Difference between revisions of "Next Release"

From truxwiki.com
Jump to navigation Jump to search
 
(33 intermediate revisions by the same user not shown)
Line 5: Line 5:
  
 
==Improvements==
 
==Improvements==
 +
* Use PostgreSQL 18.4
 +
* Updated to SQLite 3.53.4
 +
* Updated default hashset to <code>Truxton20251201.hashset</code> with 251,384,600 hashes.
 +
* New <code>globaldedupe</code> [[Default ETL Options|option]] causes only unique files to be stored in depots. Loads will slow but file contents will not be duplicated anywhere. You save storage at the cost of load speed.
 +
* We now scan text for Bitcoin accounts and seed phrases
 
* Improved the quality of parsing [[Type_Cellebrite_2|Cellebrite reports]] to clean up deleted entries and pull more contact information.
 
* Improved the quality of parsing [[Type_Cellebrite_2|Cellebrite reports]] to clean up deleted entries and pull more contact information.
 +
* First BETA release of [[EDiscovery_Load|eDiscovery load]]
 
* We now exploit [[Type_Twitter_Database|Twitter direct messages]] as chat.
 
* We now exploit [[Type_Twitter_Database|Twitter direct messages]] as chat.
 
* Improved [[Type_Protocol_Buffer|protocol buffer]] expansion. Added support for Unix microsecond timestamps.
 
* Improved [[Type_Protocol_Buffer|protocol buffer]] expansion. Added support for Unix microsecond timestamps.
Line 13: Line 19:
 
* Better exploitation of [[Type_Android_Access_Point_XML|Android WiFi Configuration]] files.
 
* Better exploitation of [[Type_Android_Access_Point_XML|Android WiFi Configuration]] files.
 
* Better exploitation of [[Type_Chrome_Web_Data|Chrome Web Data]].
 
* Better exploitation of [[Type_Chrome_Web_Data|Chrome Web Data]].
 +
* New C API's
 +
** <code>[[truxton_media_set_calculated_size]]</code>
 +
** <code>[[truxton_set_artifact_type_color]]</code>
 +
** <code>[[truxton_set_event_type_color]]</code>
 +
** <code>[[truxton_set_file_type_color]]</code>
 +
** <code>[[truxton_set_investigation_status_color]]</code>
 +
** <code>[[truxton_set_investigation_type_color]]</code>
 +
** <code>[[truxton_set_location_type_color]]</code>
 +
** <code>[[truxton_set_message_type_color]]</code>
 +
** <code>[[truxton_set_review_status_color]]</code>
 +
** <code>[[truxton_set_review_type_color]]</code>
 +
** <code>[[truxton_set_url_type_color]]</code>
 +
* New Python APIs to set colors of things.
 +
* [[Type_BSON|Binary JSON]] files are now converted to ASCII JSON.
  
 
===Bug Fixes===
 
===Bug Fixes===
 
* Consolidated contacts reports where phone numbers showed up as email addresses.
 
* Consolidated contacts reports where phone numbers showed up as email addresses.
−
* The loader now processes APFS filesystems correctly
+
* The loader now processes APFS filesystems correctly.
 
* The [[Truxton_C_API#Enumeration|enumeration API]] wasn't scoping media and investigation enumeration.
 
* The [[Truxton_C_API#Enumeration|enumeration API]] wasn't scoping media and investigation enumeration.
−
* [[Type_Apple_KTX|KTX]] conversion now handle uncompressed payloads.
+
* [[Type_Apple_KTX|KTX]] conversion now handles uncompressed payloads.
 
* [[Type_Parquet|Parquet]] files were not being identified.
 
* [[Type_Parquet|Parquet]] files were not being identified.
−
* <code>Truxton.ETL</code> assembly was not sourcing relationships properly
+
* <code>Truxton.ETL</code> assembly was not sourcing relationships properly.
 +
* Fixed a bug in the C API that caused Notes to not be associated with contacts.
 +
* Notes now appear in the Consolidated Contact reports.
 +
* Added missing EVENT_TYPE constants to Python.
 +
* Consolidated Contacts now does a better job of consolidating contacts.
 +
* Valid file details are now produced from DPAPI blobs that don't start at the beginning of a file.
 +
* Duplicate entries were showing up in the Visual Media display when Unique was specified.
  
