_TYPE_HARD_DISK_IMAGE</code>

| style="text-align:center;" | 3

| A forensic copy of a hard disk in a file.

|-

| <code>MEDIA_TYPE_HARD_DISK_FOLDER</code>

| style="text-align:center;" | 4

| A hard drive as a folder. Mounting a hard disk image is an example. Truxton relied on the host operating system to interpret the file system on the media.

|-

| <code>MEDIA_TYPE_PHYSICAL_CD</code>

| style="text-align:center;" | 5

| A compact disc attached to the loader machine processed as a bag of sectors.

|-

| <code>MEDIA_TYPE_CD_IMAGE</code>

| style="text-align:center;" | 6

| A forensic copy of a compact disc in a file.

|-

| <code>MEDIA_TYPE_CD_FOLDER</code>

| style="text-align:center;" | 7

| A compact disc mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.

|-

| <code>MEDIA_TYPE_PHYSICAL_DVD</code>

| style="text-align:center;" | 8

| A DVD attached to the loader machine processed as a bag of sectors.

|-

| <code>MEDIA_TYPE_DVD_IMAGE</code>

| style="text-align:center;" | 9

| A forensic copy of a DVD in a file.

|-

| <code>MEDIA_TYPE_DVD_FOLDER</code>

| style="text-align:center;" | 10

| A DVD mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.

|-

| <code>MEDIA_TYPE_PHYSICAL_BLURAY</code>

| style="text-align:center;" | 11

| A BluRay attached to the loader machine processed as a bag of sectors.

|-

| <code>MEDIA_TYPE_BLURAY_IMAGE</code>

| style="text-align:center;" | 12

| A forensic copy of a BluRay disc in a file.

|-

| <code>MEDIA_TYPE_BLURAY_FOLDER</code>

| style="text-align:center;" | 13

| A folder on a BluRay physically attached to the loader machine. Truxton relied on the host operating system to interpret the file system on the media.

|-

| <code>MEDIA_TYPE_PHYSICAL_THUMB_DRIVE</code>

| style="text-align:center;" | 14

| A thumb drive attached to the loader machine processed as a bag of sectors.

|-

| <code>MEDIA_TYPE_THUMB_DRIVE_IMAGE</code>

| style="text-align:center;" | 15

| A forensic copy of a thumb drive in a file.

|-

| <code>MEDIA_TYPE_THUMB_DRIVE_FOLDER</code>

| style="text-align:center;" | 16

| A thumb drive mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.

|-

| <code>MEDIA_TYPE_PHYSICAL_SIM_CARD</code>

| style="text-align:center;" | 17

| A SIM card attached to the loader machine.

|-

| <code>MEDIA_TYPE_SIM_CARD_IMAGE</code>

| style="text-align:center;" | 18

| A forensic copy of a SIM card in a file.

|-

| <code>MEDIA_TYPE_SIM_CARD_FOLDER</code>

| style="text-align:center;" | 19

| A SIM card mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.

|-

| <code>MEDIA_TYPE_PHYSICAL_SD_CARD</code>

| style="text-align:center;" | 20

| An SD card attached to the loader machine.

|-

| <code>MEDIA_TYPE_SD_CARD_IMAGE</code>

| style="text-align:center;" | 21

| A forensic copy of an SD card in a file.

|-

| <code>MEDIA_TYPE_SD_CARD_FOLDER</code>

| style="text-align:center;" | 22

| An SD card mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.

|-

| <code>MEDIA_TYPE_RAM</code>

| style="text-align:center;" | 23

| A dump of memory.

|-

| <code>MEDIA_TYPE_FLOPPY_DISK_IMAGE</code>

| style="text-align:center;" | 24

| A forensic copy of a [https://en.wikipedia.org/wiki/Floppy_disk floppy diskette].

|-

| <code>MEDIA_TYPE_FLASH</code>

| style="text-align:center;" | 25

| A dump of flash memory chips.

|-

| <code>MEDIA_TYPE_GPS</code>

| style="text-align:center;" | 26

| A dump of a GPS device.

|-

| <code>MEDIA_TYPE_TAR</code>

| style="text-align:center;" | 27

| A [https://en.wikipedia.org/wiki/Tar_(computing) TAR] file.

|-

| <code>MEDIA_TYPE_RAR</code>

| style="text-align:center;" | 28

| A [https://en.wikipedia.org/wiki/RAR_(file_format) RAR] file.

|-

| <code>MEDIA_TYPE_ZIP</code>

| style="text-align:center;" | 29

| A [https://en.wikipedia.org/wiki/Zip_(file_format) ZIP] file.

|-

| <code>MEDIA_TYPE_FORENSIC_DATA</code>

| style="text-align:center;" | 30

| Data pulled from evidence by forensic technicians.

|-

| <code>MEDIA_TYPE_ASSOCIATED_DATA</code>

| style="text-align:center;" | 31

| Data relevant to the case but doesn't come from seized media such as photos of the media, crime scene, etc.

|-

| <code>MEDIA_TYPE_PHONE</code>

| style="text-align:center;" | 32

| A dump of a phone.

|-

| <code>MEDIA_TYPE_TABLET</code>

| style="text-align:center;" | 33

| A dump of a tablet.

