Next Release

This is a place holder for what is being put into the next release of Truxton.

Truxton Next

<< Released 2025-?

Improvements

• Use PostgreSQL 18.4
• Updated to SQLite 3.53.4
• Updated default hashset to Truxton20251201.hashset with 251,384,600 hashes.
• New globaldedupe option causes only unique files to be stored in depots. Loads will slow but file contents will not be duplicated anywhere. You save storage at the cost of load speed.
• We now scan text for Bitcoin accounts and seed phrases
• Improved the quality of parsing Cellebrite reports to clean up deleted entries and pull more contact information.
• First BETA release of eDiscovery load
• We now exploit Twitter direct messages as chat.
• Improved protocol buffer expansion. Added support for Unix microsecond timestamps.
• Easy Button loads will now process backup.z01 and TAR files.
• Firefox cookies are now exploited
• Better handling of SQLite files with custom collations.
• Better exploitation of Android WiFi Configuration files.
• Better exploitation of Chrome Web Data.
• New C API's
  • truxton_media_set_calculated_size
  • truxton_set_artifact_type_color
  • truxton_set_event_type_color
  • truxton_set_file_type_color
  • truxton_set_investigation_status_color
  • truxton_set_investigation_type_color
  • truxton_set_location_type_color
  • truxton_set_message_type_color
  • truxton_set_review_status_color
  • truxton_set_review_type_color
  • truxton_set_url_type_color
• New Python APIs to set colors of things.
• Binary JSON files are now converted to ASCII JSON.

Bug Fixes

• Consolidated contacts reports where phone numbers showed up as email addresses.
• The loader now processes APFS filesystems correctly.
• The enumeration API wasn't scoping media and investigation enumeration.
• KTX conversion now handles uncompressed payloads.
• Parquet files were not being identified.
• Truxton.ETL assembly was not sourcing relationships properly.
• Fixed a bug in the C API that caused Notes to not be associated with contacts.
• Notes now appear in the Consolidated Contact reports.
• Added missing EVENT_TYPE constants to Python.
• Consolidated Contacts now does a better job of consolidating contacts.
• Valid file details are now produced from DPAPI blobs that don't start at the beginning of a file.
• Duplicate entries were showing up in the Visual Media display when Unique was specified.

