Difference between revisions of "Investigation Types"

From truxwiki.com
Jump to navigation Jump to search
(Created page with "When Truxton stores media, you can assign a type of media to it. This allows the analyst to get more of a clue as to what they are looking at. This is stored in the <code>[Med...")
 
 
(5 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
When Truxton stores media, you can assign a type of media to it.
+
The <code>[InvestigationType]</code> reference table in the database also contains this information.
−
This allows the analyst to get more of a clue as to what they are looking at.
+
These are the default values that ship with Truxton.
−
This is stored in the <code>[MediaTypeID]</code> column of the <code>[Media]</code> table in the database.
+
You are free to add as many as you need.
−
The <code>[MediaType]</code> reference table in the database also contains this information.
 
−
 
 
−
This information is also kept in the <code>MediaType</code> database table.
 
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 11: Line 8:
 
! Meaning
 
! Meaning
 
|-
 
|-
−
| <code>MEDIA_TYPE_UNKNOWN</code>
+
| <code>INVESTIGATION_TYPE_UNKNOWN</code>
 
| style="text-align:center;" | 0
 
| style="text-align:center;" | 0
−
| We don't know what type of media this is.
+
| We don't know what type of investigation this is.
−
|-
 
−
| <code>MEDIA_TYPE_LOGICAL_FILES</code>
 
−
| style="text-align:center;" | 1
 
−
| A folder on the loader machine.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_HARD_DISK</code>
 
−
| style="text-align:center;" | 2
 
−
| The media is a physical hard drive connected, hopefully through a write-blocker, to the loader machine processed as a bag of sectors.
 
−
|-
 
−
| <code>MEDIA_TYPE_HARD_DISK_IMAGE</code>
 
−
| style="text-align:center;" | 3
 
−
| A forensic copy of a hard disk in a file.
 
−
|-
 
−
| <code>MEDIA_TYPE_HARD_DISK_FOLDER</code>
 
−
| style="text-align:center;" | 4
 
−
| A hard drive as a folder. Mounting a hard disk image is an example. Truxton relied on the host operating system to interpret the file system on the media.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_CD</code>
 
−
| style="text-align:center;" | 5
 
−
| A compact disc attached to the loader machine processed as a bag of sectors.
 
−
|-
 
−
| <code>MEDIA_TYPE_CD_IMAGE</code>
 
−
| style="text-align:center;" | 6
 
−
| A forensic copy of a compact disc in a file.
 
−
|-
 
−
| <code>MEDIA_TYPE_CD_FOLDER</code>
 
−
| style="text-align:center;" | 7
 
−
| A compact disc mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_DVD</code>
 
−
| style="text-align:center;" | 8
 
−
| A DVD attached to the loader machine processed as a bag of sectors.
 
−
|-
 
−
| <code>MEDIA_TYPE_DVD_IMAGE</code>
 
−
| style="text-align:center;" | 9
 
−
| A forensic copy of a DVD in a file.
 
−
|-
 
−
| <code>MEDIA_TYPE_DVD_FOLDER</code>
 
−
| style="text-align:center;" | 10
 
−
| A DVD mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_BLURAY</code>
 
−
| style="text-align:center;" | 11
 
−
| A BluRay attached to the loader machine processed as a bag of sectors.
 
−
|-
 
−
| <code>MEDIA_TYPE_BLURAY_IMAGE</code>
 
−
| style="text-align:center;" | 12
 
−
| A forensic copy of a BluRay disc in a file.
 
−
|-
 
−
| <code>MEDIA_TYPE_BLURAY_FOLDER</code>
 
−
| style="text-align:center;" | 13
 
−
| A folder on a BluRay physically attached to the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_THUMB_DRIVE</code>
 
−
| style="text-align:center;" | 14
 
−
| A thumb drive attached to the loader machine processed as a bag of sectors.
 
−
|-
 
−
| <code>MEDIA_TYPE_THUMB_DRIVE_IMAGE</code>
 
−
| style="text-align:center;" | 15
 
−
| A forensic copy of a thumb drive in a file.
 
