Skip to main content

Who is this article for?

Code42 for Enterprise
CrashPlan for Small Business

Code42 for Enterprise, yes.

CrashPlan for Small Business, no.

This article applies to Code42 cloud environments.

HOME
GETTING STARTED
RELEASE NOTES
FAQS
SYSTEM STATUS
Code42 Support

Forensic Search reference guide

Who is this article for?

Code42 for Enterprise
CrashPlan for Small Business

Code42 for Enterprise, yes.

CrashPlan for Small Business, no.

This article applies to Code42 cloud environments.

Overview

Forensic Search is a powerful search interface that enables security teams to monitor and investigate suspicious file activity. Forensic Search provides detailed visibility about files:

  • Stored on user devices, including files not selected for backup
  • Stored in corporate cloud services, such as Google Drive and Microsoft OneDrive
  • Synced to personal cloud services, such as Box, Dropbox, iCloud, and OneDrive
  • Moved to removable media
  • Sent as email attachments in Microsoft Office 365 and Gmail
  • Sent to printers (Mac and Linux only)

This enables security personnel to gain a clearer understanding of file activity throughout the organization.

In order to see results in Forensic Search, you must first enable File Metadata Collection

For cloud services and email services configuration instructions, see Introduction to adding data sources

Forensic Search

To access Forensic Search:

  1. Sign in to the Code42 console.
  2. Select Investigation > Forensic Search.
What is a "file event"?
Forensic Search reports on file events detected by Code42. A file event is defined as any activity observed for a file. For example, creating, modifying, renaming, moving, or deleting a file generates an event for that file. Events are reported for both user and system actions.

Search results

Forensic Search results

Item   Description
a Search Displays search criteria and results.
b Saved Searches Displays the list of Saved Searches.
c Load Saved Search Displays a searchable list of searches created and saved by users in your Code42 environment. Click the name of a search to immediately execute that search and display the results.
d Date selector

All searches must specify a date range. Select one the following options:

  • Events observed in the last: Select a pre-defined time period ranging from the past 15 minutes to the past 30 days. This is especially useful for saved searches because they can be used at any time in the future and still search the same relative time period.
  • Events observed on or after: Search events on or after a specific date and time. To include all events on the start date, enter a time value of 00:00:00.
  • Events observed on or before: Search events on or before a specific date and time. To include all events on the end date, enter a time value of 23:59:59. 
  • Events observed is in range: Search events between specific start and end dates/times. Enter a time range of 00:00:00 to 23:59:59 to include all events on the start and end dates.

Times are evaluated as Coordinated Universal Time (UTC).

e Search filters

Select an item from the menu to base your search on:

Event

Print

  • Printer Name
  • Print Job Name

File

  • Filename
  • File Path
  • File Size
  • File Category
  • File Owner
  • MD5 Hash
  • SHA256 Hash

Device

  • Hostname
  • Username (Code42)
  • Username (signed in to device)
  • IP Address (public)
  • IP Address (private)
  • Remote Activity

Cloud (visible only with licensing for one or more cloud service data sources)

  • Directory ID
  • Actor
  • Shared With
  • Shared
  • File exposure changed to

Exposure (visible only with licensing for the endpoint data source)

  • Exposure Type
  • Device Vendor
  • Device Name
  • Device Media Name
  • Device Volume Name
  • Device Partition ID
  • Device Serial Number
  • Executable Name
  • Tab/Window Title
  • Tab URL
  • Sync Destination

Email (visible only with licensing for the email data source)

  • Policy Names
  • Subject
  • Sender
  • From
  • Recipients
f Search operator

Search operator options vary based on the search filter.

  • Single value
    • Is: Returns events that match the search criteria
    • Is not: Excludes events that match the search criteria
    • Exists: Returns events including any value for the search criteria
    • Does not exist: Returns events with no value for the search criteria
  • Multi-value (OR)
    • Includes any: Returns events that match any item in the list of search criteria. This search is evaluated as though the "OR" operator exists between each value.
    • Includes none: Returns events that do not match the items included in the list of search criteria.

For File Size, select is greater than or is less than.

 

For Shared With, select Contains or Does not contain to enter search criteria for a specific user.

g Value

Defines the search criteria. Searches are case-insensitive.

 

For multi-value searches (includes any or includes none), enter each value on a separate line. Do not enter a comma-separated list.

 

Use the * wildcard character to search for a partial string. Use the ? wildcard to replace a single character. File size For example:

  • Enter the search string expenses* to return events for any filename beginning with the phrase expenses, such as expenses.xls, expenses.doc, expenses to review.txt, and so on.
  • Enter the search string expenses201?.xls to return events only for filenames matching that exact pattern, such as expenses2016.xls, expenses2017.xls, and so on.

Wildcards are supported for all search filters except MD5 hash, SHA256 hash, IP address, and file size.

