Difference between revisions of "Expand"

From truxwiki.com
Jump to navigation Jump to search
Line 358: Line 358:
 
| [[Type_Windows_XML_Event_Log]]
 
| [[Type_Windows_XML_Event_Log]]
 
| [[Entity Table|Artifacts]], [[Event Table|Events]], Files, [[#Event Log Records|Supported Record Numbers]]
 
| [[Entity Table|Artifacts]], [[Event Table|Events]], Files, [[#Event Log Records|Supported Record Numbers]]
 +
|-
 +
| [[Type_XML_PList]]
 +
| [[Entity Table|Artifacts]], Files
 +
|-
 +
| [[Type_Apple_Addressbook]]
 +
| [[Entity Table|Artifacts]]
 +
|-
 +
| [[Type_ydjp]]
 +
| Files
 +
|-
 +
| [[Type_TAR]]
 +
| Files
 +
|-
 +
| [[Type_Windows_Hibernation]]
 +
| [[Type_File_Details|File Details]]
 +
|-
 +
| [[Type_Kies_Backup_Data]]
 +
| Files
 +
|-
 +
| [[Type_Kies_Backed_Up_Items]]
 +
| [[Entity Table|Artifacts]], Files, Messages
 
|}
 
|}
  

Revision as of 15:55, 22 July 2020

Details
Executable Expand.exe
Stage 3
Percent Complete 48%
Message Queue expand

Expand is the most capable exploitation process. It produces files and artifacts.

Capabilities

File Types

Expand processes the following types of files.

File Type Produces
Type_Physical_Artifacts Artifacts
Type_ASCII_Text File Details
Type_JPEG Artifacts, File Details
Type_JPEGWithExif Artifacts, EXIF, File Details
Type_GIF File Details
Type_PE File Details
Type_ZIP Files, File Details
Type_32bit_Windows_Executable Files, File Details
Type_64bit_Windows_Executable Files, File Details
Type_ROM_Windows_Executable Files, File Details
Type_Word_2007 Artifacts, File Details
Type_Excel_2007 Artifacts, File Details
Type_PowerPoint_2007 Artifacts, File Details
Type_Microsoft_ESE File Details
Type_MPEG4Video Artifacts, EXIF, File Details, Locations
Type_Adobe_PDF Artifacts
Type_Internet_Explorer_History Artifacts, File Details
Type_SQLite_Database Artifacts, Files, File Details
Type_PNG File Details
Type_Firefox_Form_History Artifacts, File Details
Type_Firefox_Downloads File Details
Type_Firefox_Web_Sites_Visited Artifacts, File Details
Type_Chrome_Archived_History File Details
Type_Chrome_Cookies File Details
Type_Chrome_History Artifacts, File Details
Type_Chrome_History_Index File Details
Type_Chrome_Thumbnails File Details
Type_Chrome_Web_Data File Details
Type_Zip_Fragment Files, File Details
Type_RichText Artifacts, File Details
Type_Java_Archive Files, File Details
Type_XP_Prefetch Artifacts, File Details
Type_Vista7_Prefetch Artifacts, File Details
Type_Binary_PList Files
Type_3GP_Video File Details
Type_BZip_Archive Files
Type_TrueType_Font File Details
Type_OpenType_Font File Details
Type_KMZ File Details
Type_Flash_Cookie File Details
Type_Apple_Addressbook_Thumbnails Files, File Details
Type_iOS_Locations File Details, Locations
Type_ZIP_Code_Database File Details
Type_Bible_Database File Details
Type_ATT_Mark_The_Spot_Database File Details, Locations
Type_Shazam_Database File Details, Locations
Type_Apple_Calendar_Database Events, File Details
Type_Ancestry_Database File Details
Type_iOS_SMS Messages, File Details
Type_iOS_Call_History Events, File Details
Type_Skype_Main Artifacts, Events, File Details
Type_3G2_Video File Details
Type_GZip Files
Type_Bitmap_Image File Details
Type_TIFF EXIF
Type_Cellebrite_1 Artifacts, Events, Locations, Messages
Type_Cellebrite_2 Artifacts, Events, Locations, Messages, URLs
Type_MPEG2Video EXIF
Type_Windows_Registry File Details
Type_SAM_Registry File Details
Type_System_Registry File Details
Type_Boot_Registry File Details
Type_User_Registry File Details
Type_Software_Registry File Details
Type_Vista7_Thumbnail_Cache Files
Type_Microsoft_Cabinet Files
Type_Adobe_Flash_Video_New File Details
Type_Evernote_Database File Details
Type_vCard Artifacts
Type_vCard_Unicode Artifacts
Type_xCard Artifacts
Type_Ogg_Theora File Details
Type_Encrypted_ZIP File Details
Type_Outlook_Personal_Folders File Details
Type_Torrent File Details
Type_Setup_API_Log Artifacts, Events
Type_QuickTime_Container File Details
Type_Digital_Media_Broadcasting File Details
Type_Digital_Media_Protection File Details
Type_Dirac_Video File Details
Type_Digital_Video_Broadcast File Details
Type_JPEG_2000 File Details
Type_AAC_Audio File Details
Type_AAC_Audio_Book File Details
Type_Motion_JPEG File Details
Type_MPEG_21 File Details
Type_MPEG_7 File Details
Type_QuickTime_Video File Details, Locations
Type_QuickTime_Cache File Details
Type_Safari_Cache File Details
Type_XRY_XML_File Artifacts, Events, Locations, Messages, URLs
Type_Apple_Voicemail_Database Artifacts, Events, File Details
Type_Apple_Find_My_iPhone_Database File Details, Locations
Type_Windows_Link Artifacts, File Details, URLs
Type_Precompiled_INF File Details
Type_ELF_Executable File Details
Type_Firefox_Offline_Cache Files, File Details, URLs
Type_Microsoft_DPAPI_Key File Details
Type_Recycle_Bin_INFO2 Events, File Details
Type_Opera_Typed_URL_Cache Events
Type_MIME_Message Files
Type_BluRay_PlayList File Details
Type_NTFS_Log_File File Details
Type_Android_WiFi_Cache Artifacts, Events, Locations
Type_Android_Cell_Tower_Cache Events, Locations
Type_Android_Executable_35 File Details
Type_Android_Executable_36 File Details
Type_Android_Settings_Database File Details
Type_Android_Suggestions_Database Artifacts, Events, File Details
Type_TigerText_Database File Details
Type_Windows_XML_Event_Log Artifacts, Events, Files, Supported Record Numbers
Type_XML_PList Artifacts, Files
Type_Apple_Addressbook Artifacts
Type_ydjp Files
Type_TAR Files
Type_Windows_Hibernation File Details
Type_Kies_Backup_Data Files
Type_Kies_Backed_Up_Items Artifacts, Files, Messages

Event Log Records

Expand processes the following event log record numbers

ID Description
21
22
25
300
600
1001
1002
1006
1102
1149
2003
2102
2104
4616
4624
4663
6100
7045
8001
8003
11001
20001
20003
24576
24577
24578
50067
Retrieved from "https://truxwiki.com/index.php?title=Expand&oldid=2039"