Details
| Executable
|
Expand.exe
|
| Stage
|
3
|
| Percent Complete
|
48%
|
| Message Queue
|
expand
|
Expand is the most capable exploitation process.
It produces files and artifacts.
Capabilities
File Types
Expand processes the following types of files.
| File Type
|
Produces
|
| Type_Physical_Artifacts
|
Artifacts
|
| Type_ASCII_Text
|
File Details
|
| Type_JPEG
|
Artifacts, File Details
|
| Type_JPEGWithExif
|
Artifacts, EXIF, File Details
|
| Type_GIF
|
File Details
|
| Type_PE
|
File Details
|
| Type_ZIP
|
Files, File Details
|
| Type_32bit_Windows_Executable
|
Files, File Details
|
| Type_64bit_Windows_Executable
|
Files, File Details
|
| Type_ROM_Windows_Executable
|
Files, File Details
|
| Type_Word_2007
|
Artifacts, File Details
|
| Type_Excel_2007
|
Artifacts, File Details
|
| Type_PowerPoint_2007
|
Artifacts, File Details
|
| Type_Microsoft_ESE
|
File Details
|
| Type_MPEG4Video
|
Artifacts, EXIF, File Details, Locations
|
| Type_Adobe_PDF
|
Artifacts
|
| Type_Internet_Explorer_History
|
Artifacts, File Details
|
| Type_SQLite_Database
|
Artifacts, Files, File Details
|
| Type_PNG
|
File Details
|
| Type_Firefox_Form_History
|
Artifacts, File Details
|
| Type_Firefox_Downloads
|
File Details
|
| Type_Firefox_Web_Sites_Visited
|
Artifacts, File Details
|
| Type_Chrome_Archived_History
|
File Details
|
| Type_Chrome_Cookies
|
File Details
|
| Type_Chrome_History
|
Artifacts, File Details
|
| Type_Chrome_History_Index
|
File Details
|
| Type_Chrome_Thumbnails
|
File Details
|
| Type_Chrome_Web_Data
|
File Details
|
| Type_Zip_Fragment
|
Files, File Details
|
| Type_RichText
|
Artifacts, File Details
|
| Type_Java_Archive
|
Files, File Details
|
| Type_XP_Prefetch
|
Artifacts, File Details
|
| Type_Vista7_Prefetch
|
Artifacts, File Details
|
| Type_Binary_PList
|
Files
|
| Type_3GP_Video
|
File Details
|
| Type_BZip_Archive
|
Files
|
| Type_TrueType_Font
|
File Details
|
| Type_OpenType_Font
|
File Details
|
| Type_KMZ
|
File Details
|
| Type_Flash_Cookie
|
File Details
|
| Type_Apple_Addressbook_Thumbnails
|
Files, File Details
|
| Type_iOS_Locations
|
File Details, Locations
|
| Type_ZIP_Code_Database
|
File Details
|
| Type_Bible_Database
|
File Details
|
| Type_ATT_Mark_The_Spot_Database
|
File Details, Locations
|
| Type_Shazam_Database
|
File Details, Locations
|
| Type_Apple_Calendar_Database
|
Events, File Details
|
| Type_Ancestry_Database
|
File Details
|
| Type_iOS_SMS
|
Messages, File Details
|
| Type_iOS_Call_History
|
Events, File Details
|
| Type_Skype_Main
|
Artifacts, Events, File Details
|
| Type_3G2_Video
|
File Details
|
| Type_GZip
|
Files
|
| Type_Bitmap_Image
|
File Details
|
| Type_TIFF
|
EXIF
|
| Type_Cellebrite_1
|
Artifacts, Events, Locations, Messages
|
| Type_Cellebrite_2
|
Artifacts, Events, Locations, Messages, URLs
|
| Type_MPEG2Video
|
EXIF
|
| Type_Windows_Registry
|
File Details
|
| Type_SAM_Registry
|
File Details
|
| Type_System_Registry
|
File Details
|
| Type_Boot_Registry
|
File Details
|
| Type_User_Registry
|
File Details
|
| Type_Software_Registry
|
File Details
|
| Type_Vista7_Thumbnail_Cache
|
Files
|
| Type_Microsoft_Cabinet
|
Files
|
| Type_Adobe_Flash_Video_New
|
File Details
|
| Type_Evernote_Database
|
File Details
|
| Type_vCard
|
Artifacts
|
| Type_vCard_Unicode
|
Artifacts
|
| Type_xCard
|
Artifacts
|
| Type_Ogg_Theora
|
File Details
|
| Type_Encrypted_ZIP
|
File Details
|
| Type_Outlook_Personal_Folders
|
File Details
|
| Type_Torrent
|
File Details
|
| Type_Setup_API_Log
|
Artifacts, Events
|
| Type_QuickTime_Container
|
File Details
|
| Type_Digital_Media_Broadcasting
|
File Details
|
| Type_Digital_Media_Protection
|
File Details
|
| Type_Dirac_Video
|
File Details
|
| Type_Digital_Video_Broadcast
|
File Details
|
| Type_JPEG_2000
|
File Details
|
| Type_AAC_Audio
|
File Details
|
| Type_AAC_Audio_Book
|
File Details
|
| Type_Motion_JPEG
|
File Details
|
| Type_MPEG_21
|
File Details
|
| Type_MPEG_7
|
File Details
|
| Type_QuickTime_Video
|
File Details, Locations
|
| Type_QuickTime_Cache
|
File Details
|
| Type_Safari_Cache
|
File Details
|
| Type_XRY_XML_File
|
Artifacts, Events, Locations, Messages, URLs
|
| Type_Apple_Voicemail_Database
|
Artifacts, Events, File Details
|
| Type_Apple_Find_My_iPhone_Database
|
File Details, Locations
|
| Type_Windows_Link
|
Artifacts, File Details, URLs
|
| Type_Precompiled_INF
|
File Details
|
| Type_ELF_Executable
|
File Details
|
| Type_Firefox_Offline_Cache
|
Files, File Details, URLs
|
| Type_Microsoft_DPAPI_Key
|
File Details
|
| Type_Recycle_Bin_INFO2
|
Events, File Details
|
| Type_Opera_Typed_URL_Cache
|
Events
|
| Type_MIME_Message
|
Files
|
| Type_BluRay_PlayList
|
File Details
|
| Type_NTFS_Log_File
|
File Details
|
| Type_Android_WiFi_Cache
|
Artifacts, Events, Locations
|
| Type_Android_Cell_Tower_Cache
|
Events, Locations
|
| Type_Android_Executable_35
|
File Details
|
| Type_Android_Executable_36
|
File Details
|
| Type_Android_Settings_Database
|
File Details
|
| Type_Android_Suggestions_Database
|
Artifacts, Events, File Details
|
| Type_TigerText_Database
|
File Details
|
| Type_Windows_XML_Event_Log
|
Artifacts, Events, Files
|
Event Log Records
Expand processes the following event log record numbers
