Origin - Revision history

Sam: /* Generated Files */

2021-12-17T18:29:25Z

Generated Files

2020-12-30T11:06:48Z

2020-12-29T12:16:17Z

2020-12-28T17:57:41Z

2020-12-03T15:22:28Z

2020-11-20T20:57:14Z

Associated Files

2020-11-20T20:56:28Z

Generated Files

2020-11-20T20:55:51Z

Generated Files

2020-06-18T14:39:18Z

2020-06-18T14:37:46Z

Associated Files

← Older revision		Revision as of 18:29, 17 December 2021
Line 78:		Line 78:

	If your ETL generates files that should not be exploited, only content indexed, mark their origin as <code>ORIGIN_GENERATED</code>. Otherwise, if you need the file to be exploited it is recommended to mark their origin as <code>ORIGIN_EXPANDED</code>.		If your ETL generates files that should not be exploited, only content indexed, mark their origin as <code>ORIGIN_GENERATED</code>. Otherwise, if you need the file to be exploited it is recommended to mark their origin as <code>ORIGIN_EXPANDED</code>.
		+
		+	The following files are generated by Truxton to help analyze seized media:
		+	* [[Type_File_Details]] - A [http://en.wikipedia.org/wiki/JSON JSON] file that contains information about a file in Truxton
		+	* [[Type_RegRipper_Report]] - The report generated by RegRipper
		+	* [[Type_Media_Snippet]] - A Snippet is information in an XML file that is used to generate reports
		+	* [[Type_USB_Information]] - Data collected about USB devices in a piece of seized media
		+	* [[Type_Password_Dump]] - a pwdump file containing the logon information for the seized media
		+	* [[Type_Load_Log]] - The log file for Truxton loads
		+	* Truxton Media Geographic Report - This [[Type_KMZ\|KMZ]] file contains all of the geographic data from the seized media.

	=Expanded vs Generated Files=		=Expanded vs Generated Files=

@@ Line 64: / Line 64: @@
 | style="text-align:center;" | 13
 | The file was an attachment to a [https://en.wikipedia.org/wiki/VCard vCard] entry.
 |}

@@ Line 60: / Line 60: @@
 | style="text-align:center;" | 12
 | The file came from the slack space of a normal file in the filesystem of the media.
 |}

@@ Line 1: / Line 1: @@
 When Truxton stores files, it will tell you where the file came from.
-This is stored in the <code>[Origin]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table in the database.
+This is stored in the <code>[OriginID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table in the database.
 This information is also kept in the <code>[Origin]</code> database table.

@@ Line 1: / Line 1: @@
 When Truxton stores files, it will tell you where the file came from.
-This is stored in the <code>Origin</code> column of the <code>File</code> table in the database.
+This is stored in the <code>[Origin]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table in the database.
-This information is also kept in the <code>Origin</code> database table.
+This information is also kept in the <code>[Origin]</code> database table.
 {| class="wikitable"

← Older revision		Revision as of 20:57, 20 November 2020
Line 89:		Line 89:
	* Anything the investigator needs		* Anything the investigator needs

−	Associated files ~~will~~ not go through the ~~forensic exploitation process~~ but they will go ~~though~~ content indexing.	+	Associated files '''are not routed through the ETL layer''' but they will go through content indexing.

@@ Line 65: / Line 65: @@
 Files having an origin of <code>ORIGIN_GENERATED</code> are a special case in Truxton exploitation.
 Generated files '''are not routed through the ETL layer''' like other files.
-For example, the Truxton Geographic Report is a [[Type_KMZ | KMZ]] file.
+For example, the Truxton Geographic Report is a [[Type_KMZ|KMZ]] file.
 If this wasn't marked as generated, it would cause an endless loop in exploitation.
 The exception to the routing is generated files will be routed to only ETLs that registered for <code>[[Type_All_Files_With_Or_Without_Contents]]</code> or <code>[[Type_All_Files_With_Contents]]</code>.

@@ Line 29: / Line 29: @@
 | The file came out of another file in Truxton. Child files of a [[Type_ZIP|Zip archive]] are <code>ORIGIN_EXPANDED</code>
 |-
-| <code>ORIGIN_ASSOCIATED</code>
+| <code>[[#Associated_Files | ORIGIN_ASSOCIATED]]</code>
 | style="text-align:center;" | 5
 | The file was uploaded to Truxton by a user and associated with media.
 |-
-| <code>ORIGIN_GENERATED</code>
+| <code>[[#Generated Files | ORIGIN_GENERATED]]</code>
 | style="text-align:center;" | 6
 | Truxton generated this file during exploitation. [[Type_Media_Snippet|Snippet]] files are an example. Please see the note below about generated files.

← Older revision		Revision as of 14:37, 18 June 2020
Line 88:		Line 88:
	* Witness interview transcripts		* Witness interview transcripts
	* Anything the investigator needs		* Anything the investigator needs
		+
		+	Associated files will not go through the forensic exploitation process but they will go though content indexing.