Difference between revisions of "Database Tables"
Jump to navigation
Jump to search
| (10 intermediate revisions by the same user not shown) | |||
| Line 4: | Line 4: | ||
These tables hold data gleaned from exploiting media. | These tables hold data gleaned from exploiting media. | ||
* <code><nowiki>[</nowiki>[[Account Table|Account]]<nowiki>]</nowiki></code> - Holds accounts. | * <code><nowiki>[</nowiki>[[Account Table|Account]]<nowiki>]</nowiki></code> - Holds accounts. | ||
| − | * <code><nowiki>[</nowiki>[[Alert Table|Alert]]<nowiki>]</nowiki></code> - Holds | + | * <code><nowiki>[</nowiki>[[Alert Table|Alert]]<nowiki>]</nowiki></code> - Holds alerts. |
| − | * <code><nowiki>[</nowiki>[[BOLO Table|BOLO]]<nowiki>]</nowiki></code> - | + | * <code><nowiki>[</nowiki>[[BOLO Table|BOLO]]<nowiki>]</nowiki></code> - Be On the Look Out information. |
| − | * <code><nowiki>[</nowiki>[[Content Table|Content]]<nowiki>]</nowiki></code> - Holds | + | * <code><nowiki>[</nowiki>[[Content Table|Content]]<nowiki>]</nowiki></code> - Holds content information. |
| − | * <code><nowiki>[</nowiki>[[Definition Table|Definition]]<nowiki>]</nowiki></code> - Holds | + | * <code><nowiki>[</nowiki>[[Definition Table|Definition]]<nowiki>]</nowiki></code> - Holds definitions of terms. |
| + | * <code><nowiki>[</nowiki>[[Depot Table|Depot]]<nowiki>]</nowiki></code> - Holds depot information. | ||
* <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> - Also known as artifacts. | * <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> - Also known as artifacts. | ||
* <code><nowiki>[</nowiki>[[ETLRoute Table|ETLRoute]]<nowiki>]</nowiki></code> - Can be thought of as load configurations. | * <code><nowiki>[</nowiki>[[ETLRoute Table|ETLRoute]]<nowiki>]</nowiki></code> - Can be thought of as load configurations. | ||
| Line 14: | Line 15: | ||
* <code><nowiki>[</nowiki>[[ExpandedFile Table|ExpandedFile]]<nowiki>]</nowiki></code> - This allows you to determine if a file has been expanded. | * <code><nowiki>[</nowiki>[[ExpandedFile Table|ExpandedFile]]<nowiki>]</nowiki></code> - This allows you to determine if a file has been expanded. | ||
* <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> - The files found in exploited media. | * <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> - The files found in exploited media. | ||
| + | * <code><nowiki>[</nowiki>[[FileType Table|FileType]]<nowiki>]</nowiki></code> - The types of files Truxton knows about. | ||
| + | * <code><nowiki>[</nowiki>[[Free Table|Free]]<nowiki>]</nowiki></code> - The table that holds the free space in media. | ||
* <code><nowiki>[</nowiki>[[InvestigatorAction Table|InvestigatorAction]]<nowiki>]</nowiki></code> - Actions taken by the investigator while using the Analyst Desktop. | * <code><nowiki>[</nowiki>[[InvestigatorAction Table|InvestigatorAction]]<nowiki>]</nowiki></code> - Actions taken by the investigator while using the Analyst Desktop. | ||
* <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> - Geographic locations. | * <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> - Geographic locations. | ||
* <code><nowiki>[</nowiki>[[Log Table|Log]]<nowiki>]</nowiki></code> - Holds entries in the [[Type_Load_Log|load log]]. | * <code><nowiki>[</nowiki>[[Log Table|Log]]<nowiki>]</nowiki></code> - Holds entries in the [[Type_Load_Log|load log]]. | ||
| + | * <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> - Details about the seized media. | ||
* <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> - Relationships between items in Truxton. | * <code><nowiki>[</nowiki>[[Relation Table|Relation]]<nowiki>]</nowiki></code> - Relationships between items in Truxton. | ||
* <code><nowiki>[</nowiki>[[Statistics Table|Statistics]]<nowiki>]</nowiki></code> - Load statistics. | * <code><nowiki>[</nowiki>[[Statistics Table|Statistics]]<nowiki>]</nowiki></code> - Load statistics. | ||
| + | * <code><nowiki>[</nowiki>[[Tag Table|Tag]]<nowiki>]</nowiki></code> - Tags used in Truxton. | ||
| + | * <code><nowiki>[</nowiki>[[TriageFile Table|TriageFile]]<nowiki>]</nowiki></code> - Holds filenames to load during a Triage Load. | ||
* <code><nowiki>[</nowiki>[[USBDevice Table|USBDevice]]<nowiki>]</nowiki></code> - USB Devices. | * <code><nowiki>[</nowiki>[[USBDevice Table|USBDevice]]<nowiki>]</nowiki></code> - USB Devices. | ||
* <code><nowiki>[</nowiki>[[WebsiteVisit Table|WebsiteVisit]]<nowiki>]</nowiki></code> - URLs found during exploitation. | * <code><nowiki>[</nowiki>[[WebsiteVisit Table|WebsiteVisit]]<nowiki>]</nowiki></code> - URLs found during exploitation. | ||
| Line 24: | Line 30: | ||
=Reference Tables= | =Reference Tables= | ||
These tables exist only to give meanings to magic values so humans can better comprehend it. | These tables exist only to give meanings to magic values so humans can better comprehend it. | ||
| − | * <code>[AlertStatus]</code> gives meaning to integer values found in the <code>[AlertStatusID]</code> column of the <code>[Alert]</code> table. | + | * <code>[AlertStatus]</code> gives meaning to integer values found in the <code>[AlertStatusID]</code> column of the <code><nowiki>[</nowiki>[[Alert Table|Alert]]<nowiki>]</nowiki></code> table. |
* <code>[BOLOStatus]</code> gives meaning to integer values found in the <code>[BOLOStatusID]</code> column of the <code>[BOLO]</code> table. | * <code>[BOLOStatus]</code> gives meaning to integer values found in the <code>[BOLOStatusID]</code> column of the <code>[BOLO]</code> table. | ||