New Types

File

1. Type_EBTS - Electronic Biometric Transmission Specification (fingerprints, biometric information, etc.)
2. Type_OBB - Android opaque binary blobs
3. Type_Volley_Cache - Android library for applications to cache web data
4. Type_Glide_Disk_Cache - Something really similar to Volley cache
5. Type_Wwise_SoundBank - A bundle of sounds for an application
6. Type_Roblox_Cache - Cache used by Roblox application
7. Type_Android_Binary_XML - Yet another XML compression scheme (different from the other Android Binary XML format)
8. Type_Apple_Spotlight_String_Map - String maps used by Apple's Spotlight system
9. Type_Visio - Visio drawings
10. Type_Envelope_Index - Apple Envelope Index SQLite database
11. Type_XAR - Extensible Archive
12. Type_Apple_Logdata_Statistics - Apple Logdata Statistics
13. Type_Apple_Shutdown_Log - Apple shutdown log
14. Type_WiFi_Network_Store_Model - Apple WiFi Network Store database
15. Type_Notepad_Tabstate - Microsoft Notepad Tab State
16. Type_Android_Snapchat_Core - Android Snapchat Core
17. Type_Android_Snapchat_Main - Android Snapchat Main
18. Type_Android_WiFi_Config_Store - Android WiFi Configuration Store
19. Type_Android_Bluetooth_Share_Database - Android Bluetooth File Sharing Database
20. Type_Samsung_Smart_Tethering - Samsung Smart Tethering Database
21. Type_Android_WiFi_QTables - Android WiFI Q Tables
22. Type_Samsung_Q_Image - Samsung image format used during boot and shutdown
23. Type_eDiscovery_Concordance - A concordance file from an eDiscovery dump
24. Type_Notepad_Plus_Plus_Session - Notepad++ session information
25. Type_ProcMon_Log - ProcMon tracing logs
26. Type_IDA_Type_Library - IDA Pro Disassembler Type Information Library
27. Type_Firefox_Key_Database - Firefox Key Database
28. Type_Firefox_Web_App_Store - Firefox Web App Storage
29. Type_Firefox_Favicons - Firefox Web Page Icons
30. Type_Firefox_Cache - Firefox Cache
31. Type_Firefox_Storage - Firefox Website Storage
32. Type_Firefox_Object_Data - Firefox Object Data
33. Type_Firefox_Object_Key - Firefox Object Key
34. Type_Apple_Resource - Apple Double Resource
35. Type_Bink_Video - Bink Video
36. Type_BSON - Binary JSON
37. Type_DirectX_Object - DirectX Object File (XOF)
38. Type_Apple_Aggregated_Preferences - Yet another Plist
39. Type_Kaspersky_Virus_Definitions - Kaspersky definitions
40. Type_Koan_Pro_Composition - Koan Pro Composition
41. Type_Photoshop_Action - Photoshop action
42. Type_Intel_Hex - Firmware programming file
43. Type_iOS_Processing_Pipeline - iOS PencilKit pipeline
44. Type_iOS_Keyboard_Image - iOS Keyboard
45. Type_iOS_Locationsd_Tiles - Locationds Tiles
46. Type_iOS_Voice_Services_Cache - iOS Voice Services Cache
47. Type_iOS_Shortcut_Plist - iOS Shortcuts
48. Type_Novalogic_Archive - Resources for Novalogic games
49. Type_DrWatson_Log - Dr Watson Crash Log
50. Type_MMedia_Archive - MMedia Archive of game resources
51. Type_PSpice - PSpice Circuit Emulation
52. Type_Supercell_Asset - Supercell game resources
53. Type_Unity_Shader_Cache_Compressed - Compressed Unity game ending shader cache
54. Type_Core_Animation_Markup_Language - Core Animation Markup Language
55. Type_Apple_Code_Directory - Apple Code Directory
56. Type_Apple_Multi_Archive - Apple Multi Archive
57. Type_Apple_Object_Model - Apple Core Object Model
58. Type_OpenGL_Shader_Cache - OpenGL Shader Cache
59. Type_Verizon_Messages_Config - Verizon Messages Configuration
60. Type_Google_DocList_Database - Google DocList Database
61. Type_GGUF - GPT-Generated Unified Format
62. Type_ACMI - Tacview Air Combat Maneuvering Instrumentation
63. Type_State_Repository_Data - Microsoft Application State Repository Data
64. Type_Photo_Adjustment - Apple Photo Mutation Adjustment
65. Type_TikTok_Database - TikTok Database
66. Type_Apple_Wallet_Transactions - Apple Wallet Transactions Database
67. Type_TikTok_Search_History - TikTok Search History
68. Type_Suggestion_Entities - Apple Suggestion Entities
69. Type_Prebuilt_Set - Apple Dynamic Prebuilt Set
70. Type_CloudKit_Reference_Data - CloudKit Reference Data
71. Type_Android_Resource_ID_Mapping - Android Resource ID Mapping

Entity Types

1. ENTITY_TYPE_BITCOIN - A bitcoin account
2. ENTITY_TYPE_BITCOIN_SEED - A bitcoin seed phrase
3. ENTITY_TYPE_GOOGLE_ANALYTICS_ID - A Google analytics ID
4. ENTITY_TYPE_TIKTOK_ACCOUNT_ID - A TikTok account ID
5. ENTITY_TYPE_GDID - Windows Global Device ID
6. ENTITY_TYPE_PUID - Windows Account Passport Unique ID
7. ENTITY_TYPE_CID - Microsoft Consumer ID
8. ENTITY_TYPE_MUID - Microsoft User ID

Event Types

1. EVENT_TYPE_COOKIE_CREATED - A browser cookie was created.
2. EVENT_TYPE_COOKIE_USED - A browser cookie was used.
3. EVENT_TYPE_FILE_TRANSFER - A file was transferred.

URL Types

1. URL_TYPE_VOLLEY_CACHE - A URL used by Android's Volley caching system to retrieve a file from the internet
2. URL_TYPE_APPLICATION - A URL used by an application to retrieve a file from the internet