- Basic Searches 101
- Time Based Searches
- Person and Organizational Searches
- Other Relevant Searches
- Expanding on the Tool
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Expanding on the Tool
Windows Desktop Search has many neat abilities. It can do deep searches into a lot of different file types. It’s even extensible. The IFilter interface can be configured to do the search you need (information currently at http://msdn2.microsoft.com/en-us/library/ms691105.aspx). Maybe you have an employee suspected of harvesting Social Security or credit card numbers from other employees. Perhaps you can create an IFilter and run the query as part of a login script. Or maybe run a late night script enabled by Wake-on-LAN settings or through background processes spawned by SMS. Results could be saved to a LAN share for later review.
At this point, many readers might feel this is somewhat Orwellian. Mac OS X’s spotlight, Google’s Desktop tool, and other search engines have as many search abilities. Let’s face it; our lives are full of files: our financial spreadsheets, kid jpegs, music files, etc. The goal of these tools is to aid us users with finding the information more quickly.
But if the equipment and networks provided to you are your employer’s, expect these tools to be used to aid their investigations as well. Search tools are increasingly available as add-ons or as baseline abilities in the operating system. Think twice before using these in ways management may not approve.
Note to actual Information Security Investigators: these search features are built into Vista by default no special client install needed. Additionally, there is an optional "natural language" interface that can make query writing easier.
So, without creating scripts and binaries, you found enough issues to provide managers a fairly comprehensive report, one that shows your competition engaging workers in suspicious ways. You reviewed many file and data types without using fancy languages or libraries. You even avoided the expense and learning curve of a dedicated Forensics tool. And you did so within the small time provided thanks to your new found friend. Time to go home and enjoy your weekend.