Difference between revisions of "Expand"

From truxwiki.com
Jump to navigation Jump to search
 
(36 intermediate revisions by the same user not shown)
Line 11: Line 11:
 
|-
 
|-
 
| Message Queue
 
| Message Queue
−
| <code>expand</code>
+
| style="text-align:center;" | <code>expand</code>
 
|}
 
|}
  
Line 766: Line 766:
 
| [[Type_DBeaver_Settings]]
 
| [[Type_DBeaver_Settings]]
 
| [[Entity Table|Artifacts]]
 
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Encrypted_Expert_Witness]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Office_Telemetry_User]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Office_Telemetry_Solution]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Office_Telemetry_Event]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_NTFS_USN_Change_Journal]]
 +
| Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Windows_Error_Report]]
 +
| [[Event Table|Events]]
 +
|-
 +
| [[Type_Windows_Activities]]
 +
| [[Event Table|Events]], [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_RDP_Tile_Cache]]
 +
| Files
 +
|-
 +
| [[Type_PCAP]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_MBOX_Mail]]
 +
| Files
 +
|-
 +
| [[Type_PostgreSQL_Binary_Package]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Security_Registry]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_iOS_Backup_Keybag]]
 +
| Files
 +
|-
 +
| [[Type_Movie_Filmroll_File]]
 +
| Files
 +
|-
 +
| [[Type_Restore_Point_Log]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Inno_Uninstall_Log]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Windows_Error_Report_Snapshot]]
 +
| [[Event Table|Events]]
 +
|-
 +
| [[Type_Unity_Asset_Bundle]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Jumplist_Automatic_Destination]]
 +
| [[Event Table|Events]], Files
 +
|-
 +
| [[Type_Git_Blob]]
 +
| Files
 +
|-
 +
| [[Type_Android_Package]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Viber_Data]]
 +
| [[Entity Table|Artifacts]], [[Event Table|Events]]
 +
|-
 +
| [[Type_Viber_Messages]]
 +
| [[Event Table|Events]], [[Type_File_Details|File Details]], [[Location Table|Locations]], Messages
 +
|-
 +
| [[Type_Android_Bug_Report]]
 +
| [[Entity Table|Artifacts]], [[Event Table|Events]]
 +
|-
 +
| [[Type_Snapchat_Preferences]]
 +
| [[Entity Table|Artifacts]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_Kik_Preferences]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Apple_Partition_Map]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Snapchat_Data]]
 +
| [[Entity Table|Artifacts]], [[Type_File_Details|File Details]], Messages
 +
|-
 +
| [[Type_Signal]]
 +
| [[Type_File_Details|File Details]], Messages
 +
|-
 +
| [[Type_Icing_MMS_SMS]]
 +
| [[Type_File_Details|File Details]], Messages
 +
|-
 +
| [[Type_HEIF]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_MPEG4Video_With_DRM]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Firefox_Snappy]]
 +
| Files
 +
|-
 +
| [[Type_Google_Analytics_Cookie]]
 +
| [[WebsiteVisit Table|URLs]]
 +
|-
 +
| [[Type_Extended_Audible_dot_com_Audio]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Chrome_Local_State]]
 +
| Files
 +
|-
 +
| [[Type_Generic_Password_Dump]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Speedtest_Database]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_ProtonMail_Messages]]
 +
| Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Apple_Account_Token]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_IWC_Log]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Flashpoint_Data]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Google_Duo_Database]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Android_Bluetooth_Config]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_Phonebook_Access]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_Common_User_Settings]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_Coffee_Preferences]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_Bluetooth_Volume_Map]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_Bluetooth_Database]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Waze_Database]]
 +
| Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Waze_Log]]
 +
| [[Location Table|Locations]]
 +
|-
 +
| [[Type_Foursquare_Pilgrim]]
 +
| Files, [[Type_File_Details|File Details]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_Android_Network_Policy]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_Power_Off_Log]]
 +
| [[Event Table|Events]]
 +
|-
 +
| [[Type_Windows_Photo_Database]]
 +
| Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Google_Plus_Contacts_Database]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Safari_Browser_State]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]], [[WebsiteVisit Table|URLs]]
