Difference between revisions of "Investigation Types"

From truxwiki.com
Jump to navigation Jump to search
(Created page with "When Truxton stores media, you can assign a type of media to it. This allows the analyst to get more of a clue as to what they are looking at. This is stored in the <code>[Med...")
 
Line 1: Line 1:
−
When Truxton stores media, you can assign a type of media to it.
+
The <code>InvestigationType</code> reference table in the database also contains this information.
−
This allows the analyst to get more of a clue as to what they are looking at.
 
−
This is stored in the <code>[MediaTypeID]</code> column of the <code>[Media]</code> table in the database.
 
−
The <code>[MediaType]</code> reference table in the database also contains this information.
 
−
 
 
−
This information is also kept in the <code>MediaType</code> database table.
 
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 11: Line 6:
 
! Meaning
 
! Meaning
 
|-
 
|-
−
| <code>MEDIA_TYPE_UNKNOWN</code>
+
| <code>INVESTIGATION_TYPE_UNKNOWN</code>
 
| style="text-align:center;" | 0
 
| style="text-align:center;" | 0
−
| We don't know what type of media this is.
+
| We don't know what type of investigation this is.
−
|-
 
−
| <code>MEDIA_TYPE_LOGICAL_FILES</code>
 
−
| style="text-align:center;" | 1
 
−
| A folder on the loader machine.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_HARD_DISK</code>
 
−
| style="text-align:center;" | 2
 
−
| The media is a physical hard drive connected, hopefully through a write-blocker, to the loader machine processed as a bag of sectors.
 
−
|-
 
−
| <code>MEDIA_TYPE_HARD_DISK_IMAGE</code>
 
−
| style="text-align:center;" | 3
 
−
| A forensic copy of a hard disk in a file.
 
−
|-
 
−
| <code>MEDIA_TYPE_HARD_DISK_FOLDER</code>
 
−
| style="text-align:center;" | 4
 
−
| A hard drive as a folder. Mounting a hard disk image is an example. Truxton relied on the host operating system to interpret the file system on the media.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_CD</code>
 
−
| style="text-align:center;" | 5
 
−
| A compact disc attached to the loader machine processed as a bag of sectors.
 
−
|-
 
−
| <code>MEDIA_TYPE_CD_IMAGE</code>
 
−
| style="text-align:center;" | 6
 
−
| A forensic copy of a compact disc in a file.
 
−
|-
 
−
| <code>MEDIA_TYPE_CD_FOLDER</code>
 
−
| style="text-align:center;" | 7
 
−
| A compact disc mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_DVD</code>
 
−
| style="text-align:center;" | 8
 
−
| A DVD attached to the loader machine processed as a bag of sectors.
 
−
|-
 
−
| <code>MEDIA_TYPE_DVD_IMAGE</code>
 
−
| style="text-align:center;" | 9
 
−
| A forensic copy of a DVD in a file.
 
−
|-
 
−
| <code>MEDIA_TYPE_DVD_FOLDER</code>
 
−
| style="text-align:center;" | 10
 
−
| A DVD mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_BLURAY</code>
 
−
| style="text-align:center;" | 11
 
−
| A BluRay attached to the loader machine processed as a bag of sectors.
 
−
|-
 
−
| <code>MEDIA_TYPE_BLURAY_IMAGE</code>
 
−
| style="text-align:center;" | 12
 
−
| A forensic copy of a BluRay disc in a file.
 
−
|-
 
−
| <code>MEDIA_TYPE_BLURAY_FOLDER</code>
 
−
| style="text-align:center;" | 13
 
−
| A folder on a BluRay physically attached to the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_THUMB_DRIVE</code>
 
−
| style="text-align:center;" | 14
 
−
| A thumb drive attached to the loader machine processed as a bag of sectors.
 
−
|-
 
−
| <code>MEDIA_TYPE_THUMB_DRIVE_IMAGE</code>
 
−
| style="text-align:center;" | 15
 
−
| A forensic copy of a thumb drive in a file.
 
