Why is Truxton so Extensible - Revision history

Sam: /* I want to use my own file carver */

2025-10-23T11:36:05Z

I want to use my own file carver

2024-01-27T10:24:27Z

2024-01-26T08:04:38Z

How do I know my code is working?

2024-01-25T23:09:56Z

2024-01-25T11:28:09Z

I want to use my own file carver

2024-01-25T10:01:45Z

2024-01-25T10:00:32Z

I want to use my own User Interface

2024-01-25T09:59:08Z

I want to use my own file carver

2024-01-25T09:58:11Z

I have a better way to exploit a file type

2024-01-25T09:57:49Z

I have a better way to exploit this file type

@@ Line 54: / Line 54: @@
 If you want to replace Truxton's default file carver with your own, you would:
 # Create an ETL that listens to the "carve" message queue
-# Replace the [[TruxtonService.xml#Sample_Configuration_File|"carve"]] ETL in TruxtonService.xml to use your executable
+# Replace the [[TruxtonService.xml#Sample_Configuration_File|"carve"]] ETL in [[TruxtonService.xml]] to use your executable
 # Handle the [[Message_Bus_Messages#Carve|carve message]] in your code

← Older revision		Revision as of 10:24, 27 January 2024
Line 91:		Line 91:
	It will [[Easy Button Load#Determining_What_to_Load\|find media]] to load in that folder.		It will [[Easy Button Load#Determining_What_to_Load\|find media]] to load in that folder.
	When the last piece of media completes, reports are generated and a web browser pops up with links to all of the reports.		When the last piece of media completes, reports are generated and a web browser pops up with links to all of the reports.
		+
		+	==I'm a small office, I don't need a big system==
		+	Truxton is a highly modular system.
		+	It can scale up by running more of the modules on one or more machines on your network.
		+	It can scale down by running fewer modules on a laptop.
		+	If you need to share an investigation with another office, you can send them a [[TPIF]] instead of raw media.

@@ Line 58: / Line 58: @@
 ==How do I know my code is working?==
-[[Load_Validation|ValidateLoad]] is a tool to make sure Truxton is working.
+Writing forensic tools is hard.
 ==I want to use my own User Interface==

@@ Line 56: / Line 56: @@
 # Replace the [[TruxtonService.xml#Sample_Configuration_File|"carve"]] ETL in TruxtonService.xml to use your executable
 # Handle the [[Message_Bus_Messages#Carve|carve message]] in your code
 ==I want to use my own User Interface==

@@ Line 55: / Line 55: @@
 # Create an ETL that listens to the "carve" message queue
 # Replace the [[TruxtonService.xml#Sample_Configuration_File|"carve"]] ETL in TruxtonService.xml to use your executable
-# Handle the [[Type_Truxton_Control_Message_Carve|carve message]] in your code
+# Handle the [[Message_Bus_Messages#Carve|carve message]] in your code
 ==I want to use my own User Interface==

@@ Line 66: / Line 66: @@
 There are also some [[Useful_SQL_Queries|useful queries]] to get you started.
-==I don't want a User Interface==
+==I want results not a User Interface==
 For minimally trained users that say:
 * I just want to push a button and see the reports.
@@ Line 73: / Line 73: @@
 The [[Easy Button Load#Sample_Scenario|Easy Button]] is the one-stop shop for Truxton forensics.
-You right button on a folder, then wait for a browser to pop up.
+You right button on a top level folder, select Easy Button Load, then wait for a browser to pop up.
 It will [[Easy Button Load#Determining_What_to_Load|find media]] to load in that folder.
 When the last piece of media completes, reports are generated and a web browser pops up with links to all of the reports.

@@ Line 60: / Line 60: @@
 Truxton’s Analyst Desktop is a graphical user interface that queries a [[Database_Tables|database]] and puts the results onto the screen.
 There’s nothing stopping you from creating your own interface or integrating Truxton into an existing UI.
 The database schema is designed to be easily understood by humans.

@@ Line 46: / Line 46: @@
 ==I want to use my own file carver==
 While Truxton's [[Carve|file carver]] is good, it focuses on speed and accuracy, not extensibility.
-Rather than plug into the existing carver, you would write your own carving ETL and set it to run as a [[ETL_Stages#Semi-Chaotic|Semi-Chaotic]] stage.
+Rather than plug into the existing carver, you would write your own carving ETL and set it to run at a [[ETL_Stages#Semi-Chaotic|Semi-Chaotic]] stage.
 When notified to run, your ETL would:
 # Query the <code><nowiki>[</nowiki>[[Free Table|Free]]<nowiki>]</nowiki></code> table to gather the regions of free space

@@ Line 34: / Line 34: @@
 Find the records matching the <code>FileTypeID</code> column and modify the <code>ETLQueueName</code> column to hold the name of the queue associated with your exploiter.
-If you created a better [[Type_CSV|CSV]] exploitation process, you can tell Truxton to use that instead of the default exploiter by using this SQL statement:
+If you created a better [[Type_CSV|CSV]] exploitation process, you can tell Truxton to use that instead of the default exploiter by executing this SQL statement:
 <source lang="sql">
 UPDATE "ETLRoute" SET "ETLQueueName" = 'bettercsv' WHERE "FileTypeID" = 241

@@ Line 30: / Line 30: @@
 # [[TruxtonService.xml#Adding_Your_Own_ETL_Process|Register your ETL]] with the [[Truxton Service]] so it will run
-==I have a better way to exploit this file type==
+==I have a better way to exploit a file type==
 You can replace Truxton's existing file processing by updating the <code><nowiki>[</nowiki>[[ETLRoute Table|ETLRoute]]<nowiki>]</nowiki></code> table.
 Find the records matching the <code>FileTypeID</code> column and modify the <code>ETLQueueName</code> column to hold the name of the queue associated with your exploiter.