Difference between revisions of "How Truxton Works"
(→Load) |
|||
| Line 5: | Line 5: | ||
We will not give details of the design of the Truxton Architecture. | We will not give details of the design of the Truxton Architecture. | ||
| − | The Truxton exploitation process can be broken down into discrete [[ETL Stages | stages]]. | + | The Truxton exploitation process can be broken down into discrete [[ETL Stages|stages]]. |
All processes running at a given stage will execute in parallel. | All processes running at a given stage will execute in parallel. | ||
Early stages can overlap, meaning a later stage can execute in parallel with an earlier stage. | Early stages can overlap, meaning a later stage can execute in parallel with an earlier stage. | ||
Later stages execute serially where a later stage will not begin unless the previous stage has completed. | Later stages execute serially where a later stage will not begin unless the previous stage has completed. | ||
| + | |||
| + | =Overview= | ||
| + | Truxton automates much of the mundane forensic exploitation to produce artifacts and reports allowing analysts to start with information rather than data. | ||
| + | It does this in a scalable way, running 24x7 to keep up with the demands of the incoming data volume. | ||
| + | Truxton's work flow is: | ||
| + | # Ingest raw media to produce files | ||
| + | # Files are exploited to produce artifacts | ||
| + | # As artifacts are discovered, items of interest are automatically tagged | ||
| + | # Artifacts and files are used to produce reports that analysts can distribute | ||
| + | # The Analyst Desktop presents information to the user allowing them to navigate and discover relationships | ||
| + | |||
| + | |||
=Load= | =Load= | ||
| Line 21: | Line 33: | ||
[[Load]] will open the file, determine what type it is and navigate it. | [[Load]] will open the file, determine what type it is and navigate it. | ||
| − | [[Load]]'s purpose in life is to find files, identify their type, eliminate their contents based on known-good [https://en.wikipedia.org/wiki/MD5 MD5] hashes, put the meta-data about the file into a [[File Table | database]], contents into a [[Depot | depot]], then send [[Message Bus Messages | messages]] to other ETL processes that have registered to receive that [[File Types Supported | type of file.]] | + | [[Load]]'s purpose in life is to find files, identify their type, eliminate their contents based on known-good [https://en.wikipedia.org/wiki/MD5 MD5] hashes, put the meta-data about the file into a [[File Table|database]], contents into a [[Depot|depot]], then send [[Message Bus Messages|messages]] to other ETL processes that have registered to receive that [[File Types Supported|type of file.]] |
| − | = | + | =Exploit= |
| − | The next stage, which runs in parallel with [[#Load | Load]], | + | The next stage, which runs in parallel with [[#Load | Load]], exploits files to produce: |
| − | * More files - When Truxton encounters a file archive (like a [[Type_ZIP | zip]] file), it will extract the files from that archive. | + | * More files - When Truxton encounters a file archive (like a [[Type_ZIP|zip]] file), it will extract the files from that archive and send them through the exploitation pipeline. |
* Artifacts - Truxton will exploit files to extract [[Entity Types | things]] like serial numbers, accounts, etc that analysts can use in their examinations. | * Artifacts - Truxton will exploit files to extract [[Entity Types | things]] like serial numbers, accounts, etc that analysts can use in their examinations. | ||
| − | * Events - Significant [[Event Types | events]] such as connecting to networks, running programs, etc. to plot them on a time line. | + | * Events - Significant [[Event Types|events]] such as connecting to networks, running programs, etc. to plot them on a time line. |
| − | * Geographic Locations - [[Location Types | Places]] embedded in photos, videos, drones, etc. | + | * Geographic Locations - [[Location Types|Places]] embedded in photos, videos, drones, etc. |
| − | * Camera Information - Truxton extracts camera [[EXIF Table | make, model and serial numbers]] from photos and videos. | + | * Camera Information - Truxton extracts camera [[EXIF Table|make, model and serial numbers]] from photos and videos. |
=Reporting= | =Reporting= | ||
Revision as of 18:27, 16 December 2020
Truxton was designed to exploit data in a scalable way. You can add more exploitation processes on your loader machine or you can add more machines to the exploitation process.
This high level overview will give you an idea of what Truxton is doing. We will not give details of the design of the Truxton Architecture.
The Truxton exploitation process can be broken down into discrete stages. All processes running at a given stage will execute in parallel. Early stages can overlap, meaning a later stage can execute in parallel with an earlier stage. Later stages execute serially where a later stage will not begin unless the previous stage has completed.
Contents
Overview
Truxton automates much of the mundane forensic exploitation to produce artifacts and reports allowing analysts to start with information rather than data. It does this in a scalable way, running 24x7 to keep up with the demands of the incoming data volume. Truxton's work flow is:
- Ingest raw media to produce files
- Files are exploited to produce artifacts
- As artifacts are discovered, items of interest are automatically tagged
- Artifacts and files are used to produce reports that analysts can distribute
- The Analyst Desktop presents information to the user allowing them to navigate and discover relationships
Load
Someone has decided that they have data that needs Truxton exploitation. Let's say it is a hard drive image in the popular E01 format, Bob.E01
The entry point for Truxton is the Load process.
load.exe T:\Bob.E01
Load will open the file, determine what type it is and navigate it. Load's purpose in life is to find files, identify their type, eliminate their contents based on known-good MD5 hashes, put the meta-data about the file into a database, contents into a depot, then send messages to other ETL processes that have registered to receive that type of file.
Exploit
The next stage, which runs in parallel with Load, exploits files to produce:
- More files - When Truxton encounters a file archive (like a zip file), it will extract the files from that archive and send them through the exploitation pipeline.
- Artifacts - Truxton will exploit files to extract things like serial numbers, accounts, etc that analysts can use in their examinations.
- Events - Significant events such as connecting to networks, running programs, etc. to plot them on a time line.
- Geographic Locations - Places embedded in photos, videos, drones, etc.
- Camera Information - Truxton extracts camera make, model and serial numbers from photos and videos.
Reporting
Once all of the files and meta data have been produced, Truxton can can apply automation to jumpstart an investigation with reports such as:
- Media Summary Report - This report is a non-technical summary of the media that was loaded. It will give you information about the life of the media, activity in the last 24 hours of that life, USB devices seen on the device, etc.
- Geographic Report - A KMZ with all of the geographic coordinates found in the media to include Sensitive Site Violations.
Analysis
A user doesn't have to wait until reporting has finished in order to begin using the Desktop GUI to look at the data. The user interface is completely separate from the load/expand/report processes. Through the Desktop, users can view files, query for artifacts, see activity on a timeline, review videos, etc.