 +
|-
 +
| [[Type_Safari_Session_Entry_Data]]
 +
| [[WebsiteVisit Table|URLs]]
 +
|-
 +
| [[Type_Network_Interfaces_PList]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Known_Networks_PList]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Comm_Center_PList]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Snapchat_Config_PList]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_LinkedIn_Messenger_Database]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Apple_Sharing_PList]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Safari_Bookmarks]]
 +
| Files, [[Type_File_Details|File Details]], [[WebsiteVisit Table|URLs]]
 +
|-
 +
| [[Type_Data_Ark_PList]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_iPod_Preferences]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_iOS_Routine_Locations_Database]]
 +
| [[Entity Table|Artifacts]], [[Event Table|Events]], Files, [[Type_File_Details|File Details]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_Protocol_Buffer]]
 +
| [[Type_Protocol_Buffer_XML]]
 +
|-
 +
| [[Type_WhatsApp_Contacts_Database]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_LinkedIn_Imported_Contacts]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_TraceV3_Log]]
 +
|
 +
|-
 +
| [[Type_Berla_CSV]]
 +
| [[Entity Table|Artifacts]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_SubRip_Subtitle]]
 +
| [[Location Table|Locations]]
 +
|-
 +
| [[Type_iOS_Bluetooth_Pairings]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Apple_Advertisers]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Twitter_Message_Store]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Apple_KTX]]
 +
| [[Type_PNG]]
 +
|-
 +
| [[Type_Keychain_Dump]]
 +
|
 +
|-
 +
| [[Type_Android_ID_Settings]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_PCW_Device]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Generic_Log]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_Browser_Bookmarks]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]], [[WebsiteVisit Table|URLs]]
 +
|-
 +
| [[Type_Android_Settings]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Samsung_Notes]]
 +
| Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Android_Access_Point_XML]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_Access_Point_Config]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_LastPass_Database]]
 +
| Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Realm_Database]]
 +
|
 +
|-
 +
| [[Type_Device_Analytics_Database]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_WhatsApp_Crypt14]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Android_Messages]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_NITF]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_KnowledgeC]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Shared_Cache_Strings]]
 +
|
 +
|-
 +
| [[Type_ADF_Properties]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_JSON_Log_Lines]]
 +
|
 +
|-
 +
| [[Type_ADF_Bundle]]
 +
|
 +
|-
 +
| [[Type_ATT_Phone_Backup]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_Embedded_Plist]]
 +
| Files
 +
|-
 +
| [[Type_Core_Location]]
 +
| [[Location Table|Locations]]
 +
|-
 +
| [[Type_Android_Installed_Applications]]
 +
| [[Entity Table|Artifacts]], Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Facebook_Omni_Store]]
 +
| Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Safari_Key_Value_Items]]
 +
| Files, [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_CPHD]]
 +
| Tags
 +
|-
 +
| [[Type_AirTag_Data]]
 +
| [[Entity Table|Artifacts]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_Apple_SEGB]]
 +
| Files
 +
|-
 +
| [[Type_Android_Call_Log_Backup]]
 +
| [[Entity Table|Artifacts]], [[Event Table|Events]]
 +
|-
 +
| [[Type_Protocol_Buffer_Archive]]
 +
| Files
 +
|-
 +
| [[Type_Olympus_Raw_Image]]
 +
| [[Entity Table|Artifacts]], [[EXIF Table|EXIF]], [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Fuji_Raw_Image]]
 +
| [[Entity Table|Artifacts]], [[EXIF Table|EXIF]], [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Discord_User_Information]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_AlpineQuest_Track]]
 +
| [[Location Table|Locations]]
 +
|-
 +
| [[Type_Samsung_CMH]]
 +
| [[Type_File_Details|File Details]], [[Location Table|Locations]]
 +
|-
 +
| [[Type_Gemini_Activity]]
 +
| [[Entity Table|Artifacts]], [[Event Table|Events]]
 +
|-
 +
| [[Type_Volley_Cache]]
 +
| Files, [[WebsiteVisit Table|URLs]]
 +
|-
 +
| [[Type_Glide_Disk_Cache]]
 +
| Files, [[WebsiteVisit Table|URLs]]
 +
|-
 +
| [[Type_Android_Binary_XML]]
 +
| Files
 +
|-
 +
| [[Type_Envelope_Index]]
 +
| Files
 +
|-
 +
| [[Type_Apple_Shutdown_Log]]
 +
| [[Event Table|Events]]
 
|}
 
|}
  
Line 774: Line 1,134:
 
