Load

Details

Executable	Load.exe
Stage	1
Percent Complete	48%
Message Queue	loadq

Load's purpose in life is to find files, identify their type, eliminate their contents based on known-good MD5 hashes, put the meta-data about the file into a database, contents into a depot, then send messages to other ETL processes that have registered to receive that type of file.

Loading Zip Files

Load considers Zip files to be a media type. It will expand the zip and add the files found therein. If you want the zip file loaded as if it appeared on media (so you get the zip file details), put the zip file in a folder by itself and load the folder.

Usage

load.exe T:\Bob.E01

Capabilities

Load can ingest the files and folders. If the file is one of the following disk image formats, it will be opened, partitions and filesystems navigated, freespace gathered, files carved, etc.

• Raw (dd)
• E01 - Expert Witness Disk Image
• L01 - Expert Witness Logical Files
• ISO - CD/DVD disc image

The following file systems are supported

• ext2 - Linux ext2/3/4
• FAT - Microsoft FAT12/16/32/ex
• HFS - HFS/HFS+
• ISO 9660 - CD/DVD
• NTFS - Microsoft NTFS
• UFS - UFS1/UFS2
• YAFFS - Yet Another Flash File System

Not Loading Data

Load has abilities other than loading data into Truxton.

Merge Hash Sets

Searching a single hash set is faster than searching multiple hash sets. To improve speed, it is better to combine multiple hash sets into a single file. Use the mergehashsets option to tell the loader to process the command line as a list of hash sets.

"C:\Program Files\Truxton\Loader\Load.exe" -mergehashsets Yes NSRL.hashset MyLibraryOfAndroidApps.hashset

This will produce an output file named merged.hashset in the current directory that contains the unique hashes from the given sources.

Differential Load

This is a load where you have two different images of the same media and you only want to see the changes between them. For example, you image your laptop's hard drive before going on a trip. You load that image into Truxton. When you return from your trip, you image it again. When you load this second image of your laptop, you use the hashsetm loader option giving it the media id of the first time you loaded it. This will cause the loader to create a temporary hash set containing the unique hashes of the first load and use it to eliminate duplicates from the second load. What you will have loaded are only those files that were new or modified from the first image.

Prism Loads

A prism load is where you have multiple copies of a piece of media that you want loaded into Truxton as a single piece of media. This situation arises when you use multiple tools to image media. For example, you have used ADF, Cellebrite, XRY, and GrayKey to pull data from the same cell phone. Each tool has its own strengths and weaknesses. You now have four images of the same phone. By using a prism load, you can combine the uniqueness of each tool into a single media in Truxton. The analyst has only one media in Truxton, not four.

Prism Load List

The easiest way to perform a prism load is to use a load list.

 1 M: Emilio Lizardo iPhone 4275636B-6172-6F6F-2042-616E7A616938
 2 P: E:\Incoming\EL\ADF\afc_backup.z01
 3 
 4 M: Emilio Lizardo iPhone
 5 G: -prism 4275636B-6172-6F6F-2042-616E7A616938
 6 P: E:\Incoming\EL\XRY\Full Log\File
 7 
 8 M: Emilio Lizardo iPhone
 9 G: -prism 4275636B-6172-6F6F-2042-616E7A616938
10 P: E:\Incoming\EL\Cellebrite\Cellebrite\UFED\AdvancedLogical File System 01\Apple_iPhone (ABCDE).zip
11 
12 M: Emilio Lizardo iPhone
13 G: -prism 4275636B-6172-6F6F-2042-616E7A616938
14 P: E:\Incoming\EL\Gray\iPhone\0000A755-AA421C94FF44802F\0000A755-AA421C94FF44802F_files_full

Line 1 sets the name and GUID for the media.

Lines 4-7 setup the first prism load. Line 5 tells the loader that it should perform the prism load into media 4275636B-6172-6F6F-2042-616E7A616938. The load process will query the database for the status of the media and wait until the status is "loaded." When the prism load begins to process files, it will first create a hash set containing all of the hashes currently in the media. If the loader encounters a hit in this hash set, it will completely ignore the file, not putting a record in the database nor storing the content. It will act as if the file never existed. When the load completes, the hash set will be deleted.

Lines 8-10 setup the second prism load.

Lines 12-14 setup the third prism load.

One thing to note, when using a load list, multiple load processes will be spawned. In this case, 4 will be spawned and run simultaneously. The three prism load processes, however, will pause until the original load completes. When that happens, one of the three prism loads will take over and perform a prism load while the remaining two processes wait for it to complete. The order in which the prism loads take place is random.

Case Numbers

This explains the algorithms used to generate case numbers for investigations and media.

Investigation

If you don't specify a case number for the investigation (using the case option) a default case number will be generated. It will be the letter 'T' followed by a four digit year, a dash, three digit day number of the year, dash, a three digit counter. For example, a case created on May 25, 2022 would have a case number of "T2022-144-001" If another investigation is created on the same day, the case number will have the counter incremented ("T2022-144-002").

Media

If you don't specify a case number for the media (using the mcsn option) a default case number will be generated. It will be a four digit year followed by the day number of the year, underscore and the four digit minutes of the day. For example, media loaded on May 25, 2022 at 1:15pm would have a case number of "2022144_0795"

Customizing Loads

There are many options you can use tp specify what is loaded and how it is loaded.

Load Only EMail

You can choose to load only particular types of files found in media. Once use case would be to load only the email found in a hard drive. First, you would identify the types of files that would contain email and load only those.

load.exe -includefilesbytype yes -includes 341,426,921

Waiting for Source Media

The wfsm boolean option will cause the loader to wait until the media to load exists. Normally, if you tell Truxton to load a file or folder, if it doesn't exist the loader will exit. By specifying "-wfsm yes" on the command line, the loader will wait until the media appears before proceeding to load it. This is handy when you are automating the loading of data and the loader gets spawned before the media is finished copying or you have a buggy SAN solution.

If the media is not present, an error message will be written to the Windows Application Event Log. If the error persists, you may have to do some sleuthing to determine why. Media not being present rarely happens while typos on the command line are more common. To debug this, start Windows Task Manager, Details tab, mark the "Command line" column to be shown. Take a close look at the command line to see if there's any errors. A missing dash on an option or an unquoted option are usually the culprits.