|-

| <code>MEDIA_TYPE_PHYSICAL_ITEMS</code>

| style="text-align:center;" | 34

| Non-digital evidence collected from the crime scene such as pieces of paper, writing on a wall, etc.

|-

| <code>MEDIA_TYPE_ABORT_LOAD</code>

| style="text-align:center;" | 32749

| A request has been made to abort any loading of this media.

|}

@@ Line 47: / Line 47: @@
 | style="text-align:center;" | -1142204208
 | A homicide case.
 |-
 | <code>INVESTIGATION_TYPE_INTERNAL</code>

@@ Line 12: / Line 12: @@
 | We don't know what type of investigation this is.
 |-
-| <code>INVESTIGATION_TYPE_TRAINING</code>
+| <code>INVESTIGATION_TYPE_ASSAULT</code>
-| style="text-align:center;" | 1294317807
+| style="text-align:center;" | 282345722
-| An investigation for the purpose of training an analyst.
+| An assault investigation.
 |-
-| <code>INVESTIGATION_TYPE_FRAUD</code>
+| <code>INVESTIGATION_TYPE_BATTERY</code>
-| style="text-align:center;" | 1433479426
+| style="text-align:center;" | 1540437532
-| This is a fraud case.
+| A battery case.
 |-
 | <code>INVESTIGATION_TYPE_CHILD_EXPLOITATION</code>
@@ Line 24: / Line 24: @@
 | A child exploitation case.
 |-
-| <code>INVESTIGATION_TYPE_SUSPICIOUS_DEATH</code>
+| <code>INVESTIGATION_TYPE_CIVIL</code>
-| style="text-align:center;" | 618357760
+| style="text-align:center;" | -578586218
-| A death under unusual circumstances.
+| A civil case.
 |-
-| <code>INVESTIGATION_TYPE_MISSING_PERSON</code>
+| <code>INVESTIGATION_TYPE_DATA_RECOVERY</code>
-| style="text-align:center;" | 2095812006
+| style="text-align:center;" | -762708792
-| The disappearance of someone.
+| A data recovery case.
 |-
 | <code>INVESTIGATION_TYPE_DRUG</code>
@@ Line 52: / Line 36: @@
 | A drug case.
 |-
-| <code>INVESTIGATION_TYPE_CIVIL</code>
+| <code>INVESTIGATION_TYPE_FRAUD</code>
-| style="text-align:center;" | -578586218
+| style="text-align:center;" | 1433479426
-| A civil case.
+| This is a fraud case.
 |-
 | <code>INVESTIGATION_TYPE_GANG</code>
@@ Line 64: / Line 48: @@
 | A homicide case.
 |-
-| <code>INVESTIGATION_TYPE_UNACCOMPANIED_DEATH</code>
+| <code>INVESTIGATION_TYPE_INTERNAL</code>
-| style="text-align:center;" | -67542183
+| style="text-align:center;" | 772945205
-| A investigation of an unaccompanied death.
+| An internal investigation.
 |-
 | <code>INVESTIGATION_TYPE_LOAC</code>
@@ Line 72: / Line 56: @@
 | A [https://en.wikipedia.org/wiki/International_humanitarian_law Law of Armed Conflict] case.
 |-
-| <code>INVESTIGATION_TYPE_DATA_RECOVERY</code>
+| <code>INVESTIGATION_TYPE_MISSING_PERSON</code>
-| style="text-align:center;" | -762708792
+| style="text-align:center;" | 2095812006
-| A data recovery case.
+| The disappearance of someone.
 |-
 | <code>INVESTIGATION_TYPE_OTHER</code>
 | style="text-align:center;" | 99897732
 | Some generic reason for having an investigation.
 |}

← Older revision		Revision as of 18:00, 18 February 2021
Line 1:		Line 1:
	The <code>[InvestigationType]</code> reference table in the database also contains this information.		The <code>[InvestigationType]</code> reference table in the database also contains this information.
		+	These are the default values that ship with Truxton.
		+	You are free to add as many as you need.

	{\| class="wikitable"		{\| class="wikitable"

@@ Line 68: / Line 68: @@
 | <code>INVESTIGATION_TYPE_LOAC</code>
 | style="text-align:center;" | -570969319
-| A Law of Armed Conflict case.
+| A [https://en.wikipedia.org/wiki/International_humanitarian_law Law of Armed Conflict] case.
 |-
 | <code>INVESTIGATION_TYPE_DATA_RECOVERY</code>

← Older revision		Revision as of 15:32, 3 December 2020
Line 1:		Line 1:
−	The <code>InvestigationType</code> reference table in the database also contains this information.	+	The <code>[InvestigationType]</code> reference table in the database also contains this information.

	{\| class="wikitable"		{\| class="wikitable"

Investigation Types - Revision history

Sam at 16:30, 18 August 2021

Sam at 13:46, 17 August 2021

Sam at 18:00, 18 February 2021

Sam at 12:32, 29 December 2020

Sam at 15:32, 3 December 2020

Sam at 18:02, 29 May 2020

Sam: Created page with "When Truxton stores media, you can assign a type of media to it. This allows the analyst to get more of a clue as to what they are looking at. This is stored in the [Med..."

Sam: Created page with "When Truxton stores media, you can assign a type of media to it. This allows the analyst to get more of a clue as to what they are looking at. This is stored in the `[Med..."`