! ID
 
! ID
 
! Description
 
! Description
 +
! Items Produced
 
|-
 
|-
−
| 21 ||
+
| 1 || VHD || [[Event Types|EVENT_TYPE_DISK_MOUNTED]]
−
|-
 
−
| 22 ||
 
−
|-
 
−
| 25 ||
 
−
|-
 
−
| 300 ||
 
−
|-
 
−
| 600 ||
 
 
|-
 
|-
−
| 1001 ||
+
| 2 || VHD || [[Event Types|EVENT_TYPE_DISK_DISMOUNTED]]
 
|-
 
|-
−
| 1002 ||
+
| 22 || RDP Connection || [[Event Types|EVENT_TYPE_RDP_CONNECTION]]
 
|-
 
|-
−
| 1006 ||
+
| 25 || RDP Connection || [[Event Types|EVENT_TYPE_RDP_CONNECTION]]
 
|-
 
|-
−
| 1102 ||
+
| 300 || Word Document Recovery || [[Event Types|EVENT_TYPE_OFFICE_ALERT]]
 
|-
 
|-
−
| 1149 ||
+
| 600 || Powershell Command Line || [[Event Types|EVENT_TYPE_POSSIBLE_INFECTION]]
 
|-
 
|-
−
| 2003 ||
+
| 1001<br />1002 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_USB_DEVICE]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]]<br />[[Event Types|EVENT_TYPE_USB_INSERTED]]
 
|-
 
|-
−
| 2102 ||
+
| 1006 || USB Info || [[Entity Types|ENTITY_TYPE_DISK_SIGNATURE]]<br />[[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_NAME]]<br />[[Entity Types|ENTITY_TYPE_VOLUME_SERIAL_NUMBER]]
 
|-
 
|-
−
| 2104 ||
+
| 1102 || Event Log Cleared|| [[Event Types|EVENT_TYPE_LOG_CLEARED]]
 
|-
 
|-
−
| 4616 ||
+
| 2003 || USB Info || [[Event Types|EVENT_TYPE_USB_INSERTED]]
 
|-
 
|-
−
| 4624 ||
+
| 2102 || USB Info || [[Event Types|EVENT_TYPE_USB_REMOVED]]
 
|-
 
|-
−
| 4663 ||
+
| 2104 || USB Info || [[Entity Types|ENTITY_TYPE_USB_DEVICE]]
 
|-
 
|-
−
| 6100 ||
+
| 4616 || Change System Time || [[Event Types|EVENT_TYPE_TIME_CHANGED]]
 
|-
 
|-
−
| 7045 ||
+
| 4624 || Logon || [[Event Types|EVENT_TYPE_LOGON]]
 
|-
 
|-
−
| 8001 ||
+
| 4625 || Failed Logon || [[Event Types|EVENT_TYPE_FAILED_LOGON]]
 
|-
 
|-
−
| 8003 ||
+
| 4663<br />6100 || WiFi Data || [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]]<br />[[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_HEARD_WIFI]]
 
|-
 
|-
−
| 11001 ||
+
| 4720 || Account Created || [[Event Types|EVENT_TYPE_ACCOUNT_CREATED]]
 
|-
 
|-
−
| 20001 ||
+
| 7045 || Service Installed || [[Event Types|EVENT_TYPE_SERVICE_INSTALLED]]<br />[[Type_Shell_Script]]
 
|-
 
|-
−
| 20003 ||
+
| 8001 || WiFi Data || [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]]<br />[[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]]
 
|-
 
|-
−
| 24576 ||
+
| 8003 || WiFi Data || [[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_DISCONNECTED_FROM_NETWORK]]
 
|-
 
|-
−
| 24577 ||
+
| 11001 || WiFi Data || [[Entity Types|ENTITY_TYPE_MAC_ADDRESS]]<br />[[Entity Types|ENTITY_TYPE_SSID]]
 
|-
 
|-
−
| 24578 ||
+
| 20001<br />20003<br />24576<br />24577 || USB Data || [[Entity Types|ENTITY_TYPE_SERIAL_NUMBER]]<br />[[Event Types|EVENT_TYPE_USB_INSERTED]]
 
|-
 
|-
−
| 50067 ||
+
| 50067 || WiFi Data || [[Entity Types|ENTITY_TYPE_SSID]]<br />[[Event Types|EVENT_TYPE_CONNECTED_TO_NETWORK]]
 
|}
 
|}

Latest revision as of 15:00, 29 June 2025

Details
Executable Expand.exe
Stage 3
Percent Complete 48%
Message Queue expand

Expand is the most capable exploitation process. It produces files and artifacts.

