Desktop Search Tools - A Security Investigator's New Best Friend
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Security investigations are never easy.
Imagine the perfect Friday afternoon. Imagine thoughts of leaving early or even on time; it’s been a long week. But stow that, you soon find out Boy WonderCoder left the company in a huff, just an hour ago, under very suspicious conditions. Yes, the one person most needed for your company’s next big product just walked out the door mumbling dire threats.
Management wants to know if there are any signs of Intellectual Property loss, and you’re the person who gets to provide that initial analysis...in an hour.
In your favor: your decision to have this guy’s PC, email, and LAN files backed up every evening. In his favor: his managers allowed him continued system access for the rest of the day. Yes, that’s five hours of uninterrupted access to all files and systems housing Project X files, even after loudly complaining about the company.
By now, most of your support allies have left for the door, and you need to look for signs of problems in the guy’s Outlook email file, in his Office files (*.doc, *.xls, etc), and in all of the PDF and ZIP files he may have had. You need to check a lot of different file types on too many different systems. Only one ally has provided WonderCoder’s files from the night and week before on new LAN shares. Time to begin security triage.
Sure, you know about "grep" and "find" and a lot of other text search tools, but we’re talking about some odd file types. What do you do? You download and install a copy of Microsoft Windows Desktop Search.
Windows Desktop Search is a very cool tool to use when you must wade through thousands of files. Maybe you need to look for signs; maybe WonderCoder is sending emails to your competitors. You can do it. Maybe you need to rifle through his contact list for competitor’s names. Sure. Maybe you want to check WonderCoder’s meetings or browser favorites or even videos for information linking Boy WonderCoder to your competitors. Can do. Email attachments have you concerned? Search away.
This article will provide enough basic, easy-to-use information examining all kinds of files for interesting information. This article won’t define the legality of any of these searches in your part of the world. It also won’t provide the perfect search terms that generate the clearest results. Anyone who has used search engines knows that definitive search terms are tough to create. This article is not indicative of an actual investigation, actual person(s), or actual events. No, not at all. Lastly, while a basic knowledge of SQL is helpful, it’s not required. After all, we’re Information Security professionals.
Basic Searches 101
We can’t cover how to install the search tool or configure what file folders are searched. Check online help. Once you’ve done these tasks and have allowed indexing to complete, it’s time to search.
Let’s begin by searching for all files relating to Boy WonderCoder’s projects. As you can see from Figure 1, the Search tool allows you to specify the file types returned.
)
Figure 1: Typing in a simple search term
However, this may return too many "hits" or files to investigate. So, let’s try some more terms. There are six types of search modifiers that you can use with the search terms, three are key words, and three are punctuation marks. Each is described in the table below.
Table 1: Basic Search Modifiers and How They Are Used
Search Modifier |
Meaning |
Examples |
AND |
Show files that have both search terms |
Competitor AND ProjectName |
OR |
Show files that have one or the other search terms, but not both |
Competitor OR ProjectName |
NOT, - |
Negate the search term that follows, useful for excluding terms from the results |
ProjectName NOT CompanyName, ProjectName -CompanyName |
(Parentheses) |
Look for enclosed search terms in any order |
(ProjectName Worth) |
"Quotation Marks" |
Find the exact search phrase as typed |
"ProjectName Sourcecode" |
< > |
Find values Less Than or Greater Than the search term |
Date: >yesterday Date:<04/12/06 |
By using these six simple modifiers, you can create reasonably precise search statements that focus your returned files. Just remember that you must use uppercase letters for the key words and that you can’t use two or more key words in a query. After all, this is a simple search tool and not a full-blown database.