Difference between revisions of "ExpandedFile Table"
Jump to navigation
Jump to search
| Line 3: | Line 3: | ||
This allows you to make intelligent decisions about reprocessing files with a newer version of an existing ETL. | This allows you to make intelligent decisions about reprocessing files with a newer version of an existing ETL. | ||
| + | =SQL= | ||
<source lang="SQL"> | <source lang="SQL"> | ||
CREATE TABLE "ExpandedFile" | CREATE TABLE "ExpandedFile" | ||
| Line 12: | Line 13: | ||
); | ); | ||
</source> | </source> | ||
| + | |||
| + | =Columns= | ||
| + | ==<code>FileID</code>== | ||
| + | The globally unique identifier of the file that was expanded. | ||
| + | This corresponds to the <code>ID</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table. | ||
| + | |||
| + | ==<code>HashID</code>== | ||
| + | The hash of the file''s contents. | ||
| + | This corresponds to the <code>HashID</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table. | ||
| + | |||
| + | ==<code>Expander</code>== | ||
| + | The identifier of the expander that processed this file. Usually the string identifier of the queue name. | ||
| + | |||
| + | ==<code>Version</code>== | ||
| + | The version of the expanded that expanded this file. | ||
Latest revision as of 05:18, 27 January 2024
The [ExpandedFile] table is used to record which exploitation methods were performed on a file.
Truxton tracks which version of ETLs were used to expand/exploit a file.
This allows you to make intelligent decisions about reprocessing files with a newer version of an existing ETL.
SQL
CREATE TABLE "ExpandedFile"
(
"FileID" uuid NOT NULL,
"HashID" uuid NOT NULL,
"Expander" bigint DEFAULT 0 NOT NULL,
"Version" bigint DEFAULT 0 NOT NULL
);
Columns
FileID
The globally unique identifier of the file that was expanded.
This corresponds to the ID column of the [File] table.
HashID
The hash of the files contents.
This corresponds to the HashID column of the [File] table.
Expander
The identifier of the expander that processed this file. Usually the string identifier of the queue name.
Version
The version of the expanded that expanded this file.
