Difference between revisions of "Stitch"
| Line 33: | Line 33: | ||
The expander can fill out all that is known about the file like File Name, File Size. | The expander can fill out all that is known about the file like File Name, File Size. | ||
Fixing up this reference means we have to query this media to see if there is an original file that matches the reference. | Fixing up this reference means we have to query this media to see if there is an original file that matches the reference. | ||
| + | It will attempt to fix references from: | ||
| + | * EMail Attachments | ||
| + | * MMS Attachments | ||
| + | * [[Type_vCard|vCard]] Attachments | ||
==Apple Filesystem Event Consolidation== | ==Apple Filesystem Event Consolidation== | ||
Stitch will gather all of the [[Type_Apple_Filesystem_Events|Apple Filesystem Events]] files and produce a single <code>FSEvents.sql</code> file that can be used to create a SQLite database compatible with [https://www.crowdstrike.com/blog/using-os-x-fsevents-discover-deleted-malicious-artifact/ other tools]. | Stitch will gather all of the [[Type_Apple_Filesystem_Events|Apple Filesystem Events]] files and produce a single <code>FSEvents.sql</code> file that can be used to create a SQLite database compatible with [https://www.crowdstrike.com/blog/using-os-x-fsevents-discover-deleted-malicious-artifact/ other tools]. | ||
Revision as of 07:26, 9 August 2024
| Executable | Stitch.exe
|
| Stage | 40 |
| Percent Complete | 62% |
| Message Queue | stitch
|
The Stitch ETL performs the task of gathering files from a piece of media and producing something from it. This ETL will only run once per media.
Contents
Fragmented File Carving
Stitch takes fragments of carved files and puts them back together again. The fragments of the file are put back in order and added as a complete file even though the individual pieces could be randomly scattered throughout the drive.
File Types
Stitch can defragment the following types of files.
File Reference Fixup
Fixing up file references is the task where a reference to a file was found in the media but the file being referenced may not have been. For example, in email or chat, a file (JPG) may have been sent. When Truxton processes the SQLite file containing the chat, it may also contain information about the file that was sent but not the contents of that file. The expander can fill out all that is known about the file like File Name, File Size. Fixing up this reference means we have to query this media to see if there is an original file that matches the reference. It will attempt to fix references from:
- EMail Attachments
- MMS Attachments
- vCard Attachments
Apple Filesystem Event Consolidation
Stitch will gather all of the Apple Filesystem Events files and produce a single FSEvents.sql file that can be used to create a SQLite database compatible with other tools.