 
==New Types==
 
==New Types==
Line 45: Line 71:
 
# [[Type_Samsung_Smart_Tethering]] - Samsung Smart Tethering Database
 
# [[Type_Samsung_Smart_Tethering]] - Samsung Smart Tethering Database
 
# [[Type_Android_WiFi_QTables]] - Android WiFI Q Tables
 
# [[Type_Android_WiFi_QTables]] - Android WiFI Q Tables
 +
# [[Type_Samsung_Q_Image]] - Samsung image format used during boot and shutdown
 +
# [[Type_eDiscovery_Concordance]] - A concordance file from an eDiscovery dump
 +
# [[Type_Notepad_Plus_Plus_Session]] - Notepad++ session information
 +
# [[Type_ProcMon_Log]] - ProcMon tracing logs
 +
# [[Type_IDA_Type_Library]] - IDA Pro Disassembler Type Information Library
 +
# [[Type_Firefox_Key_Database]] - Firefox Key Database
 +
# [[Type_Firefox_Web_App_Store]] - Firefox Web App Storage
 +
# [[Type_Firefox_Favicons]] - Firefox Web Page Icons
 +
# [[Type_Firefox_Cache]] - Firefox Cache
 +
# [[Type_Firefox_Storage]] - Firefox Website Storage
 +
# [[Type_Firefox_Object_Data]] - Firefox Object Data
 +
# [[Type_Firefox_Object_Key]] - Firefox Object Key
 +
# [[Type_Apple_Resource]] - Apple Double Resource
 +
# [[Type_Bink_Video]] - Bink Video
 +
# [[Type_BSON]] - Binary JSON
 +
# [[Type_DirectX_Object]] - DirectX Object File (XOF)
 +
# [[Type_Apple_Aggregated_Preferences]] - Yet another Plist
 +
# [[Type_Kaspersky_Virus_Definitions]] - Kaspersky definitions
 +
# [[Type_Koan_Pro_Composition]] - Koan Pro Composition
 +
# [[Type_Photoshop_Action]] - Photoshop action
 +
# [[Type_Intel_Hex]] - Firmware programming file
 +
# [[Type_iOS_Processing_Pipeline]] - iOS PencilKit pipeline
 +
# [[Type_iOS_Keyboard_Image]] - iOS Keyboard
 +
# [[Type_iOS_Locationsd_Tiles]] - Locationds Tiles
 +
# [[Type_iOS_Voice_Services_Cache]] - iOS Voice Services Cache
 +
# [[Type_iOS_Shortcut_Plist]] - iOS Shortcuts
 +
# [[Type_Novalogic_Archive]] - Resources for Novalogic games
 +
# [[Type_DrWatson_Log]] - Dr Watson Crash Log
 +
# [[Type_MMedia_Archive]] - MMedia Archive of game resources
 +
# [[Type_PSpice]] - PSpice Circuit Emulation
 +
# [[Type_Supercell_Asset]] - Supercell game resources
 +
# [[Type_Unity_Shader_Cache_Compressed]] - Compressed Unity game ending shader cache
 +
# [[Type_Core_Animation_Markup_Language]] - Core Animation Markup Language
 +
# [[Type_Apple_Code_Directory]] - Apple Code Directory
 +
# [[Type_Apple_Multi_Archive]] - Apple Multi Archive
 +
# [[Type_Apple_Object_Model]] - Apple Core Object Model
 +
# [[Type_OpenGL_Shader_Cache]] - OpenGL Shader Cache
 +
# [[Type_Verizon_Messages_Config]] - Verizon Messages Configuration
 +
# [[Type_Google_DocList_Database]] - Google DocList Database
 +
# [[Type_GGUF]] - GPT-Generated Unified Format
 +
# [[Type_ACMI]] - Tacview Air Combat Maneuvering Instrumentation
 +
# [[Type_State_Repository_Data]] - Microsoft Application State Repository Data
 +
# [[Type_Photo_Adjustment]] - Apple Photo Mutation Adjustment
 +
# [[Type_TikTok_Database]] - TikTok Database
 +
# [[Type_Apple_Wallet_Transactions]] - Apple Wallet Transactions Database
 +
# [[Type_TikTok_Search_History]] - TikTok Search History
 +
# [[Type_Suggestion_Entities]] - Apple Suggestion Entities
 +
# [[Type_Prebuilt_Set]] - Apple Dynamic Prebuilt Set
 +
# [[Type_CloudKit_Reference_Data]] - CloudKit Reference Data
 +
# [[Type_Android_Resource_ID_Mapping]] - Android Resource ID Mapping
  
