Stitch - Revision history

Sam at 09:14, 15 August 2024

2024-08-15T09:14:55Z

Sam at 09:13, 15 August 2024

2024-08-15T09:13:58Z

Sam: /* File Reference Fixup */

2024-08-09T11:26:33Z

File Reference Fixup

Sam at 11:21, 9 August 2024

2024-08-09T11:21:57Z

Sam at 16:56, 25 January 2021

2021-01-25T16:56:48Z

Sam at 13:49, 23 July 2020

2020-07-23T13:49:58Z

Sam: Created page with "{| style="float:right;border:1px solid black" |+ Details | Executable | `Stitch.exe` |- | Stage | style="text-align:center;" | 40 |- | Percent Complete | style="tex..."

2020-07-23T13:49:27Z

Created page with "{| style="float:right;border:1px solid black" |+ Details | Executable | <code>Stitch.exe</code> |- | Stage | style="text-align:center;" | 40 |- | Percent Complete | style="tex..."

New page

{| style="float:right;border:1px solid black"
|+ Details
| Executable
| <code>Stitch.exe</code>
|-
| Stage
| style="text-align:center;" | 40
|-
| Percent Complete
| style="text-align:center;" | 62%
|-
| Message Queue
| <code>stitch</code>
|}

The Stitch ETL takes fragments of carved files and puts them back together again.
The fragments of the file are put back in order and added as a complete file even though the individual pieces could be scattered throughout the drive.

=File Types=
Stitch can defragment the following types of files.

* [[Type_Ogg_Vorbis]]
* [[Type_Ogg_Theora]]

@@ Line 22: / Line 22: @@
 While [[Poly]] is triggered by the presence of certain [[Poly#File_Types|file types]], Stitch is triggered by all ETLs in previous [[ETL_Stages|stages]] having completed their processing.
 All media processing after Stitch will be in serial while before Stitch, exploitation executes in parallel.
 ==Fragmented File Carving==

@@ Line 16: / Line 16: @@
 The Stitch ETL performs the task of gathering files from a piece of media and producing something from it.
 This ETL will only run once per media.
 ==Fragmented File Carving==

@@ Line 33: / Line 33: @@
 The expander can fill out all that is known about the file like File Name, File Size.
 Fixing up this reference means we have to query this media to see if there is an original file that matches the reference.
 ==Apple Filesystem Event Consolidation==
 Stitch will gather all of the [[Type_Apple_Filesystem_Events|Apple Filesystem Events]] files and produce a single <code>FSEvents.sql</code> file that can be used to create a SQLite database compatible with [https://www.crowdstrike.com/blog/using-os-x-fsevents-discover-deleted-malicious-artifact/ other tools].

@@ Line 14: / Line 14: @@
 |}
-The Stitch ETL takes fragments of carved files and puts them back together again.
+The Stitch ETL performs the task of gathering files from a piece of media and producing something from it.
 The fragments of the file are put back in order and added as a complete file even though the individual pieces could be randomly scattered throughout the drive.
-=File Types=
+===File Types===
 Stitch can defragment the following types of files.
 * [[Type_Ogg_Vorbis]]
 * [[Type_Ogg_Theora]]

@@ Line 11: / Line 11: @@
 |-
 | Message Queue
-| <code>stitch</code>
+| style="text-align:center;" | <code>stitch</code>
 |}