Why is Truxton so Extensible

Well, to meet your needs, that’s why.

Introduction

The field of digital forensics is far too large to be mastered by any single vender, lab, organization, agency, or government. No single tool can meet all of a customer’s needs. Truxton’s extensible processing architecture allows customers to integrate their existing tools and know-how into a scalable work flow. In short, Truxton is extensible so it can become part of your investigative workflow.

Sample Scenarios

Let’s demonstrate some of this extensibility with some sample scenarios.

Truxton doesn’t identify file types I need

There will always be new types of files springing into existence. Suppose you have expended many hours creating your own file identification system that uses XML files to describe file signatures. Here's how to use your custom file identifier in Truxton:

1. Create a scheme to convert your file type identifier to an integer (16-bit).
2. Enumerate through your file types and add them to the [FileType] table. Here’s sample code in Python and C.
3. Create an ETL process to receive unknown file types. Here’s sample code in Python or C.
4. Register your ETL with Truxton. Add your ETL to the Truxton Service for it to automatically start with the other ETL processes.

Congratulations! You have now extended Truxton’s file identification capability to match your own.

Truxton doesn’t exploit my file types

If Truxton doesn’t know how to exploit a particular file type:

1. Create an ETL process to exploit the file type. Here’s sample code in Python or C.
2. Register your ETL with the Truxton Service so it will run

I have a better way to exploit this file type

Yay. Change the [ETLRoute] table. Find the records matching the FileTypeID column and modify the ETLQueueName column to hold the name of the queue associated with your exploiter.

I want to export Truxton data in a custom JSON format

Use Python or C to enumerate through Truxton.

I want to use my own file carver

1. Create an ETL that listens to the "carve" message queue
2. Replace the “carve” ETL in TruxtonService.xml to use your executable

I want to use my own User Interface

Truxton’s Analyst Desktop is a graphical user interface that queries a database and puts the results onto the screen. There’s nothing stopping you from creating your own interface or integrating Truxton into an existing UI. The database schema is designed to be easily understood by humans. All tables and columns are documented. There are also useful queries.