 
===Entity Types===
 
===Entity Types===
 +
# [[Entity Types|ENTITY_TYPE_BITCOIN]] - A bitcoin account
 +
# [[Entity Types|ENTITY_TYPE_BITCOIN_SEED]] - A bitcoin seed phrase
 +
# [[Entity Types|ENTITY_TYPE_GOOGLE_ANALYTICS_ID]] - A Google analytics ID
 +
# [[Entity Types|ENTITY_TYPE_TIKTOK_ACCOUNT_ID]] - A TikTok account ID
 +
# [[Entity Types|ENTITY_TYPE_GDID]] - Windows Global Device ID
 +
# [[Entity Types|ENTITY_TYPE_PUID]] - Windows Account Passport Unique ID
 +
# [[Entity Types|ENTITY_TYPE_CID]] - Microsoft Consumer ID
 +
# [[Entity Types|ENTITY_TYPE_MUID]] - Microsoft User ID
  
 
===Event Types===
 
===Event Types===

Latest revision as of 03:56, 25 July 2026

This is a place holder for what is being put into the next release of Truxton.

Truxton Next

<< Released 2025-?

Improvements

Bug Fixes

  • Consolidated contacts reports where phone numbers showed up as email addresses.
  • The loader now processes APFS filesystems correctly.
  • The enumeration API wasn't scoping media and investigation enumeration.
  • KTX conversion now handles uncompressed payloads.
  • Parquet files were not being identified.
  • Truxton.ETL assembly was not sourcing relationships properly.
  • Fixed a bug in the C API that caused Notes to not be associated with contacts.
  • Notes now appear in the Consolidated Contact reports.
  • Added missing EVENT_TYPE constants to Python.
  • Consolidated Contacts now does a better job of consolidating contacts.
  • Valid file details are now produced from DPAPI blobs that don't start at the beginning of a file.
  • Duplicate entries were showing up in the Visual Media display when Unique was specified.