−
|-
 
−
| <code>MEDIA_TYPE_THUMB_DRIVE_FOLDER</code>
 
−
| style="text-align:center;" | 16
 
−
| A thumb drive mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
 
−
|-
 
−
| <code>MEDIA_TYPE_PHYSICAL_SIM_CARD</code>
 
−
| style="text-align:center;" | 17
 
−
| A SIM card attached to the loader machine.
 
−
|-
 
−
| <code>MEDIA_TYPE_SIM_CARD_IMAGE</code>
 
−
| style="text-align:center;" | 18
 
−
| A forensic copy of a SIM card in a file.
 
 
|-
 
|-
−
| <code>MEDIA_TYPE_SIM_CARD_FOLDER</code>
+
| <code>INVESTIGATION_TYPE_TRAINING</code>
−
| style="text-align:center;" | 19
+
| style="text-align:center;" | 1294317807
−
| A SIM card mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
+
| An investigation for the purpose of training an analyst.
 
|-
 
|-
−
| <code>MEDIA_TYPE_PHYSICAL_SD_CARD</code>
+
| <code>INVESTIGATION_TYPE_FRAUD</code>
−
| style="text-align:center;" | 20
+
| style="text-align:center;" | 1433479426
−
| An SD card attached to the loader machine.
+
| This is a fraud case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_SD_CARD_IMAGE</code>
+
| <code>INVESTIGATION_TYPE_CHILD_EXPLOITATION</code>
−
| style="text-align:center;" | 21
+
| style="text-align:center;" | -1917039916
−
| A forensic copy of an SD card in a file.
+
| A child exploitation case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_SD_CARD_FOLDER</code>
+
| <code>INVESTIGATION_TYPE_SUSPICIOUS_DEATH</code>
−
| style="text-align:center;" | 22
+
| style="text-align:center;" | 618357760
−
| An SD card mounted as a folder on the loader machine. Truxton relied on the host operating system to interpret the file system on the media.
+
| A death under unusual circumstances.
 
|-
 
|-
−
| <code>MEDIA_TYPE_RAM</code>
+
| <code>INVESTIGATION_TYPE_MISSING_PERSON</code>
−
| style="text-align:center;" | 23
+
| style="text-align:center;" | 2095812006
−
| A dump of memory.
+
| The disappearance of someone.
 
|-
 
|-
−
| <code>MEDIA_TYPE_FLOPPY_DISK_IMAGE</code>
+
| <code>INVESTIGATION_TYPE_BATTERY</code>
−
| style="text-align:center;" | 24
+
| style="text-align:center;" | 1540437532
−
| A forensic copy of a [https://en.wikipedia.org/wiki/Floppy_disk floppy diskette].
+
| A battery case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_FLASH</code>
+
| <code>INVESTIGATION_TYPE_INTERNAL</code>
−
| style="text-align:center;" | 25
+
| style="text-align:center;" | 772945205
−
| A dump of flash memory chips.
+
| An internal investigation.
 
|-
 
|-
−
| <code>MEDIA_TYPE_GPS</code>
+
| <code>INVESTIGATION_TYPE_ASSAULT</code>
−
| style="text-align:center;" | 26
+
| style="text-align:center;" | 282345722
−
| A dump of a GPS device.
+
| An assault investigation.
 
