Skip to content
Snippets Groups Projects
Commit 842892fa authored by Mark McKinnon's avatar Mark McKinnon
Browse files

Update artifact_catalog.dox

Added new artifacts and attributes
parent df0f8e9d
Branches
Tags
No related merge requests found
...@@ -35,6 +35,23 @@ TSK_CARD_NUMBER (Credit card number) ...@@ -35,6 +35,23 @@ TSK_CARD_NUMBER (Credit card number)
--- ---
## TSK_ACTIVITY
Activity on the system or from an application. Example Usage is a mobile device being locked and unlocked.
.
### REQUIRED ATTRIBUTES
- TSK_DATETIME_START (When activity Started)
or
TSK_DATETIME
### OPTIONAL ATTRIBUTES
- TSK_ACTIVITY_TYPE (Activity Type ie: On or Off)
- TSK_DATETIME_END (When activity ended)
- TSK_PROG_NAME (Name of the program doing the activity)
- TSK_VALUE (Connection Type)
---
## TSK_ASSOCIATED_OBJECT ## TSK_ASSOCIATED_OBJECT
Provides a backwards link to an artifact that references the parent file of this artifact. Example usage is that a downloaded file will have this artifact and it will point back to the TSK_WEB_DOWNLOAD artifact that is associated with a browser's SQLite database. See \ref jni_bb_associated_object. Provides a backwards link to an artifact that references the parent file of this artifact. Example usage is that a downloaded file will have this artifact and it will point back to the TSK_WEB_DOWNLOAD artifact that is associated with a browser's SQLite database. See \ref jni_bb_associated_object.
...@@ -43,6 +60,20 @@ Provides a backwards link to an artifact that references the parent file of this ...@@ -43,6 +60,20 @@ Provides a backwards link to an artifact that references the parent file of this
- TSK_ASSOCIATED_ARTIFACT (Artifact ID of associated artifact) - TSK_ASSOCIATED_ARTIFACT (Artifact ID of associated artifact)
---
## TSK_BACKUP
Details about System/Aplication/File backups.
### REQUIRED ATTRIBUTES
- TSK_DATETIME_STARTED (Date/Time the backup happened)
or
TSK_DATETIME
### OPTIONAL ATTRIBUTES
- TSK_DATETIME_ENDED (Date/Time the backup ended)
--- ---
## TSK_BLUETOOTH_ADAPTER ## TSK_BLUETOOTH_ADAPTER
Details about a Bluetooth adapter. Details about a Bluetooth adapter.
...@@ -136,6 +167,20 @@ Describes how a data source was used, e.g., as a SIM card or an OS drive (such a ...@@ -136,6 +167,20 @@ Describes how a data source was used, e.g., as a SIM card or an OS drive (such a
- TSK_DESCRIPTION (Description of the usage, e.g., "OS Drive (Windows Vista)"). - TSK_DESCRIPTION (Description of the usage, e.g., "OS Drive (Windows Vista)").
---
## TSK_DELETED_PROG
Programs that have been deleted from the system.
### REQUIRED ATTRIBUTES
- TSK_DATETIME_DELETED (Date/Time the program was deleted)
or
TSK_DATETIME
- TSK_PROG_NAME (Program that was deleted)
### OPTIONAL Attributes
- TSK_PATH (Location where the program resided before being deleted)
--- ---
## TSK_DEVICE_ATTACHED ## TSK_DEVICE_ATTACHED
...@@ -163,6 +208,16 @@ Details about a device data source. ...@@ -163,6 +208,16 @@ Details about a device data source.
- TSK_IMSI (IMSI number of the device) - TSK_IMSI (IMSI number of the device)
---
## TSK_DHCP_INFO
DHCP information that is stored.
### REQUIRED ATTRIBUTES
- TSK_NAME (Description of Information)
- TSK_VALUE (Value of Information)
--- ---
## TSK_EMAIL_MSG ## TSK_EMAIL_MSG
...@@ -447,6 +502,20 @@ EXIF metadata found in an image or audio file. ...@@ -447,6 +502,20 @@ EXIF metadata found in an image or audio file.
- TSK_GEO_LONGITUDE (The camera's longitude when the image/audio was taken) - TSK_GEO_LONGITUDE (The camera's longitude when the image/audio was taken)
---
## TSK_NOTIFICATION
Notifications to the user.
### REQUIRED ATTRIBUTES
- TSK_DATETIME (When the notification was sent/received)
- TSK_PROG_NAME (Program to send/receive notification)
### OPTIONAL ATTRIBUTES
- TSK_TITLE (Title of the notification)
- TSK_VALUE (Message being sent or received)
--- ---
## TSK_OBJECT_DETECTED ## TSK_OBJECT_DETECTED
Indicates that an object was detected in a media file. Typically used by computer vision software to classify images. Indicates that an object was detected in a media file. Typically used by computer vision software to classify images.
...@@ -556,6 +625,18 @@ Details about a remote drive found in the data source. ...@@ -556,6 +625,18 @@ Details about a remote drive found in the data source.
---
## TSK_SCREEN_SHOTS
Screen shots from a device or Application.
### REQUIRED ATTRIBUTES
- TSK_DATETIME (When the screenshot was taken)
- TSK_PROG_NAME (Program that took the screenshot)
### OPTIONAL ATTRIBUTES
- TSK_PATH (Location of screenshot)
--- ---
## TSK_SERVICE_ACCOUNT ## TSK_SERVICE_ACCOUNT
An application or web user account. An application or web user account.
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment