Loading Strategies - Revision history

Sam: /* A Walk Through */

2023-06-02T16:37:16Z

A Walk Through

Sam: /* A Walk Through */

2023-06-02T16:35:26Z

A Walk Through

Sam at 16:34, 2 June 2023

2023-06-02T16:34:11Z

Sam at 16:32, 2 June 2023

2023-06-02T16:32:40Z

Sam at 16:08, 2 June 2023

2023-06-02T16:08:27Z

Sam at 16:58, 25 October 2022

2022-10-25T16:58:16Z

Sam: /* A Walk Through */

2021-01-25T16:52:39Z

A Walk Through

Sam: /* A Walk Through */

2021-01-25T16:47:47Z

A Walk Through

Sam: /* Field Exploitation */

2021-01-25T16:42:23Z

Field Exploitation

Sam: /* Quality Controlled */

2021-01-25T16:23:47Z

Quality Controlled

@@ Line 97: / Line 97: @@
 # Monitor the status of the load waiting for it to finish
 # Execute a script to extract [[Python Sample Export Videos|files]] or [[TruxtonEnumeration#Sample|artifacts]] in a format of your choosing to a place on the share
-# [[TruxtonCLI.exe#Export_an_Investigation|Export]] the loaded media to a shared folder
+# [[TruxtonCLI.exe#Export_an_Investigation|Export]] the loaded media to a shared folder ([[TPIF]])
 # Destroy the virtual machine
 This workflow ensures no data contamination since all media is loaded on a virgin machine.
-Should a user on your enterprise system want to see the media that an interesting artifact came from, they can import the media into their instance of Truxton.
+Should a user on your enterprise system want to see the media that an interesting artifact came from, they can import the media ([[TPIF]]) into their instance of Truxton.
 =Field Exploitation=

@@ Line 96: / Line 96: @@
 # Execute [[Load|Load.exe]] on the new virtual machine and give it the path the load list.
 # Monitor the status of the load waiting for it to finish
-# Execute a script to extract [[Python Sample Export Videos|files]] or [[TruxtonEnumeration#Sample|artifacts]] to a place on the share
+# Execute a script to extract [[Python Sample Export Videos|files]] or [[TruxtonEnumeration#Sample|artifacts]] in a format of your choosing to a place on the share
 # [[TruxtonCLI.exe#Export_an_Investigation|Export]] the loaded media to a shared folder
 # Destroy the virtual machine

@@ Line 70: / Line 70: @@
 The analysis Truxton has no knowledge of the depot files from the loader machines until the media has been published to the analysis server.
 This allows the quality control technicians to freely delete depot files from bad loads without interfering with analysts.
 =Integrated into Your Existing Enterprise Workflow=
@@ Line 89: / Line 102: @@
 This workflow ensures no data contamination since all media is loaded on a virgin machine.
 Should a user on your enterprise system want to see the media that an interesting artifact came from, they can import the media into their instance of Truxton.
 =Field Exploitation=

@@ Line 70: / Line 70: @@
 The analysis Truxton has no knowledge of the depot files from the loader machines until the media has been published to the analysis server.
 This allows the quality control technicians to freely delete depot files from bad loads without interfering with analysts.
 ==A Walk Through==

← Older revision		Revision as of 16:08, 2 June 2023
Line 115:		Line 115:
	The user can dismount the Easy Button load, FedEx the external drive to a central office.		The user can dismount the Easy Button load, FedEx the external drive to a central office.
	All of the reports are in the results folder.		All of the reports are in the results folder.
		+
		+	=Triage=
		+	If you are in a hurry you can perform a Turbo Triage load.
		+	This type of load will ignore freespace and carving.
		+	It will load only those files and folders that you have specified.
		+	The names and patterns are stored in the <code><nowiki>[</nowiki>[[TriageFile Table\|TriageFile]]<nowiki>]</nowiki></code> table in the database.
		+	Any file or folder that doesn't match an entry in that table will be ignored.