Capabilities

File Types

Expand processes the following types of files.

File Type Produces
Type_Physical_Artifacts Artifacts
Type_ASCII_Text File Details
Type_JPEG Artifacts, File Details
Type_JPEGWithExif Artifacts, EXIF, File Details
Type_GIF File Details
Type_PE File Details
Type_ZIP Files, File Details
Type_32bit_Windows_Executable Files, File Details
Type_64bit_Windows_Executable Files, File Details
Type_ROM_Windows_Executable Files, File Details
Type_Word_2007 Artifacts, File Details
Type_Excel_2007 Artifacts, File Details
Type_PowerPoint_2007 Artifacts, File Details
Type_Microsoft_ESE File Details
Type_MPEG4Video Artifacts, EXIF, File Details, Locations
Type_Adobe_PDF Artifacts
Type_Internet_Explorer_History Artifacts, File Details
Type_SQLite_Database Artifacts, Files, File Details
Type_PNG File Details
Type_Firefox_Form_History Artifacts, File Details
Type_Firefox_Downloads File Details
Type_Firefox_Web_Sites_Visited Artifacts, File Details
Type_Chrome_Archived_History File Details
Type_Chrome_Cookies File Details
Type_Chrome_History Artifacts, File Details
Type_Chrome_History_Index File Details
Type_Chrome_Thumbnails File Details
Type_Chrome_Web_Data File Details
Type_Zip_Fragment Files, File Details
Type_RichText Artifacts, File Details
Type_Java_Archive Files, File Details
Type_XP_Prefetch Artifacts, File Details
Type_Vista7_Prefetch Artifacts, File Details
Type_Binary_PList Files
Type_3GP_Video File Details
Type_BZip_Archive Files
Type_TrueType_Font File Details
Type_OpenType_Font File Details
Type_KMZ File Details
Type_Flash_Cookie File Details
Type_Apple_Addressbook_Thumbnails Files, File Details
Type_iOS_Locations File Details, Locations
Type_ZIP_Code_Database File Details
Type_Bible_Database File Details
Type_ATT_Mark_The_Spot_Database File Details, Locations
Type_Shazam_Database File Details, Locations
Type_Apple_Calendar_Database Events, File Details
Type_Ancestry_Database File Details
Type_iOS_SMS Messages, File Details
Type_iOS_Call_History Events, File Details
Type_Skype_Main Artifacts, Events, File Details
Type_3G2_Video File Details
Type_GZip Files
Type_Bitmap_Image File Details
Type_TIFF EXIF
Type_Cellebrite_1 Artifacts, Events, Locations, Messages
Type_Cellebrite_2 Artifacts, Events, Locations, Messages, URLs
Type_MPEG2Video EXIF
Type_Windows_Registry File Details
Type_SAM_Registry File Details
Type_System_Registry File Details
Type_Boot_Registry File Details
Type_User_Registry File Details
Type_Software_Registry File Details
Type_Vista7_Thumbnail_Cache Files
Type_Microsoft_Cabinet Files
Type_Adobe_Flash_Video_New File Details
Type_Evernote_Database File Details
Type_vCard Artifacts
Type_vCard_Unicode Artifacts
Type_xCard Artifacts
Type_Ogg_Theora File Details
Type_Encrypted_ZIP File Details
Type_Outlook_Personal_Folders File Details
Type_Torrent File Details
Type_Setup_API_Log Artifacts, Events
Type_QuickTime_Container File Details
Type_Digital_Media_Broadcasting File Details
Type_Digital_Media_Protection File Details
Type_Dirac_Video File Details
Type_Digital_Video_Broadcast File Details
Type_JPEG_2000 File Details
Type_AAC_Audio File Details
Type_AAC_Audio_Book File Details
Type_Motion_JPEG File Details
Type_MPEG_21 File Details
Type_MPEG_7 File Details
Type_QuickTime_Video File Details, Locations
Type_QuickTime_Cache File Details
Type_Safari_Cache File Details
Type_XRY_XML_File Artifacts, Events, Locations, Messages, URLs
Type_Apple_Voicemail_Database Artifacts, Events, File Details
Type_Apple_Find_My_iPhone_Database File Details, Locations
Type_Windows_Link Artifacts, File Details, URLs
Type_Precompiled_INF File Details
