Tornado Terminology
Core Terms
Section titled “Core Terms”Collection
Section titled “Collection”The process of gathering digital evidence from cloud platforms. A collection refers to a single operation that retrieves specific data types from selected accounts.
A logical container that holds one or more collections and their associated evidence. Cases help organize investigations systematically.
Evidence
Section titled “Evidence”Digital data collected from cloud platforms, stored in an SQLite database format for analysis and export.
Platform Terms
Section titled “Platform Terms”Google Workspace (GWS)
Section titled “Google Workspace (GWS)”- Mail Data: Emails, attachments, and settings.
- Drive Activities: File sharing and access logs.
- Reports: Administrative and security logs.
- Admin Data: System configurations and policies.
Microsoft 365 (O365)
Section titled “Microsoft 365 (O365)”- Mail Data: Exchange emails and metadata.
- Entra Data: Sign-in and audit logs (formerly Azure AD).
- Admin Actions: System changes and configurations.
Interface Elements
Section titled “Interface Elements”Collectors
Section titled “Collectors”Components designed to gather specific types of data:
- Mail Collector
- Drive Activity Collector
- Reports Collector
- Admin Collector
Collection Modes
Section titled “Collection Modes”- Normal User: Collection using standard user credentials.
- Admin/Service: Collection using administrative or service account access.
Progress States
Section titled “Progress States”- Pending: Collection is awaiting start.
- Running: Collection is in progress.
- Completed: Collection finished successfully.
- Failed: Collection encountered errors.
Technical Terms
Section titled “Technical Terms”HTTP Trace
Section titled “HTTP Trace”Detailed logging of API communications, used for troubleshooting and debugging.
SQLite Database
Section titled “SQLite Database”The storage format is used for organizing and exporting collected evidence.
OAuth 2.0
Section titled “OAuth 2.0”A secure authentication protocol is used to access cloud platforms during collection.
Common Actions
Section titled “Common Actions”Authentication
Section titled “Authentication”The process of logging into cloud platforms to enable data collection.
Export
Section titled “Export”Saving collected evidence in an SQLite database format for use outside the system.
Collection Configuration
Section titled “Collection Configuration”Customizable settings and parameters that define the scope and type of data to be collected.