* <code>[ContentStatus]</code> gives meaning to integer values found in the <code>[ContentStatusID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table. These values are also [[Content Status|defined constants.]] | * <code>[ContentStatus]</code> gives meaning to integer values found in the <code>[ContentStatusID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table. These values are also [[Content Status|defined constants.]] | ||
* <code>[DataType]</code> gives meaning to integer values found in the <code>[DataTypeID]</code> column of the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table. These values are also [[DATA TYPE|defined constants.]] | * <code>[DataType]</code> gives meaning to integer values found in the <code>[DataTypeID]</code> column of the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table. These values are also [[DATA TYPE|defined constants.]] | ||
| − | * <code>[DepotStatus]</code> gives meaning to integer values found in the <code>[DepotStatusID]</code> column of the <code>[Depot]</code> table. | + | * <code>[DepotStatus]</code> gives meaning to integer values found in the <code>[DepotStatusID]</code> column of the <code><nowiki>[</nowiki>[[Depot Table|Depot]]<nowiki>]</nowiki></code> table. |
| − | * <code>[DepotType]</code> gives meaning to integer values found in the <code>[DepotTypeID]</code> column of the <code>[Depot]</code> table. These values are also [[Depot Types|defined constants.]] | + | * <code>[DepotType]</code> gives meaning to integer values found in the <code>[DepotTypeID]</code> column of the <code><nowiki>[</nowiki>[[Depot Table|Depot]]<nowiki>]</nowiki></code> table. These values are also [[Depot Types|defined constants.]] |
* <code>[EntityType]</code> gives meaning to integer values found in the <code>[EntityTypeID]</code> column of the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table. These values are also [[Entity Types|defined constants.]] | * <code>[EntityType]</code> gives meaning to integer values found in the <code>[EntityTypeID]</code> column of the <code><nowiki>[</nowiki>[[Entity Table|Entity]]<nowiki>]</nowiki></code> table. These values are also [[Entity Types|defined constants.]] | ||
* <code>[EventType]</code> gives meaning to integer values found in the <code>[EventTypeID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. These values are also [[Event Types|defined constants.]] | * <code>[EventType]</code> gives meaning to integer values found in the <code>[EventTypeID]</code> column of the <code><nowiki>[</nowiki>[[Event Table|Event]]<nowiki>]</nowiki></code> table. These values are also [[Event Types|defined constants.]] | ||
| Line 38: | Line 44: | ||
* <code>[InvestigationStatus]</code> gives meaning to integer values found in the <code>[InvestigationStatusID]</code> column of the <code>[Investigation]</code> table. These values are also [[Investigation Statuses|defined constants.]] | * <code>[InvestigationStatus]</code> gives meaning to integer values found in the <code>[InvestigationStatusID]</code> column of the <code>[Investigation]</code> table. These values are also [[Investigation Statuses|defined constants.]] | ||
* <code>[LocationType]</code> gives meaning to integer values found in the <code>[LocationTypeID]</code> column of the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table. These values are also [[Location Types|defined constants.]] | * <code>[LocationType]</code> gives meaning to integer values found in the <code>[LocationTypeID]</code> column of the <code><nowiki>[</nowiki>[[Location Table|Location]]<nowiki>]</nowiki></code> table. These values are also [[Location Types|defined constants.]] | ||
| − | * <code>[MediaStatus]</code> gives meaning to integer values found in the <code>[MediaStatusID]</code> column of the <code>[Media]</code> table. These values are also [[Media Status|defined constants.]] | + | * <code>[MediaStatus]</code> gives meaning to integer values found in the <code>[MediaStatusID]</code> column of the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table. These values are also [[Media Status|defined constants.]] |
| − | * <code>[MediaType]</code> gives meaning to integer values found in the <code>[MediaTypeID]</code> column of the <code>[Media]</code> table. These values are also [[Media Types|defined constants.]] | + | * <code>[MediaType]</code> gives meaning to integer values found in the <code>[MediaTypeID]</code> column of the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table. These values are also [[Media Types|defined constants.]] |
* <code>[MessageAddressType]</code> gives meaning to integer values found in the <code>[MessageAddressTypeID]</code> column of the <code>[MessageAddress_Message]</code> table. | * <code>[MessageAddressType]</code> gives meaning to integer values found in the <code>[MessageAddressTypeID]</code> column of the <code>[MessageAddress_Message]</code> table. | ||
* <code>[MessageType]</code> gives meaning to integer values found in the <code>[MessageTypeID]</code> column of the <code>[Message]</code> table. These values are also [[Message Types|defined constants.]] | * <code>[MessageType]</code> gives meaning to integer values found in the <code>[MessageTypeID]</code> column of the <code>[Message]</code> table. These values are also [[Message Types|defined constants.]] | ||
Latest revision as of 07:34, 3 February 2024
The Truxton database holds "hot" tables that are constantly written to as well as reference (read-only) tables.