Type_ELF_Executable File Details
Type_Firefox_Offline_Cache Files, File Details, URLs
Type_Microsoft_DPAPI_Key File Details
Type_Recycle_Bin_INFO2 Events, File Details
Type_Opera_Typed_URL_Cache Events
Type_MIME_Message Files
Type_BluRay_PlayList File Details
Type_NTFS_Log_File File Details
Type_Android_WiFi_Cache Artifacts, Events, Locations
Type_Android_Cell_Tower_Cache Events, Locations
Type_Android_Executable_35 File Details
Type_Android_Executable_36 File Details
Type_Android_Settings_Database File Details
Type_Android_Suggestions_Database Artifacts, Events, File Details
Type_TigerText_Database File Details
Type_Windows_XML_Event_Log Artifacts, Events, Files, Supported Record Numbers
Type_XML_PList Artifacts, Files
Type_Apple_Addressbook Artifacts
Type_ydjp Files
Type_TAR Files
Type_Windows_Hibernation File Details
Type_Kies_Backup_Data Files
Type_Kies_Backed_Up_Items Artifacts, Files, Messages
Type_Kies_Zip Files
Type_WPA_Supplicant_Configuration Artifacts, Locations
Type_Kies_Internal_Blob Files
Type_Kies_Container Files
Type_Kies_Message_Backup Files, Messages
Type_Kies_Contacts_Backup Artifacts, Files, URLs
Type_Google_Search_Results Artifacts
Type_Opera_Browser_Cache Files, URLs
Type_RDP_Configuration_File Artifacts
Type_cpio Files
Type_Facebook_App_Database Artifacts, File Details, Locations
Type_Apple_Mach_O_Executable File Details
Type_Facebook_Contacts_Sync Artifacts, Files, File Details
Type_81_Prefetch Artifacts, File Details
Type_iOS_Routine_Location File Details, Locations
Type_Facebook_Orca_Database Artifacts, File Details, Locations, Messages
Type_Windows_Wireless_LAN_Config Artifacts, Files
Type_Windows_Wifi_AP_Profile Artifacts, Files
Type_HomeGroup_Credential_Cache Artifacts
Type_Unix_Compress Files
Type_Printer_Spool Artifacts, File Details
Type_Jumplist_Custom_Destination Artifacts, File Details, URLs
Type_IE_DOMStore Events
Type_1Password_Encrypted_Entry Events
Type_Firefox_Encrypted_Credentials Events, URLs
Type_Windows_Mini_Dump File Details
Type_Amazon_Music_Player_Database File Details
Type_Mozilla_LZ4_Compressed_Data Files
Type_Master_Boot_Record Artifacts, File Details
Type_Firefox_Cache2_Entry Files, URLs
Type_Apple_Lockdown_Plist Artifacts
Type_Apple_iWork File Details
Type_Limewire_Properties Artifacts, Locations
Type_Apple_Note_Database Events, Files, File Details
Type_ipconfig_Report Artifacts
Type_UUEncoded_Data Files
Type_Base64_Encoded_Data Files
Type_TIFFWithExif Artifacts, EXIF
Type_Firefox_Signons Events, File Details, URLs
Type_Firefox_Cookies File Details
Type_Services_Plist Artifacts
Type_Cryptnet_Cache_Entry File Details, URLs
Type_Media_Monkey_Database File Details
Type_Local_Storage File Details
Type_iTag_Database File Details
Type_Firefox_Health_Report File Details
Type_Dropbox_Aggregation File Details
Type_Github_API_Cache File Details
Type_Firefox_DOM_Storage File Details
Type_Android_Manifest_Binary_XML Files
Type_Empty_SQLite File Details
Type_Empty_SQLite_With_Freespace File Details
Type_Apple_Advertising File Details
Type_Apple_Downloads File Details
Type_Firefox_Cache2_Entry_URL URLs
Type_NTFS_Boot Artifacts
Type_iOS_Accounts3 Artifacts, File Details
Type_Safari_History File Details, URLs
Type_Chrome_Resource_Package File Details
Type_Cisco_AnyConnect_Preferences Artifacts
Type_vCard_Cache Artifacts
Type_ZLib Files
Type_QuickTime_Image Files
Type_Open_Package File Details
Type_Kies_Backup_History Artifacts
Type_SQLite_with_WAL File Details
Type_iOS_Diagnostic_Log Artifacts
Type_Compressed_Prefetch Files
Type_10_Prefetch Artifacts, File Details
Type_VMWare_Disk File Details
Type_PAX_Archive Files
