Load
| Executable | Load.exe
|
| Stage | 1 |
| Percent Complete | 48% |
| Message Queue | loadq
|
Load's purpose in life is to find files, identify their type, eliminate their contents based on known-good MD5 hashes, put the meta-data about the file into a database, contents into a depot, then send messages to other ETL processes that have registered to receive that type of file.
Contents
Loading Zip Files
Load considers Zip files to be a media type. It will expand the zip and add the files found therein. If you want the zip file loaded as if it appeared on media (so you get the zip file details), put the zip file in a folder by itself and load the folder.
Usage
load.exe T:\Bob.E01
Capabilities
Load can ingest the files and folders. If the file is one of the following disk image formats, it will be opened, partitions and filesystems navigated, freespace gathered, files carved, etc.
The following file systems are supported
- ext2 - Linux ext2/3/4
- FAT - Microsoft FAT12/16/32/ex
- HFS - HFS/HFS+
- ISO 9660 - CD/DVD
- NTFS - Microsoft NTFS
- UFS - UFS1/UFS2
- YAFFS - Yet Another Flash File System
Not Loading Data
Load has abilities other than loading data into Truxton.
Merge Hash Sets
Searching a single hash set is faster than searching multiple hash sets.
To improve speed, it is better to combine multiple hash sets into a single file.
Use the mergehashsets option to tell the loader to process the command line as a list of hash sets.
"C:\Program Files\Truxton\Loader\Load.exe" -mergehashsets Yes NSRL.hashset MyLibraryOfAndroidApps.hashset
This will produce an output file named merged.hashset in the current directory that contains the unique hashes from the given sources.
Prism Loads
A prism load is where you have multiple copies of a piece of media that you want loaded into Truxton as a single piece of media. This situation arises when you use multiple tools to image media. For example, you have used ADF, Cellebrite, XRY, and GrayKey to pull data from the same cell phone. Each tool has its own strengths and weaknesses. You now have four images of the same phone. By using a prism load, you can combine the uniqueness of each tool into a single media in Truxton. The analyst has only one media in Truxton, not four.
Prism Load List
The easiest way to perform a prism load is to use a load list.
M: Emilio Lizardo iPhone 4275636B-6172-6F6F-2042-616E7A616938
P: E:\Incoming\EL\ADF\afc_backup.z01
M: Emilio Lizardo iPhone
G: -prism 4275636B-6172-6F6F-2042-616E7A616938
P: E:\Incoming\EL\XRY\Full Log\File
M: Emilio Lizardo iPhone
G: -prism 4275636B-6172-6F6F-2042-616E7A616938
P: E:\Incoming\EL\Cellebrite\C:\ClusterStorage\Incoming\Test Data\Cellebrite\UFED Apple iPhone (ABCDE)\AdvancedLogical File System 01\Apple_iPhone (ABCDE).zip
M: Emilio Lizardo iPhone
G: -prism 4275636B-6172-6F6F-2042-616E7A616938
P: E:\Incoming\EL\Gray\iPhone\0000A755-AA421C94FF44802F\0000A755-AA421C94FF44802F_files_full