Data Tables
These tables hold data gleaned from exploiting media.
[Account]- Holds accounts.[Alert]- Holds alerts.[BOLO]- Be On the Look Out information.[Content]- Holds content information.[Definition]- Holds definitions of terms.[Depot]- Holds depot information.[Entity]- Also known as artifacts.[ETLRoute]- Can be thought of as load configurations.[Event]- This holds events extracted from exploited data.[EXIF]- This holds Camera Information.[ExpandedFile]- This allows you to determine if a file has been expanded.[File]- The files found in exploited media.[FileType]- The types of files Truxton knows about.[Free]- The table that holds the free space in media.[InvestigatorAction]- Actions taken by the investigator while using the Analyst Desktop.[Location]- Geographic locations.[Log]- Holds entries in the load log.[Media]- Details about the seized media.[Relation]- Relationships between items in Truxton.[Statistics]- Load statistics.[Tag]- Tags used in Truxton.[TriageFile]- Holds filenames to load during a Triage Load.[USBDevice]- USB Devices.[WebsiteVisit]- URLs found during exploitation.
Reference Tables
These tables exist only to give meanings to magic values so humans can better comprehend it.
[AlertStatus]gives meaning to integer values found in the[AlertStatusID]column of the[Alert]table.[BOLOStatus]gives meaning to integer values found in the[BOLOStatusID]column of the[BOLO]table.[ContentStatus]gives meaning to integer values found in the[ContentStatusID]column of the[File]table. These values are also defined constants.[DataType]gives meaning to integer values found in the[DataTypeID]column of the[Entity]table. These values are also defined constants.[DepotStatus]gives meaning to integer values found in the[DepotStatusID]column of the[Depot]table.[DepotType]gives meaning to integer values found in the[DepotTypeID]column of the[Depot]table. These values are also defined constants.[EntityType]gives meaning to integer values found in the[EntityTypeID]column of the[Entity]table. These values are also defined constants.[EventType]gives meaning to integer values found in the[EventTypeID]column of the[Event]table. These values are also defined constants.[GroupEntryStatus]gives meaning to integer values found in the[GroupEntryStatusID]column of the[GroupEntry]table.[GroupEntryType]gives meaning to integer values found in the[GroupEntryTypeID]column of the[GroupEntry]table.[GroupStatus]gives meaning to integer values found in the[GroupStatusID]column of the[Group]table.[InvestigationType]gives meaning to integer values found in the[InvestigationTypeID]column of the[Investigation]table. These values are also defined constants.[InvestigationStatus]gives meaning to integer values found in the[InvestigationStatusID]column of the[Investigation]table. These values are also defined constants.[LocationType]gives meaning to integer values found in the[LocationTypeID]column of the[Location]table. These values are also defined constants.[MediaStatus]gives meaning to integer values found in the[MediaStatusID]column of the[Media]table. These values are also defined constants.[MediaType]gives meaning to integer values found in the[MediaTypeID]column of the[Media]table. These values are also defined constants.[MessageAddressType]gives meaning to integer values found in the[MessageAddressTypeID]column of the[MessageAddress_Message]table.[MessageType]gives meaning to integer values found in the[MessageTypeID]column of the[Message]table. These values are also defined constants.[ObjectType]gives meaning to integer values found in the[ObjectTypeID]column of the[Relation]table. These values are also defined constants.[Origin]gives meaning to integer values found in the[OriginID]column of the[File]table. These values are also defined constants.[RelationType]gives meaning to integer values found in the[RelationTypeID]column of the[Relation]table. These values are also defined constants.[ReviewSource]gives meaning to integer values found in the[ReviewSourceID]column of the[Review]table.[ReviewStatus]gives meaning to integer values found in the[ReviewStatusID]column of the[Review]table.[ReviewType]gives meaning to integer values found in the[ReviewTypeID]column of the[Review]table.[URLType]gives meaning to integer values found in the[URLTypeID]column of the[WebsiteVisit]table. These values are also defined constants.[WebsiteMethod]gives meaning to integer values found in the[WebsiteMethodID]column of the[WebsiteVisit]table. These values are also defined constants.