Type_Internet_Explorer_Cookie File Details, URLs
Type_Facebook_Friends Artifacts, File Details
Type_Google_Photos File Details, Locations
Type_GUID_Partition_Table File Details
Type_Steam_User_Local_Config Artifacts
Type_Truevision_TGA_Image File Details
Type_GoPro_Version Artifacts
Type_Android_Gallery_Image_Cache Files
Type_BIF File Details
Type_NEF Artifacts, EXIF
Type_Android_Thumbnail_Cache Files
Type_Android_MMS_SMS_Database Files, Messages, File Details
Type_Android_Messages Artifacts, Files, Messages, File Details
Type_Berkeley_Database File Details
Type_Google_Quick_Search Artifacts
Type_Android_Call_Log Artifacts, Events, File Details
Type_iPhoto_Faces Artifacts, File Details
Type_SRUM_Database File Details
Type_Samsung_Thumbnail Files
Type_DJI_DAT_Flight_Log Artifacts, Files, Locations
Type_Recycle_Bin_I Events, File Details
Type_Apple_SINF Artifacts
Type_ETC_Password Artifacts
Type_Password_Shadow Artifacts
Type_Outlook_14_Mac_Message Files
Type_Android_Calendar_Database Artifacts, File Details
Type_Verizon_FIOS_Database Artifacts, File Details
Type_QNAP_Photo_Database Artifacts, Events, File Details
Type_Android_Contacts_Database Artifacts, Events, File Details
Type_PGP_Private_Key Artifacts, Events, File Details
Type_PGP_Public_Key Artifacts, Events, File Details
Type_Samsung_Motion_Photo_Video Files
Type_GMail_Mailstore_Database Files, File Details
Type_GMail_Webapp_Database Files, File Details
Type_Android_Browser_Database Artifacts, File Details, URLs
Type_QSB_Log Artifacts, Events, File Details
Type_Telephony_Database Artifacts, File Details
Type_GeoPosition_Cache File Details, Locations
Type_Webview_Database Artifacts, File Details, URLs
Type_Twitter_Database Artifacts, File Details, URLs
Type_PGP_Public_Keyring Artifacts, Events, File Details
Type_WhatsApp_Database Artifacts, Files, File Details, Locations, Messages, URLs
Type_iOS_Device_Values Artifacts
Type_Chromium_Disk_Cache Files, URLs
Type_Amcache File Details
Type_SparkPeople Artifacts
Type_Apple_Bluetooth Artifacts, File Details
Type_Pandora_Music Artifacts, File Details
Type_AFLogical_Info Artifacts
Type_Android_Chrome_Cache Artifacts, Events, File Details
Type_Android_Icing_Contacts Artifacts, File Details
Type_Yahoo_Mail_Database Files, File Details
Type_Android_eBook_Database Artifacts, File Details
Type_HTC_EMail Artifacts, Files, File Details
Type_Google_Hangout_Database Artifacts, File Details, Locations, Messages
Type_Android_Credentials_Store Files, File Details
Type_StartUpInfo_Log Events
Type_DBeaver_Settings Artifacts
Type_Encrypted_Expert_Witness File Details
Type_Office_Telemetry_User File Details
Type_Office_Telemetry_Solution File Details
Type_Office_Telemetry_Event File Details
Type_NTFS_USN_Change_Journal Files, File Details
Type_Windows_Error_Report Events
Type_Windows_Activities Events, File Details
Type_RDP_Tile_Cache Files
Type_PCAP File Details
Type_MBOX_Mail Files
Type_PostgreSQL_Binary_Package File Details
Type_Security_Registry File Details
Type_iOS_Backup_Keybag Files
Type_Movie_Filmroll_File Files
Type_Restore_Point_Log File Details
Type_Inno_Uninstall_Log File Details
Type_Windows_Error_Report_Snapshot Events
Type_Unity_Asset_Bundle File Details
Type_Jumplist_Automatic_Destination Events, Files
Type_Git_Blob Files
Type_Android_Package File Details
Type_Viber_Data Artifacts, Events
Type_Viber_Messages Events, File Details, Locations, Messages
Type_Android_Bug_Report Artifacts, Events
Type_Snapchat_Preferences Artifacts, Locations
Type_Kik_Preferences Artifacts
Type_Apple_Partition_Map File Details
Type_Snapchat_Data Artifacts, File Details, Messages