|-
 
|-
−
| <code>MEDIA_TYPE_TAR</code>
+
| <code>INVESTIGATION_TYPE_ROBBERY</code>
−
| style="text-align:center;" | 27
+
| style="text-align:center;" | 40712228
−
| A [https://en.wikipedia.org/wiki/Tar_(computing) TAR] file.
+
| A robbery case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_RAR</code>
+
| <code>INVESTIGATION_TYPE_DRUG</code>
−
| style="text-align:center;" | 28
+
| style="text-align:center;" | -1624394863
−
| A [https://en.wikipedia.org/wiki/RAR_(file_format) RAR] file.
+
| A drug case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_ZIP</code>
+
| <code>INVESTIGATION_TYPE_CIVIL</code>
−
| style="text-align:center;" | 29
+
| style="text-align:center;" | -578586218
−
| A [https://en.wikipedia.org/wiki/Zip_(file_format) ZIP] file.
+
| A civil case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_FORENSIC_DATA</code>
+
| <code>INVESTIGATION_TYPE_GANG</code>
−
| style="text-align:center;" | 30
+
| style="text-align:center;" | -807464012
−
| Data pulled from evidence by forensic technicians.
+
| A gang case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_ASSOCIATED_DATA</code>
+
| <code>INVESTIGATION_TYPE_HOMICIDE</code>
−
| style="text-align:center;" | 31
+
| style="text-align:center;" | -1142204208
−
| Data relevant to the case but doesn't come from seized media such as photos of the media, crime scene, etc.
+
| A homicide case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_PHONE</code>
+
| <code>INVESTIGATION_TYPE_UNACCOMPANIED_DEATH</code>
−
| style="text-align:center;" | 32
+
| style="text-align:center;" | -67542183
−
| A dump of a phone.
+
| A investigation of an unaccompanied death.
 
|-
 
|-
−
| <code>MEDIA_TYPE_TABLET</code>
+
| <code>INVESTIGATION_TYPE_LOAC</code>
−
| style="text-align:center;" | 33
+
| style="text-align:center;" | -570969319
−
| A dump of a tablet.
+
| A Law of Armed Conflict case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_PHYSICAL_ITEMS</code>
+
| <code>INVESTIGATION_TYPE_DATA_RECOVERY</code>
−
| style="text-align:center;" | 34
+
| style="text-align:center;" | -762708792
−
| Non-digital evidence collected from the crime scene such as pieces of paper, writing on a wall, etc.
+
| A data recovery case.
 
|-
 
|-
−
| <code>MEDIA_TYPE_ABORT_LOAD</code>
+
| <code>INVESTIGATION_TYPE_OTHER</code>
−
| style="text-align:center;" | 32749
+
| style="text-align:center;" | 99897732
−
| A request has been made to abort any loading of this media.
+
| Some generic reason for having an investigation.
 
|}
 
|}

Revision as of 14:02, 29 May 2020

The InvestigationType reference table in the database also contains this information.

Name Value Meaning
INVESTIGATION_TYPE_UNKNOWN 0 We don't know what type of investigation this is.
INVESTIGATION_TYPE_TRAINING 1294317807 An investigation for the purpose of training an analyst.
INVESTIGATION_TYPE_FRAUD 1433479426 This is a fraud case.
INVESTIGATION_TYPE_CHILD_EXPLOITATION -1917039916 A child exploitation case.
INVESTIGATION_TYPE_SUSPICIOUS_DEATH 618357760 A death under unusual circumstances.
INVESTIGATION_TYPE_MISSING_PERSON 2095812006 The disappearance of someone.
INVESTIGATION_TYPE_BATTERY 1540437532 A battery case.
INVESTIGATION_TYPE_INTERNAL 772945205 An internal investigation.
INVESTIGATION_TYPE_ASSAULT 282345722 An assault investigation.
INVESTIGATION_TYPE_ROBBERY 40712228 A robbery case.
INVESTIGATION_TYPE_DRUG -1624394863 A drug case.
INVESTIGATION_TYPE_CIVIL -578586218 A civil case.
INVESTIGATION_TYPE_GANG -807464012 A gang case.
INVESTIGATION_TYPE_HOMICIDE -1142204208 A homicide case.
INVESTIGATION_TYPE_UNACCOMPANIED_DEATH -67542183 A investigation of an unaccompanied death.
INVESTIGATION_TYPE_LOAC -570969319 A Law of Armed Conflict case.
INVESTIGATION_TYPE_DATA_RECOVERY -762708792 A data recovery case.
INVESTIGATION_TYPE_OTHER 99897732 Some generic reason for having an investigation.
Retrieved from "https://truxwiki.com/index.php?title=Investigation_Types&oldid=1238"