Origin
Jump to navigation
Jump to search
When Truxton stores files, it will tell you where the file came from.
This is stored in the Origin column of the File table in the database.
This information is also kept in the Origin database table.
| Name | Value | Meaning |
|---|---|---|
ORIGIN_UNKNOWN
|
0 | We don't know where this file came from. |
ORIGIN_NORMAL
|
1 | The file came from the media as an overt file. It was a normal entry in the media's filesystem. |
ORIGIN_UNDELETED
|
2 | The file is the result of un-deleting it from the source filesystem. |
ORIGIN_CARVED
|
3 | The file is the result of searching a byte stream for a file format (carving). |
ORIGIN_EXPANDED
|
4 | The file came out of another file in Truxton. Child files of a Zip archive are ORIGIN_EXPANDED
|
ORIGIN_ASSOCIATED
|
5 | The file was uploaded to Truxton by a user and associated with media. |
ORIGIN_GENERATED
|
6 | Truxton generated this file during exploitation. Snippet files are an example. |
ORIGIN_EMAIL_BODY
|
7 | The file is the body of an email parsed by Truxton. |
ORIGIN_EMAIL_ATTACHMENT
|
8 | The file is an attachment to an email parsed by Truxton. |
ORIGIN_VOLUME_SHADOW_COPY
|
9 | The file came from a Volume Shadow in NTFS. |
ORIGIN_MMS_ATTACHMENT
|
10 | The file is the payload of an MMS message. |
ORIGIN_STITCHED
|
11 | The file was stitched back together from fragments scattered throughout the media free space. It is a de-fragmented carved file. |
ORIGIN_SLACK
|
12 | The file came from the slack space of a normal file in the filesystem of the media. |