Type_Signal File Details, Messages
Type_Icing_MMS_SMS File Details, Messages
Type_HEIF File Details
Type_MPEG4Video_With_DRM File Details
Type_Firefox_Snappy Files
Type_Google_Analytics_Cookie URLs
Type_Extended_Audible_dot_com_Audio File Details
Type_Chrome_Local_State Files
Type_Generic_Password_Dump Artifacts
Type_Speedtest_Database Artifacts, Files, File Details, Locations
Type_ProtonMail_Messages Files, File Details
Type_Apple_Account_Token Artifacts
Type_Android_IWC_Log Artifacts
Type_Flashpoint_Data Artifacts
Type_Google_Duo_Database Artifacts, Files, File Details
Type_Android_Bluetooth_Config Artifacts
Type_Android_Phonebook_Access Artifacts
Type_Android_Common_User_Settings Artifacts
Type_Android_Coffee_Preferences Artifacts
Type_Android_Bluetooth_Volume_Map Artifacts
Type_Android_Bluetooth_Database Artifacts, Files, File Details
Type_Waze_Database Files, File Details
Type_Waze_Log Locations
Type_Foursquare_Pilgrim Files, File Details, Locations
Type_Android_Network_Policy Artifacts
Type_Android_Power_Off_Log Events
Type_Windows_Photo_Database Files, File Details
Type_Google_Plus_Contacts_Database Artifacts, Files, File Details
Type_Safari_Browser_State Artifacts, Files, File Details, URLs
Type_Safari_Session_Entry_Data URLs
Type_Network_Interfaces_PList Artifacts
Type_Known_Networks_PList Artifacts
Type_Comm_Center_PList Artifacts
Type_Snapchat_Config_PList Artifacts
Type_LinkedIn_Messenger_Database Artifacts, Files, File Details
Type_Apple_Sharing_PList Artifacts
Type_Safari_Bookmarks Files, File Details, URLs
Type_Data_Ark_PList Artifacts
Type_iPod_Preferences Artifacts
Type_iOS_Routine_Locations_Database Artifacts, Events, Files, File Details, Locations
Type_Protocol_Buffer Type_Protocol_Buffer_XML
Type_WhatsApp_Contacts_Database Artifacts, Files, File Details, Locations
Type_LinkedIn_Imported_Contacts Artifacts
Type_TraceV3_Log
Type_Berla_CSV Artifacts, Locations
Type_SubRip_Subtitle Locations
Type_iOS_Bluetooth_Pairings Artifacts
Type_Apple_Advertisers Artifacts
Type_Twitter_Message_Store Artifacts
Type_Apple_KTX Type_PNG
Type_Keychain_Dump
Type_Android_ID_Settings Artifacts
Type_Android_PCW_Device Artifacts
Type_Generic_Log Artifacts
Type_Android_Browser_Bookmarks Artifacts, Files, File Details, URLs
Type_Android_Settings Artifacts
Type_Samsung_Notes Files, File Details
Type_Android_Access_Point_XML Artifacts
Type_Android_Access_Point_Config Artifacts
Type_LastPass_Database Files, File Details
Type_Realm_Database
Type_Device_Analytics_Database Artifacts, Files, File Details, Locations
Type_WhatsApp_Crypt14 Artifacts
Type_Android_Messages Artifacts, Files, File Details
Type_NITF Artifacts
Type_KnowledgeC Artifacts, Files, File Details
Type_Shared_Cache_Strings
Type_ADF_Properties Artifacts
Type_JSON_Log_Lines
Type_ADF_Bundle
Type_ATT_Phone_Backup Artifacts
Type_Embedded_Plist Files
Type_Core_Location Locations
Type_Android_Installed_Applications Artifacts, Files, File Details
Type_Facebook_Omni_Store Files, File Details
Type_Safari_Key_Value_Items Files, File Details
Type_CPHD Tags
Type_AirTag_Data Artifacts, Locations
Type_Apple_SEGB Files
Type_Android_Call_Log_Backup Artifacts, Events
Type_Protocol_Buffer_Archive Files
Type_Olympus_Raw_Image Artifacts, EXIF, File Details
Type_Fuji_Raw_Image Artifacts, EXIF, File Details
Type_Discord_User_Information Artifacts
Type_AlpineQuest_Track Locations
Type_Samsung_CMH File Details, Locations
Type_Gemini_Activity Artifacts, Events
Type_Volley_Cache Files, URLs
Type_Glide_Disk_Cache Files, URLs
Type_Android_Binary_XML Files
Type_Envelope_Index Files
Type_Apple_Shutdown_Log Events