−
|-
 
−
| <code>MEDIA_TYPE_THUMB_DRIVE_FOLDER</code>
 
−
| style="text-align:center;" | 16
 
−
| A thumb drive mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_SIM_CARD</code>
 
−
| style="text-align:center;" | 17
 
−
| A SIM card attached to the loader machine.
 
 
|-
 
|-
−
| <code>MEDIA_TYPE_SIM_CARD_IMAGE</code>
+
| <code>INVESTIGATION_TYPE_ASSAULT</code>
−
| style="text-align:center;" | 18
+
| style="text-align:center;" | 282345722
−
| A forensic copy of a SIM card in a file.
+
| An assault investigation.
 
|-
 
|-
−
| <code>MEDIA_TYPE_SIM_CARD_FOLDER</code>
+
| <code>INVESTIGATION_TYPE_BATTERY</code>
−
| style="text-align:center;" | 19
+
| style="text-align:center;" | 1540437532
−
| A SIM card mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
+
| A battery case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_PHYSICAL_SD_CARD</code>
+
| <code>INVESTIGATION_TYPE_CHILD_EXPLOITATION</code>
−
| style="text-align:center;" | 20
+
| style="text-align:center;" | -1917039916
−
| An SD card attached to the loader machine.
+
| A child exploitation case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_SD_CARD_IMAGE</code>
+
| <code>INVESTIGATION_TYPE_CIVIL</code>
−
| style="text-align:center;" | 21
+
| style="text-align:center;" | -578586218
−
| A forensic copy of an SD card in a file.
+
| A civil case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_SD_CARD_FOLDER</code>
+
| <code>INVESTIGATION_TYPE_DATA_RECOVERY</code>
−
| style="text-align:center;" | 22
+
| style="text-align:center;" | -762708792
−
| An SD card mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
+
| A data recovery case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_RAM</code>
+
| <code>INVESTIGATION_TYPE_DRUG</code>
−
| style="text-align:center;" | 23
+
| style="text-align:center;" | -1624394863
−
| A dump of memory.
+
| A drug case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_FLOPPY_DISK_IMAGE</code>
+
| <code>INVESTIGATION_TYPE_FRAUD</code>
−
| style="text-align:center;" | 24
+
| style="text-align:center;" | 1433479426
−
| A forensic copy of a [https://en.wikipedia.org/wiki/Floppy_disk floppy diskette].
+
| This is a fraud case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_FLASH</code>
+
| <code>INVESTIGATION_TYPE_GANG</code>
−
| style="text-align:center;" | 25
+
| style="text-align:center;" | -807464012
−
| A dump of flash memory chips.
+
| A gang case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_GPS</code>
+
| <code>INVESTIGATION_TYPE_HOMICIDE</code>
−
| style="text-align:center;" | 26
+
| style="text-align:center;" | -1142204208
−
| A dump of a GPS device.
+
| A homicide case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_TAR</code>
+
| <code>INVESTIGATION_TYPE_HUMAN_TRAFFICKING</code>
−
| style="text-align:center;" | 27
+
| style="text-align:center;" | 1234271187
−
| A [https://en.wikipedia.org/wiki/Tar_(computing) TAR] file.
+
| A human trafficking case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_RAR</code>
+
| <code>INVESTIGATION_TYPE_INTERNAL</code>
−
| style="text-align:center;" | 28
+
| style="text-align:center;" | 772945205
−
| A [https://en.wikipedia.org/wiki/RAR_(file_format) RAR] file.
+
| An internal investigation.
 
|-
 
|-
−
| <code>MEDIA_TYPE_ZIP</code>
+
| <code>INVESTIGATION_TYPE_LOAC</code>
−
| style="text-align:center;" | 29
+
| style="text-align:center;" | -570969319
−
| A [https://en.wikipedia.org/wiki/Zip_(file_format) ZIP] file.
+
| A [https://en.wikipedia.org/wiki/International_humanitarian_law Law of Armed Conflict] case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_FORENSIC_DATA</code>
+
| <code>INVESTIGATION_TYPE_MISSING_PERSON</code>
−
| style="text-align:center;" | 30
+
| style="text-align:center;" | 2095812006
−
| Data pulled from evidence by forensic technicians.
+
| The disappearance of someone.
 
