Origin

When Truxton stores files, it will tell you where the file came from. This is stored in the Origin column of the File table in the database.

This information is also kept in the Origin database table.

Name	Value	Meaning
ORIGIN_UNKNOWN	0	We don't know where this file came from.
ORIGIN_NORMAL	1	The file came from the media as an overt file. It was a normal entry in the media's filesystem.
ORIGIN_UNDELETED	2	The file is the result of un-deleting it from the source filesystem.
ORIGIN_CARVED	3	The file is the result of searching a byte stream for a file format (carving).
ORIGIN_EXPANDED	4	The file came out of another file in Truxton. Child files of a Zip archive are ORIGIN_EXPANDED
ORIGIN_ASSOCIATED	5	The file was uploaded to Truxton by a user and associated with media.
ORIGIN_GENERATED	6	Truxton generated this file during exploitation. Snippet files are an example.
ORIGIN_EMAIL_BODY	7	The file is the body of an email parsed by Truxton.
ORIGIN_EMAIL_ATTACHMENT	8	The file is an attachment to an email parsed by Truxton.
ORIGIN_VOLUME_SHADOW_COPY	9	The file came from a Volume Shadow in NTFS.
ORIGIN_MMS_ATTACHMENT	10	The file is the payload of an MMS message.
ORIGIN_STITCHED	11	The file was stitched back together from fragments scattered throughout the media free space. It is a de-fragmented carved file.
ORIGIN_SLACK	12	The file came from the slack space of a normal file in the filesystem of the media.