|
|
| Line 5: |
Line 5: |
| | | | |
| | ==Improvements== | | ==Improvements== |
| − | # Generic [[Type_SQLite_Database|SQLite]] exploitation. You can add your own [[Type_SQLite_Database|SQLite]] exploitation scripts to Truxton and it will run them against every [[Type_SQLite_Database|SQLite]] database it finds. Truxton includes all of the scripts from project [https://github.com/mac4n6/APOLLO APOLLO]
| |
| − | # Beginning to exploit [[Type_Apple_SEGB|Apple SEGB]] files. For now, we mostly just convert them to [[Type_Apple_SEGB_XML|SEGB XML]].
| |
| − | # Better [[Type_Binary_PList|PList]] and [[Type_Protocol_Buffer|protocol buffer]] conversion to XML. When a field looks like it may contain a timestamp, Truxton decodes and outputs a human-readable timestamp.
| |
| − | # Better [[Type_MPEG2TransportStreamVideo|MPEG 2 Stream]] carving.
| |
| − | # Truxton no longer pollutes the Camera Information section with Quicktime information.
| |
| − | # In the GUI, when viewing a geographic location on an external map URL link, a label for that location is now included instead of just "You are here"
| |
| − | # Better [https://datapilot.com/ DataPilot] integration
| |
| − | # We now extract the [https://support.microsoft.com/en-us/windows/general-privacy-settings-in-windows-7c7f6a09-cebd-5589-c376-7f505e5bf65a#:~:text=Windows%20generates%20a%20unique%20advertising,with%20third%2Dparty%20ad%20providers. Windows Advertising ID] (WAID) from Windows machines.
| |
| − | # Use PostgreSQL 17.4.1
| |
| − | # Updated to Python 3.13.2
| |
| − | # Fixed a high-compression ratio bug in [[Type_Apple_KTX|KTX]] conversion.
| |
| − | # We now pull contacts from [[Type_Apple_Calendar_Database|Apple Calendar Databases]].
| |
| − | # Fixed a bug where duplicate Subjects were being displayed in communications display
| |
| − | # Exploit [[Type_AlpineQuest_Track|AlpineQuest track logs]]. The tracks are written to the geographic report KMZ.
| |
| − | # EXIF information was not being extracted from very large images.
| |
| − | # Improved exploitation of [[Type_Android_Accounts_Database|Android Accounts]]
| |
| − | # Fixed a bug where relationships with Subjects was not being deleted in the [[truxton_delete_subject]]() C API.
| |
| − | # When expanding [[Type_Protocol_Buffer|Protocol Buffers]], if a file is found in an array field, it will become a child of the protocol buffer file. Usually these are [[Type_JPEG|JPG]] or [[Type_PNG|PNG]] files.
| |
| − | # Extract more contact information from [[Type_Skype_Main|Skype]] database
| |
| − | # Fixed a bug in the [[Type_Windows_XML_Event_Log|Windows Event Log]] parser
| |
| − | # Added the following C APIs
| |
| − | ## [[truxton_delete_artifact_type]]
| |
| − | ## [[truxton_delete_event_type]]
| |
| − | ## [[truxton_delete_investigation_by_name]]
| |
| − | ## [[truxton_delete_media_by_name]]
| |
| − | ## [[truxton_delete_subject]]
| |
| − | ## [[truxton_delete_tag]]
| |
| − | # Added the following Python APIs
| |
| − | ## [[TruxtonObject#deleteartifacttype.28typeid:_int.29_-.3E_boolean|deleteartifacttype]]
| |
| − | ## [[TruxtonObject#deleteeventtype.28typeid:_int.29_-.3E_boolean|deleteeventtype]]
| |
| − | ## [[TruxtonObject#deleteinvestigationbyname.28name:_str.29_-.3E_boolean|deleteinvestigationbyname]]
| |
| − | ## [[TruxtonObject#deletemediabyname.28name:_str.29_-.3E_boolean|deletemediabyname]]
| |
| − | ## [[TruxtonObject#deletesubject.28subject_id:_str_.7C_UUID.29_-.3E_boolean|deletesubject]]
| |
| − | ## [[TruxtonObject#deletetag.28tagname:_str.29_-.3E_boolean|deletetag]]
| |
| − | # Fixed a bug where suspects in an investigation were not being deleted
| |
| − | # Added [[Type_ELF_Executable|ELF]] file carving
| |
| − | # Better exploitation of prefetch files to include which files were opened by the application
| |
| − | # Better exploitation of the UserAssist registry key. Better translation of GUIDs to something humanly readable.