|-
 
|-
−
| <code>MEDIA_TYPE_ASSOCIATED_DATA</code>
+
| <code>INVESTIGATION_TYPE_OTHER</code>
−
| style="text-align:center;" | 31
+
| style="text-align:center;" | 99897732
−
| Data relevant to the case but doesn't come from seized media such as photos of the media, crime scene, etc.
+
| Some generic reason for having an investigation.
 
|-
 
|-
−
| <code>MEDIA_TYPE_PHONE</code>
+
| <code>INVESTIGATION_TYPE_ROBBERY</code>
−
| style="text-align:center;" | 32
+
| style="text-align:center;" | 40712228
−
| A dump of a phone.
+
| A robbery case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_TABLET</code>
+
| <code>INVESTIGATION_TYPE_SUSPICIOUS_DEATH</code>
−
| style="text-align:center;" | 33
+
| style="text-align:center;" | 618357760
−
| A dump of a tablet.
+
| A death under unusual circumstances.
 
|-
 
|-
−
| <code>MEDIA_TYPE_PHYSICAL_ITEMS</code>
+
| <code>INVESTIGATION_TYPE_TRAINING</code>
−
| style="text-align:center;" | 34
+
| style="text-align:center;" | 1294317807
−
| Non-digital evidence collected from the crime scene such as pieces of paper, writing on a wall, etc.
+
| An investigation for the purpose of training an analyst.
 
|-
 
|-
−
| <code>MEDIA_TYPE_ABORT_LOAD</code>
+
| <code>INVESTIGATION_TYPE_UNACCOMPANIED_DEATH</code>
−
| style="text-align:center;" | 32749
+
| style="text-align:center;" | -67542183
−
| A request has been made to abort any loading of this media.
+
| A investigation of an unaccompanied death.
 
|}
 
|}

Latest revision as of 12:30, 18 August 2021

The [InvestigationType] reference table in the database also contains this information. These are the default values that ship with Truxton. You are free to add as many as you need.

Name Value Meaning
INVESTIGATION_TYPE_UNKNOWN 0 We don't know what type of investigation this is.
INVESTIGATION_TYPE_ASSAULT 282345722 An assault investigation.
INVESTIGATION_TYPE_BATTERY 1540437532 A battery case.
INVESTIGATION_TYPE_CHILD_EXPLOITATION -1917039916 A child exploitation case.
INVESTIGATION_TYPE_CIVIL -578586218 A civil case.
INVESTIGATION_TYPE_DATA_RECOVERY -762708792 A data recovery case.
INVESTIGATION_TYPE_DRUG -1624394863 A drug case.
INVESTIGATION_TYPE_FRAUD 1433479426 This is a fraud case.
INVESTIGATION_TYPE_GANG -807464012 A gang case.
INVESTIGATION_TYPE_HOMICIDE -1142204208 A homicide case.
INVESTIGATION_TYPE_HUMAN_TRAFFICKING 1234271187 A human trafficking case.
INVESTIGATION_TYPE_INTERNAL 772945205 An internal investigation.
INVESTIGATION_TYPE_LOAC -570969319 A Law of Armed Conflict case.
INVESTIGATION_TYPE_MISSING_PERSON 2095812006 The disappearance of someone.
INVESTIGATION_TYPE_OTHER 99897732 Some generic reason for having an investigation.
INVESTIGATION_TYPE_ROBBERY 40712228 A robbery case.
INVESTIGATION_TYPE_SUSPICIOUS_DEATH 618357760 A death under unusual circumstances.
INVESTIGATION_TYPE_TRAINING 1294317807 An investigation for the purpose of training an analyst.
INVESTIGATION_TYPE_UNACCOMPANIED_DEATH -67542183 A investigation of an unaccompanied death.
Retrieved from "https://truxwiki.com/index.php?title=Investigation_Types&oldid=5180"