Difference between revisions of "Database Tables"
Jump to navigation
Jump to search
| Line 3: | Line 3: | ||
=Data Tables= | =Data Tables= | ||
These tables hold data gleaned from exploiting media. | These tables hold data gleaned from exploiting media. | ||
| − | * <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> | + | * <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> - Also known as artifacts. |
| − | * <code><nowiki>[</nowiki>[[ETLRoute Table|ETLRoute]]<nowiki>]</nowiki></code> | + | * <code><nowiki>[</nowiki>[[ETLRoute Table|ETLRoute]]<nowiki>]</nowiki></code> - Can be thought of as load configurations. |
| − | * <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> | + | * <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> - This holds events extracted from exploited data. |
| − | * <code><nowiki>[</nowiki>[[EXIF Table|EXIF]]<nowiki>]</nowiki></code> - This holds Camera Information | + | * <code><nowiki>[</nowiki>[[EXIF Table|EXIF]]<nowiki>]</nowiki></code> - This holds Camera Information. |
| − | * <code><nowiki>[</nowiki>[[ExpandedFile Table|ExpandedFile]]<nowiki>]</nowiki></code> | + | * <code><nowiki>[</nowiki>[[ExpandedFile Table|ExpandedFile]]<nowiki>]</nowiki></code> - This allows you to determine if a file has been expanded. |
| − | * <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> | + | * <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> - The files found in exploited media. |
| − | * <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> | + | * <code><nowiki>[</nowiki>[[InvestigatorAction Table|InvestigatorAction]]<nowiki>]</nowiki></code> - Actions taken by the investigator while using the Analyst Desktop. |
| − | * <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> | + | * <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> - Geographic locations. |
| − | * <code><nowiki>[</nowiki>[[Statistics Table|Statistics]]<nowiki>]</nowiki></code> | + | * <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> - Relationships between items in Truxton. |
| − | * <code><nowiki>[</nowiki>[[USBDevice Table|USBDevice]]<nowiki>]</nowiki></code> | + | * <code><nowiki>[</nowiki>[[Statistics Table|Statistics]]<nowiki>]</nowiki></code> - Load statistics. |
| − | * <code><nowiki>[</nowiki>[[WebsiteVisit Table|WebsiteVisit]]<nowiki>]</nowiki></code> | + | * <code><nowiki>[</nowiki>[[USBDevice Table|USBDevice]]<nowiki>]</nowiki></code> - USB Devices. |
| + | * <code><nowiki>[</nowiki>[[WebsiteVisit Table|WebsiteVisit]]<nowiki>]</nowiki></code> - URLs found during exploitation. | ||
=Reference Tables= | =Reference Tables= | ||
Revision as of 10:11, 25 July 2022
The Truxton database holds "hot" tables that are constantly written to as well as reference (read-only) tables.
Data Tables
These tables hold data gleaned from exploiting media.
[Entity]- Also known as artifacts.[ETLRoute]- Can be thought of as load configurations.[Event]- This holds events extracted from exploited data.[EXIF]- This holds Camera Information.[ExpandedFile]- This allows you to determine if a file has been expanded.[File]- The files found in exploited media.[InvestigatorAction]- Actions taken by the investigator while using the Analyst Desktop.[Location]- Geographic locations.[Relation]- Relationships between items in Truxton.[Statistics]- Load statistics.[USBDevice]- USB Devices.[WebsiteVisit]- URLs found during exploitation.
Reference Tables
These tables exist only to give meanings to magic values so humans can better comprehend it.
[AlertStatus]gives meaning to integer values found in the[AlertStatusID]column of the[Alert]table.[BOLOStatus]gives meaning to integer values found in the[BOLOStatusID]column of the[BOLO]table.[ContentStatus]gives meaning to integer values found in the[ContentStatusID]column of the[File]table. These values are also defined constants.[DataType]gives meaning to integer values found in the[DataTypeID]column of the[Entity]table. These values are also defined constants.[DepotStatus]gives meaning to integer values found in the[DepotStatusID]column of the[Depot]table.[DepotType]gives meaning to integer values found in the[DepotTypeID]column of the[Depot]table. These values are also defined constants.[EntityType]gives meaning to integer values found in the[EntityTypeID]column of the[Entity]table. These values are also defined constants.[EventType]gives meaning to integer values found in the[EventTypeID]column of the[Event]table. These values are also defined constants.[GroupEntryStatus]gives meaning to integer values found in the[GroupEntryStatusID]column of the[GroupEntry]table.[GroupEntryType]gives meaning to integer values found in the[GroupEntryTypeID]column of the[GroupEntry]table.[GroupStatus]gives meaning to integer values found in the[GroupStatusID]column of the[Group]table.[InvestigationType]gives meaning to integer values found in the[InvestigationTypeID]column of the[Investigation]table. These values are also defined constants.[InvestigationStatus]gives meaning to integer values found in the[InvestigationStatusID]column of the[Investigation]table. These values are also defined constants.[LocationType]gives meaning to integer values found in the[LocationTypeID]column of the[Location]table. These values are also defined constants.[MediaStatus]gives meaning to integer values found in the[MediaStatusID]column of the[Media]table. These values are also defined constants.[MediaType]gives meaning to integer values found in the[MediaTypeID]column of the[Media]table. These values are also defined constants.[MessageAddressType]gives meaning to integer values found in the[MessageAddressTypeID]column of the[MessageAddress_Message]table.[MessageType]gives meaning to integer values found in the[MessageTypeID]column of the[Message]table. These values are also defined constants.[ObjectType]gives meaning to integer values found in the[ObjectTypeID]column of the[Relation]table. These values are also defined constants.[Origin]gives meaning to integer values found in the[OriginID]column of the[File]table. These values are also defined constants.[RelationType]gives meaning to integer values found in the[RelationTypeID]column of the[Relation]table. These values are also defined constants.[ReviewSource]gives meaning to integer values found in the[ReviewSourceID]column of the[Review]table.[ReviewStatus]gives meaning to integer values found in the[ReviewStatusID]column of the[Review]table.[ReviewType]gives meaning to integer values found in the[ReviewTypeID]column of the[Review]table.[URLType]gives meaning to integer values found in the[URLTypeID]column of the[WebsiteVisit]table. These values are also defined constants.[WebsiteMethod]gives meaning to integer values found in the[WebsiteMethodID]column of the[WebsiteVisit]table. These values are also defined constants.
