Difference between revisions of "Stitch"
| Line 14: | Line 14: | ||
|} | |} | ||
| − | The Stitch ETL takes fragments of carved files and puts them back together again. | + | The Stitch ETL performs the task of gathering files from a piece of media and producing something from it. |
| + | This ETL will only run once per media. | ||
| + | |||
| + | ==Fragmented File Carving== | ||
| + | Stitch takes fragments of carved files and puts them back together again. | ||
The fragments of the file are put back in order and added as a complete file even though the individual pieces could be randomly scattered throughout the drive. | The fragments of the file are put back in order and added as a complete file even though the individual pieces could be randomly scattered throughout the drive. | ||
| − | =File Types= | + | ===File Types=== |
Stitch can defragment the following types of files. | Stitch can defragment the following types of files. | ||
* [[Type_Ogg_Vorbis]] | * [[Type_Ogg_Vorbis]] | ||
* [[Type_Ogg_Theora]] | * [[Type_Ogg_Theora]] | ||
| + | |||
| + | ==File Reference Fixup== | ||
| + | Fixing up file references is the task where a reference to a file was found in the media but the file being referenced may not have been. | ||
| + | For example, in email or chat, a file (JPG) may have been sent. | ||
| + | When Truxton processes the SQLite file containing the chat, it may also contain information about the file that was sent but not the contents of that file. | ||
| + | The expander can fill out all that is known about the file like File Name, File Size. | ||
| + | Fixing up this reference means we have to query this media to see if there is an original file that matches the reference. | ||
| + | |||
| + | ==Apple Filesystem Event Consolidation== | ||
| + | Stitch will gather all of the [[Type_Apple_Filesystem_Events|Apple Filesystem Events]] files and produce a single <code>FSEvents.sql</code> file that can be used to create a SQLite database compatible with [https://www.crowdstrike.com/blog/using-os-x-fsevents-discover-deleted-malicious-artifact/ other tools]. | ||
Revision as of 07:21, 9 August 2024
| Executable | Stitch.exe
|
| Stage | 40 |
| Percent Complete | 62% |
| Message Queue | stitch
|
The Stitch ETL performs the task of gathering files from a piece of media and producing something from it. This ETL will only run once per media.
Contents
Fragmented File Carving
Stitch takes fragments of carved files and puts them back together again. The fragments of the file are put back in order and added as a complete file even though the individual pieces could be randomly scattered throughout the drive.
File Types
Stitch can defragment the following types of files.
File Reference Fixup
Fixing up file references is the task where a reference to a file was found in the media but the file being referenced may not have been. For example, in email or chat, a file (JPG) may have been sent. When Truxton processes the SQLite file containing the chat, it may also contain information about the file that was sent but not the contents of that file. The expander can fill out all that is known about the file like File Name, File Size. Fixing up this reference means we have to query this media to see if there is an original file that matches the reference.
Apple Filesystem Event Consolidation
Stitch will gather all of the Apple Filesystem Events files and produce a single FSEvents.sql file that can be used to create a SQLite database compatible with other tools.
