Difference between revisions of "Expand"
Jump to navigation
Jump to search
| (5 intermediate revisions by the same user not shown) | |||
| Line 1,079: | Line 1,079: | ||
| Files, [[Type_File_Details|File Details]] | | Files, [[Type_File_Details|File Details]] | ||
|- | |- | ||
| − | | [[ | + | | [[Type_CPHD]] |
| − | | | + | | Tags |
|- | |- | ||
| − | | [[ | + | | [[Type_AirTag_Data]] |
| − | | | + | | [[Entity Table|Artifacts]], [[Location Table|Locations]] |
| + | |- | ||
| + | | [[Type_Apple_SEGB]] | ||
| + | | Files | ||
|- | |- | ||
| [[Type_Android_Call_Log_Backup]] | | [[Type_Android_Call_Log_Backup]] | ||
| Line 1,090: | Line 1,093: | ||
| [[Type_Protocol_Buffer_Archive]] | | [[Type_Protocol_Buffer_Archive]] | ||
| Files | | Files | ||
| + | |- | ||
| + | | [[Type_Olympus_Raw_Image]] | ||
| + | | [[Entity Table|Artifacts]], [[EXIF Table|EXIF]], [[Type_File_Details|File Details]] | ||
| + | |- | ||
| + | | [[Type_Fuji_Raw_Image]] | ||
| + | | [[Entity Table|Artifacts]], [[EXIF Table|EXIF]], [[Type_File_Details|File Details]] | ||
|- | |- | ||
| [[Type_Discord_User_Information]] | | [[Type_Discord_User_Information]] | ||
| Line 1,099: | Line 1,108: | ||
| [[Type_Samsung_CMH]] | | [[Type_Samsung_CMH]] | ||
| [[Type_File_Details|File Details]], [[Location Table|Locations]] | | [[Type_File_Details|File Details]], [[Location Table|Locations]] | ||
| + | |- | ||
| + | | [[Type_Gemini_Activity]] | ||
| + | | [[Entity Table|Artifacts]], [[Event Table|Events]] | ||
| + | |- | ||
| + | | [[Type_Volley_Cache]] | ||
| + | | Files, [[WebsiteVisit Table|URLs]] | ||
| + | |- | ||
| + | | [[Type_Glide_Disk_Cache]] | ||
| + | | Files, [[WebsiteVisit Table|URLs]] | ||
| + | |- | ||
| + | | [[Type_Android_Binary_XML]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Envelope_Index]] | ||
| + | | Files | ||
| + | |- | ||
| + | | [[Type_Apple_Shutdown_Log]] | ||
| + | | [[Event Table|Events]] | ||
|} | |} | ||
Latest revision as of 15:00, 29 June 2025
| Executable | Expand.exe
|
| Stage | 3 |
| Percent Complete | 48% |
| Message Queue | expand
|
Expand is the most capable exploitation process. It produces files and artifacts.
Capabilities
File Types
Expand processes the following types of files.
Event Log Records
Expand processes the following event log record numbers