New Types

File

  1. Type_EBTS - Electronic Biometric Transmission Specification (fingerprints, biometric information, etc.)
  2. Type_OBB - Android opaque binary blobs
  3. Type_Volley_Cache - Android library for applications to cache web data
  4. Type_Glide_Disk_Cache - Something really similar to Volley cache
  5. Type_Wwise_SoundBank - A bundle of sounds for an application
  6. Type_Roblox_Cache - Cache used by Roblox application
  7. Type_Android_Binary_XML - Yet another XML compression scheme (different from the other Android Binary XML format)
  8. Type_Apple_Spotlight_String_Map - String maps used by Apple's Spotlight system
  9. Type_Visio - Visio drawings
  10. Type_Envelope_Index - Apple Envelope Index SQLite database
  11. Type_XAR - Extensible Archive
  12. Type_Apple_Logdata_Statistics - Apple Logdata Statistics
  13. Type_Apple_Shutdown_Log - Apple shutdown log
  14. Type_WiFi_Network_Store_Model - Apple WiFi Network Store database
  15. Type_Notepad_Tabstate - Microsoft Notepad Tab State
  16. Type_Android_Snapchat_Core - Android Snapchat Core
  17. Type_Android_Snapchat_Main - Android Snapchat Main
  18. Type_Android_WiFi_Config_Store - Android WiFi Configuration Store
  19. Type_Android_Bluetooth_Share_Database - Android Bluetooth File Sharing Database
  20. Type_Samsung_Smart_Tethering - Samsung Smart Tethering Database
  21. Type_Android_WiFi_QTables - Android WiFI Q Tables
  22. Type_Samsung_Q_Image - Samsung image format used during boot and shutdown
  23. Type_eDiscovery_Concordance - A concordance file from an eDiscovery dump
  24. Type_Notepad_Plus_Plus_Session - Notepad++ session information
  25. Type_ProcMon_Log - ProcMon tracing logs
  26. Type_IDA_Type_Library - IDA Pro Disassembler Type Information Library
  27. Type_Firefox_Key_Database - Firefox Key Database
  28. Type_Firefox_Web_App_Store - Firefox Web App Storage
  29. Type_Firefox_Favicons - Firefox Web Page Icons
  30. Type_Firefox_Cache - Firefox Cache
  31. Type_Firefox_Storage - Firefox Website Storage
  32. Type_Firefox_Object_Data - Firefox Object Data
  33. Type_Firefox_Object_Key - Firefox Object Key
  34. Type_Apple_Resource - Apple Double Resource
  35. Type_Bink_Video - Bink Video
  36. Type_BSON - Binary JSON
  37. Type_DirectX_Object - DirectX Object File (XOF)
  38. Type_Apple_Aggregated_Preferences - Yet another Plist
  39. Type_Kaspersky_Virus_Definitions - Kaspersky definitions
  40. Type_Koan_Pro_Composition - Koan Pro Composition
  41. Type_Photoshop_Action - Photoshop action
  42. Type_Intel_Hex - Firmware programming file
  43. Type_iOS_Processing_Pipeline - iOS PencilKit pipeline
  44. Type_iOS_Keyboard_Image - iOS Keyboard
  45. Type_iOS_Locationsd_Tiles - Locationds Tiles
  46. Type_iOS_Voice_Services_Cache - iOS Voice Services Cache
  47. Type_iOS_Shortcut_Plist - iOS Shortcuts
  48. Type_Novalogic_Archive - Resources for Novalogic games
  49. Type_DrWatson_Log - Dr Watson Crash Log
  50. Type_MMedia_Archive - MMedia Archive of game resources
  51. Type_PSpice - PSpice Circuit Emulation
  52. Type_Supercell_Asset - Supercell game resources
  53. Type_Unity_Shader_Cache_Compressed - Compressed Unity game ending shader cache
  54. Type_Core_Animation_Markup_Language - Core Animation Markup Language
  55. Type_Apple_Code_Directory - Apple Code Directory
  56. Type_Apple_Multi_Archive - Apple Multi Archive
  57. Type_Apple_Object_Model - Apple Core Object Model
  58. Type_OpenGL_Shader_Cache - OpenGL Shader Cache
  59. Type_Verizon_Messages_Config - Verizon Messages Configuration
  60. Type_Google_DocList_Database - Google DocList Database
  61. Type_GGUF - GPT-Generated Unified Format
  62. Type_ACMI - Tacview Air Combat Maneuvering Instrumentation
  63. Type_State_Repository_Data - Microsoft Application State Repository Data
  64. Type_Photo_Adjustment - Apple Photo Mutation Adjustment
  65. Type_TikTok_Database - TikTok Database
  66. Type_Apple_Wallet_Transactions - Apple Wallet Transactions Database
  67. Type_TikTok_Search_History - TikTok Search History
  68. Type_Suggestion_Entities - Apple Suggestion Entities
  69. Type_Prebuilt_Set - Apple Dynamic Prebuilt Set
  70. Type_CloudKit_Reference_Data - CloudKit Reference Data
  71. Type_Android_Resource_ID_Mapping - Android Resource ID Mapping

Entity Types

  1. ENTITY_TYPE_BITCOIN - A bitcoin account
  2. ENTITY_TYPE_BITCOIN_SEED - A bitcoin seed phrase
  3. ENTITY_TYPE_GOOGLE_ANALYTICS_ID - A Google analytics ID
  4. ENTITY_TYPE_TIKTOK_ACCOUNT_ID - A TikTok account ID
  5. ENTITY_TYPE_GDID - Windows Global Device ID
  6. ENTITY_TYPE_PUID - Windows Account Passport Unique ID
  7. ENTITY_TYPE_CID - Microsoft Consumer ID
  8. ENTITY_TYPE_MUID - Microsoft User ID

Event Types

  1. EVENT_TYPE_COOKIE_CREATED - A browser cookie was created.
  2. EVENT_TYPE_COOKIE_USED - A browser cookie was used.
  3. EVENT_TYPE_FILE_TRANSFER - A file was transferred.

Location Type

Message Type

URL Types

  1. URL_TYPE_VOLLEY_CACHE - A URL used by Android's Volley caching system to retrieve a file from the internet
  2. URL_TYPE_APPLICATION - A URL used by an application to retrieve a file from the internet
Retrieved from "https://truxwiki.com/index.php?title=Next_Release&oldid=10981"