Why is Truxton so Extensible

Well, to meet your needs, that’s why.

Introduction

The field of digital forensics is far too large to be mastered by any single vender, lab, organization, agency, or government. No single tool can meet all of a customer’s needs. Truxton’s extensible processing architecture allows customers to integrate their existing tools and know-how into a scalable work flow. In short, Truxton is extensible to meet your needs.

Sample Scenarios

Let’s demonstrate this extensibility with some sample scenarios.

Truxton Doesn’t Identify My File Types

There will always be new types of files springing into existence. Suppose you have expended many hours creating your own file identification system that uses XML files to describe file signatures. Here's how to use it in Truxton:

1. Create a scheme to convert your file type identifier to an integer (16-bit).
2. Enumerate through your file types and add them to the FileType table in Truxton. Here’s sample code in Python and C.
3. Create an ETL process to receive unknown file types. Here’s sample code in Python or C.
4. Register your ETL with Truxton (Add your ETL to the Truxton Service for it to automatically start with the other ETL processes.)

Congratulations! You have now extended Truxton’s file identification capability to match your own.

Truxton doesn’t exploit my file types

If Truxton doesn’t know how to exploit a particular file type:

1. Create an ETL process to exploit the file type. Here’s sample code in Python or C.
2. Register your ETL with Truxton

I have a better way to exploit this file type

Yay. Change the Route table. Have that file type routed to your queue. I want to export Truxton Data in a custom JSON format Use Python or C to enumerate through Truxton.

I want to use my own file carver

1. Create an ETL that listens to the “carve” message queue
2. Replace the “carve” ETL in TruxtonService.xml to use your executable

I want to use my own User Interface

Truxton’s Analyst Desktop is a graphical user interface that queries a database and puts the results onto the screen. There’s nothing stopping you from creating your own interface or integrating Truxton into an existing UI. The database schema is designed to be easily understood by humans. All tables and columns are documented. There are also useful queries.