Difference between revisions of "Exploitation Layer"
Jump to navigation
Jump to search
| (8 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
The Exploitation Layer is the collection of processes on the [[Message Bus]] that exploit data in Truxton. | The Exploitation Layer is the collection of processes on the [[Message Bus]] that exploit data in Truxton. | ||
| + | These are separate processes (or groups of processes) that operate on a single file at a time that [[Load]] extracted from the media. | ||
| + | Each of the processes have a [[ETL Stages|stage]] associated with it that allows its execution to be coordinated. | ||
=Description= | =Description= | ||
| − | The exploitation layer is typically controlled by the [[Truxton Service]]. | + | The exploitation layer is typically controlled by the [[Truxton Service]] and is configurable through the <code>[[TruxtonService.xml]]</code> file. |
| + | If an ETL process dies, it will be restarted by the [[Truxton Service]]. | ||
| + | These processes run in the background and only wake up when a message arrives on their message queue. | ||
| + | When a message arrives, the process performs the given task and waits for the next message. | ||
=Default Exploiters= | =Default Exploiters= | ||
| + | Truxton ships with the following members of the ETL layer. | ||
| + | |||
{| class="wikitable" | {| class="wikitable" | ||
! Name | ! Name | ||
| Line 11: | Line 18: | ||
| [[Load]] | | [[Load]] | ||
| The loader of data | | The loader of data | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
|- | |- | ||
| [[Alert]] | | [[Alert]] | ||
| Line 36: | Line 34: | ||
| For parsing EMail | | For parsing EMail | ||
|- | |- | ||
| − | | [[ | + | | [[Expand]] |
| − | | | + | | Extracting information from files |
|- | |- | ||
| [[Finished]] | | [[Finished]] | ||
| Line 44: | Line 42: | ||
| [[Identify]] | | [[Identify]] | ||
| For identifying files based on their content | | For identifying files based on their content | ||
| + | |- | ||
| + | | [[LangID]] | ||
| + | | Determines the language of text (Spanish, Chinese, etc) | ||
| + | |- | ||
| + | | [[Maintenance]] | ||
| + | | Performs non-forensic tasks such as deleting depots | ||
| + | |- | ||
| + | | [[Notify]] | ||
| + | | For notifying interested parties | ||
|- | |- | ||
| [[Poly]] | | [[Poly]] | ||
| Line 50: | Line 57: | ||
| [[Registry]] | | [[Registry]] | ||
| Truxton's Regsitry exploitation | | Truxton's Regsitry exploitation | ||
| + | |- | ||
| + | | [[RegRipper]] | ||
| + | | For processing Windows Registry files | ||
|- | |- | ||
| [[RemoteFileExpander]] | | [[RemoteFileExpander]] | ||
| Using proprietary technology to expand files | | Using proprietary technology to expand files | ||
| + | |- | ||
| + | | [[Report]] | ||
| + | | For preparing reports from raw data | ||
| + | |- | ||
| + | | [[Stitch]] | ||
| + | | For fragmented file carving | ||
| + | |- | ||
| + | | [[TextExtract]] | ||
| + | | Extracts text from files | ||
|- | |- | ||
| [[Thumbnail]] | | [[Thumbnail]] | ||
Latest revision as of 10:47, 30 January 2026
The Exploitation Layer is the collection of processes on the Message Bus that exploit data in Truxton. These are separate processes (or groups of processes) that operate on a single file at a time that Load extracted from the media. Each of the processes have a stage associated with it that allows its execution to be coordinated.
Description
The exploitation layer is typically controlled by the Truxton Service and is configurable through the TruxtonService.xml file.
If an ETL process dies, it will be restarted by the Truxton Service.
These processes run in the background and only wake up when a message arrives on their message queue.
When a message arrives, the process performs the given task and waits for the next message.
Default Exploiters
Truxton ships with the following members of the ETL layer.
| Name | Description |
|---|---|
| Load | The loader of data |
| Alert | For generating alerts |
| Archives | Expanding some archive files |
| Carve | Finding files in freespace |
| ContactSheet | Creating video thumbnails |
| For parsing EMail | |
| Expand | Extracting information from files |
| Finished | For tidying things up at the end of a load |
| Identify | For identifying files based on their content |
| LangID | Determines the language of text (Spanish, Chinese, etc) |
| Maintenance | Performs non-forensic tasks such as deleting depots |
| Notify | For notifying interested parties |
| Poly | For expanding multi-part files |
| Registry | Truxton's Regsitry exploitation |
| RegRipper | For processing Windows Registry files |
| RemoteFileExpander | Using proprietary technology to expand files |
| Report | For preparing reports from raw data |
| Stitch | For fragmented file carving |
| TextExtract | Extracts text from files |
| Thumbnail | Create thumbnails of images |
| Yara | For scanning file contents and tagging |