| |
| − | # Better exploitation of [[Type_Cellebrite_2|Cellebrite reports]]
| |
| − | # Exploit [[Type_Samsung_CMH|Samsung CMH]] databases to produce geographic coordinates
| |
| − | # The Maintenance ETL will clean up the database at 11pm nightly
| |
| − | # Added more map providers to the Client:
| |
| − | ## [https://geohack.toolforge.org/geohack.php?pagename=CHS¶ms=39.038287;-77.304136 GeoHack]
| |
| − | ## [https://www.openstreetmap.org/?mlat=39.038287&mlon=-77.304136#map=18/39.038287/-77.304136 OpenStreetMap]
| |
| − | # Fixed a bug in KMZ Report Generator where [[Location Types|EXIF location types]] coming from [[Type_Cellebrite_2|Cellebrite Reports]] were producing a red X.
| |
| − | # Fixed a bug where video contact sheets weren't being produced (ffmpeg update broke things)
| |
| | | | |
| | ==New Types== | | ==New Types== |
| | ===File=== | | ===File=== |
| − | # [[Type_Generic_SQLite_Script_Results]]
| + | |
| − | # [[Type_Generic_SQLite_Script_Details]]
| |
| − | # [[Type_Apple_SEGB]]
| |
| − | # [[Type_Apple_Icon_Cache]]
| |
| − | # [[Type_Material_Exchange_Format]]
| |
| − | # [[Type_ECW]]
| |
| − | # [[Type_NetXray]]
| |
| − | # [[Type_Waze_Roadmap_Data]]
| |
| − | # [[Type_Maps_With_Me]]
| |
| − | # [[Type_Apple_Encrypted_Archive]]
| |
| − | # [[Type_Apple_SEGB_XML]]
| |
| − | # [[Type_DataPilot_Database]]
| |
| − | # [[Type_Numerical_Control]]
| |
| − | # [[Type_NetCDF]]
| |
| − | # [[Type_Android_Call_Log_Backup]]
| |
| − | # [[Type_WebAssembly]]
| |
| − | # [[Type_CPBitmap]]
| |
| − | # [[Type_Protocol_Buffer_Archive]]
| |
| − | # [[Type_Paint_Dot_Net]]
| |
| − | # [[Type_Outlook_Express_DBT]]
| |
| − | # [[Type_Discord_User_Information]]
| |
| − | # [[Type_Discord_Message_Dump]]
| |
| − | # [[Type_Olympus_Raw_Image]]
| |
| − | # [[Type_EFTS]]
| |
| − | # [[Type_Fuji_Raw_Image]]
| |
| − | # [[Type_AlpineQuest_Track]]
| |
| − | # [[Type_DEX]]
| |
| − | # [[Type_FTK_Image]]
| |
| − | # [[Type_Windows_Diagnostic_Telemetry]]
| |
| − | # [[Type_Samsung_CMH]]
| |
| − | # [[Type_Google_Takeout_My_Activity]]
| |
| − | # [[Type_Gemini_Activity]]
| |
| − | # [[Type_TensorFlow_Lite]]
| |
| | | | |
| | ===Entity Types=== | | ===Entity Types=== |
| − | # [[Entity Types|ENTITY_TYPE_WAID]] - An [https://support.microsoft.com/en-us/windows/privacy-settings-for-recommendations-offers-in-windows-11-807608ee-3de2-4498-8e7c-eb10d655567f identifier] used by Microsoft Windows to target you with advertising.
| + | |
| − | # [[Entity Types|ENTITY_TYPE_DISCORD_ACCOUNT_ID]] - An identifier for a Discord account
| |
| − | # [[Entity Types|ENTITY_TYPE_REDDIT_ACCOUNT_ID]] - An identifier for a Reddit account
| |
| − | # [[Entity Types|ENTITY_TYPE_AI_PROMPT]] - An AI prompt, user AI query
| |
| − | # [[Entity Types|ENTITY_TYPE_UBER_ACCOUNT_ID]] - An Uber account identifier
| |
| − | # [[Entity Types|ENTITY_TYPE_WAZE_ACCOUNT_ID]] - A Waze account identifier
| |
| | | | |
| | ===Event Types=== | | ===Event Types=== |
| − | # [[Event Types|EVENT_TYPE_DEVICE_LOCKED]] - When a device enters a locked state
| + | |
| − | # [[Event Types|EVENT_TYPE_DEVICE_UNLOCKED]] - When a device has been unlocked
| |
| − | # [[Event Types|EVENT_TYPE_FAILED_LOGON]] - Someone tried and failed to log on
| |
| − | # [[Event Types|EVENT_TYPE_MEETING]] - A meeting
| |
| | | | |
| | ===Location Type=== | | ===Location Type=== |
| − | # [[Location Types|LOCATION_TYPE_NETWORK_CONNECTION]] - When we know the location of a network that a user connected to.
| |
| − | # [[Location Types|LOCATION_TYPE_ALPINEQUEST_STARTING_POINT]] - AlpineQuest Starting Point.
| |
| − | # [[Location Types|LOCATION_TYPE_POINT_OF_INTEREST]] - Point of Interest (POI).
| |
| | | | |
| | ===Message Type=== | | ===Message Type=== |
| − | # [[Message Types|MESSAGE_TYPE_LYNC]] - A Lync message
| |
