Load List - Revision history

Sam: /* Samples */

2023-05-05T10:44:25Z

Samples

2023-04-30T17:51:31Z

Investigation

2021-10-06T19:54:51Z

2021-07-15T09:42:53Z

Samples

2021-07-15T09:42:18Z

Execute After

2021-07-15T09:37:08Z

Execute Before

2021-07-15T09:30:25Z

Execute Before

2021-03-15T13:55:39Z

Samples

2021-02-16T10:36:23Z

2020-09-17T10:19:24Z

Samples

@@ Line 95: / Line 95: @@
 G: -loadas 514
 </source>
-This will add the <code>loadas</code> command line argument when the load process is spawned.
+This will add the <code>loadas</code> command line argument when the load process is spawned telling it to treat the media as a [[Type_Master_Boot_Record|Master Boot Record]].
 ==Execute Before==

@@ Line 10: / Line 10: @@
 The investigation line specifies the investigation that the following media should belong to.
 You may specify a [https://en.wikipedia.org/wiki/Universally_unique_identifier globally unique identifier] if you wish, otherwise Truxton will generate one for you.
-If you want the media in this load list file to belong to an existing investigation, simply put the identifier of that investigation on this line.
+If you want the media in this load list file to belong to an existing investigation, put the identifier of that investigation on this line.
 Once an investigation has been set, all media specified in the load list will belong to that investigation until another investigation line is present.
@@ Line 27: / Line 27: @@
 <hr />
-<syntaxhighlight lang="text">
+<source lang="text">
 i: {2CBA17E4-038A-4828-8A0D-D221F943B3F9}
-</syntaxhighlight>
+</source>
 The media specified in this load list file will be made part of an existing investigation with the id of "2CBA17E4-038A-4828-8A0D-D221F943B3F9."

← Older revision		Revision as of 19:54, 6 October 2021
Line 209:		Line 209:

	You now have a functional load list.		You now have a functional load list.
		+
		+	=Finding Python=
		+	If you specify a Python script file to execute before or after a load, the loader must find the Python executable.
		+	It does this by first retrieving the <code>python</code> [[Configuration System\|setting]].
		+	If that doesn't work, it will then read the <code>HKEY_CLASSES_ROOT\Python.File\shell\open\command</code> from the [https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry Registry].

@@ Line 129: / Line 129: @@
 <source lang="text">
-A: CompleteBillingRecord.py customer=THX1138
+Z: CompleteBillingRecord.py customer=THX1138
-A: ClearTemporaryFolders.cmd
+Z: ClearTemporaryFolders.cmd
-A: SendEndMessage.bat
+Z: SendEndMessage.bat
-A: AfterBobLoads.ps1
+Z: AfterBobLoads.ps1
 </source>
 These scripts will execute sequentially before the loader process is spawned.

@@ Line 117: / Line 117: @@
 ==Execute After==
-This allows you to specify a [https://docs.microsoft.com/en-us/powershell/ PowerShell] script or batch file to execute after the load process exits.
+This allows you to specify a [https://docs.microsoft.com/en-us/powershell/ PowerShell] script, [https://www.python.org/ Python] script, or batch file to execute after the [[Load|load]] process exits.
 ===Samples===
 <source lang="text">
@@ Line 123: / Line 127: @@
 </source>
 This script will execute once the load completes.
 ==Path==

@@ Line 109: / Line 109: @@
 <source lang="text">
-A: LogGovernanceData.py
+A: StartBillingRecord.py customer=THX1138 category=ForensicServices
 A: ClearTemporaryFolders.cmd
 A: SendStartMessage.bat

@@ Line 98: / Line 98: @@
 ==Execute Before==
-This allows you to specify a [https://docs.microsoft.com/en-us/powershell/ PowerShell] script or batch file to execute before the load process is spawned. Once the script completes, the loader is free to execute.
+This allows you to specify a [https://docs.microsoft.com/en-us/powershell/ PowerShell] script, [https://www.python.org/ Python] script, or batch file to execute before the load process is spawned.
 ===Samples===
@@ Line 105: / Line 107: @@
 </source>
 This script will execute before the loader process is spawned.
 ==Execute After==

@@ Line 57: / Line 57: @@
 C: c:\Configs\Triage.xml
 </source>
-This will cause the loaders to use configuration parameters as specified in the "c:\Configs\Triage.xml" file.
+This will cause the loaders to use configuration parameters as specified in the <code>c:\Configs\Triage.xml</code> file.
 ==Hash Set Directory==