Difference between revisions of "How Truxton Works"
| Line 2: | Line 2: | ||
You can add more exploitation processes on your loader machine or you can add more machines to the exploitation process. | You can add more exploitation processes on your loader machine or you can add more machines to the exploitation process. | ||
| − | This | + | This high level overview will give you an idea of what Truxton is doing. |
| − | We will not give | + | We will not give details of the design of the Truxton Architecture. |
| − | The process can be broken down into discrete [[ETL Stages | stages]]. | + | The Truxton exploitation process can be broken down into discrete [[ETL Stages | stages]]. |
| − | All processes running at a given stage execute in parallel. | + | All processes running at a given stage will execute in parallel. |
| + | Early stages can overlap, meaning a later stage can execute in parallel with an earlier stage. | ||
| + | Later stages execute serially where a later stage will not begin unless the previous stage has completed. | ||
=Load= | =Load= | ||
Someone has decided that they have data that needs Truxton exploitation. | Someone has decided that they have data that needs Truxton exploitation. | ||
| − | Let's say it is a hard drive image in the popular E01 format, ''Bob.E01'' | + | Let's say it is a hard drive image in the popular [https://en.wikipedia.org/wiki/EnCase#Expert_Witness_File_Format E01] format, ''Bob.E01'' |
| − | |||
The entry point for Truxton is the [[Load]] process. | The entry point for Truxton is the [[Load]] process. | ||
| Line 24: | Line 25: | ||
=Expand= | =Expand= | ||
The next stage, which runs in parallel with [[#Load | Load]], expands files to produce: | The next stage, which runs in parallel with [[#Load | Load]], expands files to produce: | ||
| − | * More files | + | * More files - When Truxton encounters a file archive (like a [[Type_ZIP | zip]] file), it will extract the files from that archive. |
| − | * Artifacts | + | * Artifacts - Truxton will exploit files to extract [[Entity Types | things]] like serial numbers, accounts, etc that analysts can use in their examinations. |
| − | * Events | + | * Events - Significant [[Event Types | events]] such as connecting to networks, running programs, etc. to plot them on a time line. |
| − | * Geographic Locations | + | * Geographic Locations - [[Location Types | Places]] embedded in photos, videos, drones, etc. |
| − | * Camera Information | + | * Camera Information - Truxton extracts camera [[EXIF Table | make, model and serial numbers]] from photos and videos. |
=Reporting= | =Reporting= | ||
Sensitive Sites, etc. | Sensitive Sites, etc. | ||
Revision as of 12:45, 10 June 2020
Truxton was designed to exploit data in a scalable way. You can add more exploitation processes on your loader machine or you can add more machines to the exploitation process.
This high level overview will give you an idea of what Truxton is doing. We will not give details of the design of the Truxton Architecture.
The Truxton exploitation process can be broken down into discrete stages. All processes running at a given stage will execute in parallel. Early stages can overlap, meaning a later stage can execute in parallel with an earlier stage. Later stages execute serially where a later stage will not begin unless the previous stage has completed.
Load
Someone has decided that they have data that needs Truxton exploitation. Let's say it is a hard drive image in the popular E01 format, Bob.E01
The entry point for Truxton is the Load process.
load.exe T:\Bob.E01
Load will open the file, determine what type it is and navigate it. Load's purpose in life is to find files, identify their type, eliminate their contents based on known-good MD5 hashes, put the meta-data about the file into a database, contents into a depot, then send messages to other ETL processes that have registered to receive that type of file.
Expand
The next stage, which runs in parallel with Load, expands files to produce:
- More files - When Truxton encounters a file archive (like a zip file), it will extract the files from that archive.
- Artifacts - Truxton will exploit files to extract things like serial numbers, accounts, etc that analysts can use in their examinations.
- Events - Significant events such as connecting to networks, running programs, etc. to plot them on a time line.
- Geographic Locations - Places embedded in photos, videos, drones, etc.
- Camera Information - Truxton extracts camera make, model and serial numbers from photos and videos.
Reporting
Sensitive Sites, etc.
