Next Release

This is a place holder for what is being put into the next release of Truxton.

Truxton Next

<< Released 2024-?

Improvements

1. Generic SQLite exploitation. You can add your own SQLite exploitation scripts to Truxton and it will run them against every SQLite database it finds. Truxton includes all of the scripts from project APOLLO
2. Beginning to exploit Apple SEGB files. For now, we mostly just convert them to SEGB XML.
3. Better PList and protocol buffer conversion to XML. When a field looks like it may contain a timestamp, Truxton decodes and outputs a human-readable timestamp.
4. Better MPEG 2 Stream carving.
5. Truxton no longer pollutes the Camera Information section with Quicktime information.
6. In the GUI, when viewing a geographic location on an external map URL link, a label for that location is now included instead of just "You are here"
7. Better DataPilot integration
8. We now extract the Windows Advertising ID (WAID) from Windows machines.
9. Use PostgreSQL 17.4.1
10. Updated to Python 3.13.2
11. Fixed a high-compression ration bug in KTX conversion.
12. We now pull contacts from Apple Calendar Databases.
13. Fixed a bug where duplicate Subjects were being display in communications display
14. Exploit AlpineQuest track logs. The tracks are written to the geographic report KMZ.
15. EXIF information was not being extracted from very large images.
16. Improved exploitation of Android Accounts
17. Fixed a bug where relationships with Subjects was not being deleted in the truxton_delete_subject() C API.
18. When expanding Protocol Buffers, if a file is found in an array field, it will become a child of the protocol buffer file. Usually these are JPG or PNG files.
19. Extract more contact information from Skype database
20. Fixed a bug in the Windows Event Log parser
21. Added the following C APIs
    1. truxton_delete_artifact_type
    2. truxton_delete_event_type
    3. truxton_delete_investigation_by_name
    4. truxton_delete_media_by_name
    5. truxton_delete_subject
    6. truxton_delete_tag
22. Added the following Python APIs
    1. deleteartifacttype
    2. deleteeventtype
    3. deleteinvestigationbyname
    4. deletemediabyname
    5. deletesubject
    6. deletetag
23. Fixed a bug where suspects in an investigation were not being deleted
24. Added ELF file carving
25. Better exploitation of prefetch files to include which files were opened by the application

New Types

File

1. Type_Generic_SQLite_Script_Results
2. Type_Generic_SQLite_Script_Details
3. Type_Apple_SEGB
4. Type_Apple_Icon_Cache
5. Type_Material_Exchange_Format
6. Type_ECW
7. Type_NetXray
8. Type_Waze_Roadmap_Data
9. Type_Maps_With_Me
10. Type_Apple_Encrypted_Archive
11. Type_Apple_SEGB_XML
12. Type_DataPilot_Database
13. Type_Numerical_Control
14. Type_NetCDF
15. Type_Android_Call_Log_Backup
16. Type_WebAssembly
17. Type_CPBitmap
18. Type_Protocol_Buffer_Archive
19. Type_Paint_Dot_Net
20. Type_Outlook_Express_DBT
21. Type_Discord_User_Information
22. Type_Discord_Message_Dump
23. Type_Olympus_Raw_Image
24. Type_EFTS
25. Type_Fuji_Raw_Image
26. Type_AlpineQuest_Track
27. Type_DEX
28. Type_FTK_Image
29. Type_Windows_Diagnostic_Telemetry

Entity Types

1. ENTITY_TYPE_WAID - An identifier used by Microsoft Windows to target you with advertising.
2. ENTITY_TYPE_DISCORD_ACCOUNT_ID - An identifier for a Discord account
3. ENTITY_TYPE_REDDIT_ACCOUNT_ID - An identifier for a Reddit account

Event Types

1. EVENT_TYPE_DEVICE_LOCKED - When a device enters a locked state
2. EVENT_TYPE_DEVICE_UNLOCKED - When a device has been unlocked
3. EVENT_TYPE_FAILED_LOGON - Someone tried and failed to log on
4. EVENT_TYPE_MEETING - A meeting

Location Type

1. LOCATION_TYPE_NETWORK_CONNECTION - When we know the location of a network that a user connected to.
2. LOCATION_TYPE_ALPINEQUEST_STARTING_POINT - AlpineQuest Starting Point.

Message Type

1. MESSAGE_TYPE_LYNC - A Lync message