Event Log Records

Expand processes the following event log record numbers

ID Description Items Produced
1 VHD EVENT_TYPE_DISK_MOUNTED
2 VHD EVENT_TYPE_DISK_DISMOUNTED
22 RDP Connection EVENT_TYPE_RDP_CONNECTION
25 RDP Connection EVENT_TYPE_RDP_CONNECTION
300 Word Document Recovery EVENT_TYPE_OFFICE_ALERT
600 Powershell Command Line EVENT_TYPE_POSSIBLE_INFECTION
1001
1002		 USB Info ENTITY_TYPE_DISK_SIGNATURE
ENTITY_TYPE_SERIAL_NUMBER
ENTITY_TYPE_USB_DEVICE
ENTITY_TYPE_VOLUME_NAME
ENTITY_TYPE_VOLUME_SERIAL_NUMBER
EVENT_TYPE_USB_INSERTED
1006 USB Info ENTITY_TYPE_DISK_SIGNATURE
ENTITY_TYPE_SERIAL_NUMBER
ENTITY_TYPE_VOLUME_NAME
ENTITY_TYPE_VOLUME_SERIAL_NUMBER
1102 Event Log Cleared EVENT_TYPE_LOG_CLEARED
2003 USB Info EVENT_TYPE_USB_INSERTED
2102 USB Info EVENT_TYPE_USB_REMOVED
2104 USB Info ENTITY_TYPE_USB_DEVICE
4616 Change System Time EVENT_TYPE_TIME_CHANGED
4624 Logon EVENT_TYPE_LOGON
4625 Failed Logon EVENT_TYPE_FAILED_LOGON
4663
6100		 WiFi Data ENTITY_TYPE_MAC_ADDRESS
ENTITY_TYPE_SSID
EVENT_TYPE_HEARD_WIFI
4720 Account Created EVENT_TYPE_ACCOUNT_CREATED
7045 Service Installed EVENT_TYPE_SERVICE_INSTALLED
Type_Shell_Script
8001 WiFi Data ENTITY_TYPE_MAC_ADDRESS
ENTITY_TYPE_SSID
EVENT_TYPE_CONNECTED_TO_NETWORK
8003 WiFi Data ENTITY_TYPE_SSID
EVENT_TYPE_DISCONNECTED_FROM_NETWORK
11001 WiFi Data ENTITY_TYPE_MAC_ADDRESS
ENTITY_TYPE_SSID
20001
20003
24576
24577		 USB Data ENTITY_TYPE_SERIAL_NUMBER
EVENT_TYPE_USB_INSERTED
50067 WiFi Data ENTITY_TYPE_SSID
EVENT_TYPE_CONNECTED_TO_NETWORK
Retrieved from "https://truxwiki.com/index.php?title=Expand&oldid=10327"