← Older revision		Revision as of 16:58, 25 October 2022
Line 107:		Line 107:
	# The state level organization imported the investigation into their Truxton, correlated the artifacts with the rest of their holdings and requested the rest of the media		# The state level organization imported the investigation into their Truxton, correlated the artifacts with the rest of their holdings and requested the rest of the media
	# The small town copies the [[Depot\|depot files]] and images to an external hard drive and [https://en.wikipedia.org/wiki/Grumman_G-21_Goose fly] them to the capital		# The small town copies the [[Depot\|depot files]] and images to an external hard drive and [https://en.wikipedia.org/wiki/Grumman_G-21_Goose fly] them to the capital
		+
		+	=History Major=
		+	If you are not a technical person at all, Truxton has an [[Easy Button Load\|Easy Button.]]
		+	It presumes that you have one piece of seized media per folder in another folder on an external drive.
		+	It will navigate all of the sub-folders looking for forensic images, move Truxton's databse to that external drive load all of the media into an investigation, generate the reports, then pop up a browser to a top level web page for that investigation.
		+	The GUI desktop is not needed.
		+	The user can dismount the Easy Button load, FedEx the external drive to a central office.
		+	All of the reports are in the results folder.

@@ Line 79: / Line 79: @@
 # Someone reviews the incoming media for completeness, relative priority, surrounding meta data (who gave it to us and why), etc.
 # When it has been determined that the data should be loaded, it is processed on an independent instance of Truxton (can be multi-node)
-# Once Truxton's exploitation is finished, someone reviews the load logs, browses through the data using the Analyst Desktop. If no problems are found the media is exported.
+# Once Truxton's exploitation is finished, someone reviews the [[Type_Load_Log|load logs]], browses through the data using the Analyst Desktop. If no problems are found the media is exported.
 # The processed media is then imported into the enterprise wide Truxton (or a Truxton dedicated to the analysis team)
 # Teams of analysts examine the Truxton output using the Analyst Desktop

@@ Line 104: / Line 104: @@
 # They reviewed the artifacts and reports in the Analyst Desktop and determined that higher level agency should look at it
 # They emailed the Media Summary Reports to state analysts who requested the Truxton data immediately
-# Due to the remote nature of the town, the investigation was exported from Truxton and transmitted dial-up modem to the capital city
+# The investigation was exported from Truxton and, due to the remote nature of the town, transmitted via dial-up modem to the capital city
 # The state level organization imported the investigation into their Truxton, correlated the artifacts with the rest of their holdings and requested the rest of the media
 # The small town copies the [[Depot|depot files]] and images to an external hard drive and [https://en.wikipedia.org/wiki/Grumman_G-21_Goose fly] them to the capital

← Older revision		Revision as of 16:42, 25 January 2021
Line 96:		Line 96:
	Sometimes it is better to push exploitation to the edge and send back the results rather than raw data.		Sometimes it is better to push exploitation to the edge and send back the results rather than raw data.
	The raw data and [[Depot\|depots]] can be forwarded later (via FedEx or when you get to a broadband connection).		The raw data and [[Depot\|depots]] can be forwarded later (via FedEx or when you get to a broadband connection).
		+
		+	==A Walk Through==
		+	The following is an example of an imaginary workflow.
		+	# Someone in a [https://en.wikipedia.org/wiki/Northern_Exposure small town] [https://en.wikipedia.org/wiki/Digital_forensic_process#Seizure seized] several devices
		+	# They were able to [https://en.wikipedia.org/wiki/Digital_forensic_process#Acquisition image] them
		+	# They loaded the images into Truxton
		+	# They reviewed the artifacts and reports in the Analyst Desktop and determined that higher level agency should look at it
		+	# They emailed the Media Summary Reports to state analysts who requested the Truxton data immediately
		+	# Due to the remote nature of the town, the investigation was exported from Truxton and transmitted dial-up modem to the capital city
		+	# The state level organization imported the investigation into their Truxton, correlated the artifacts with the rest of their holdings and requested the rest of the media
		+	# The small town copies the [[Depot\|depot files]] and images to an external hard drive and [https://en.wikipedia.org/wiki/Grumman_G-21_Goose fly] them to the capital