Avoid starting a search term with a wildcard
Entering a search string that begins with a wildcard or contains only wildcards is not recommended (for example, filename is * or file path is *documents). These searches may take a long time to complete and can return many millions of results, which are not practical to review or export.
  • File Path searches require a trailing slash (/) or wildcard at the end of the search term. For example:
    • Enter /Users/Clyde/ExampleFolder/ to view only events for files in ExampleFolder.
    • Enter  /Users/Clyde/ExampleFolder* to view events for files in ExampleFolder and any subfolders.

For File Size, enter a whole number (decimals are not supported) and then select a unit of measurement (bytes, kB, MB, or GB).

h Remove search criteria Removes this search criteria.
i Add search criteria Adds another item to the search criteria. Search results only return events that match all criteria.
j Save As Adds the current search criteria to the list of saved searches. When viewing an existing saved search, you can either Save As a new search or Save changes under the same name.
k Update Search Performs a search based on the current search criteria.
l Modify columns Displays a list of available columns. Select or deselect items to customize the format of your search results.
m Export Results Downloads the current search results to a CSV file. Exports are limited to 200,000 results.
n

Column sort column sort icon

Click the up arrow to sort results by this column in ascending order. Click the down arrow to sort in descending order.
o

Expand/collapse event details file details icon

Expands or collapses all file event details.
p

Risk indicator Yellow diamond risk indicator icon

Early access

 

Denotes file activity that may indicate a greater risk, such as a file extension that does not match the file contents, or activity performed outside a user's typical active hours.

q Events per page Select to display 10, 25, 50, or 100 events per page.

File event details

To view file event details within search results:

  1. Click the arrow icon file details icon to expand or collapse details for a file event.
  2. Within the expanded file event details, click the arrow icon File event details expand icon to expand or collapse each category of metadata.

Expanded Forensic File Search results

Missing file metadata
Some file events may not capture all metadata. Missing metadata is indicated by a dash (–) in the field. Most commonly, this occurs if the file did not exist on disk long enough for Code42 to capture all the metadata.

Event

Expand the Event section for summary information about the event, including date observed, event type, and event source.

Forensic Search results - event details

Item   Description

Risk Indicators

Early access

 

Indicates file activity that may be a greater risk.

  • File mismatch highlights files with extensions that do not match the file contents (for example, a file with the .jpg extension that contains source code content). This may indicate an attempt to disguise and exfiltrate data.
  • Off hours indicates the file activity occurred outside the user's typical active hours. The off hours determination is unique to each user and is based on the user's past patterns of behavior.

Date Observed

Endpoint file activity
Date and time that the Code42 service on the device detected an event for the file. The file metadata for the event is based on this detection time. The time is based on the device’s system clock and reported in Coordinated Universal Time (UTC).

 

File activity can be detected in two ways:

  • Real-time: Reported by the operating system as changes occur.
  • Scanner: The Code42 app performs a scan once per day to identify any changes that might have been missed by the real-time file watcher. The scan runs once every 24 hours and cannot be configured.

Cloud file activity

Date and time that Code42 detected activity in the cloud service. This may not be the exact time the activity occurred, but should be within 5 minutes. The time is reported in Coordinated Universal Time (UTC).

 

Email file activity

  • Microsoft Office 365: Date and time Code42 was notified that an email attachment was detected by a data loss prevention (DLP) policy, as defined in your Microsoft Office 365 Security & Compliance Center.
  • Gmail: Date and time Code42 was notified that an email was sent with any attachment.

This may not be the exact time the email was sent, but should typically be within 5 minutes. The time is reported in Coordinated Universal Time (UTC).

Event Type

The type of file event observed:

  • New file: This is the first event detected for this filename and file path on the device (for endpoint events) or in the cloud service (for cloud events). New file events are reported when:
    • A new file is created (endpoint) or uploaded (cloud).
    • An existing file is moved to a new location.
    • File Metadata Collection is initially enabled on a device or for a cloud service. As part of the initial scan, New file events are created for all existing files.
  • Modified
    • Endpoint events: File contents changed for a file Code42 already detected with this filename and file path on the device.
    • Cloud events: The cloud service detected a new file version. This occurs when file contents are modified or the file is renamed, moved, or shared.
  • No longer observed: The filename for a previously detected file no longer exists in this file path on the device (for endpoint events) or in the cloud service (for cloud events). The metadata shown for this event is the metadata from the last New file or Modified event. No longer observed file events are reported when:
    • A file is deleted.
    • A file is moved or renamed.
  • Browser or app read: The file was opened in an app that is commonly used for uploading files, such as a web browser, Slack, FTP client, or curl.
  • Emailed:
    • The file was sent as an email attachment via Microsoft Office 365 and detected by a data loss prevention (DLP) policy, as defined in your Microsoft Office 365 Security & Compliance Center.
    • The file was sent as an email attachment via Gmail.
  • Printed: The file was sent to a printer.
Source

The source of the file event:

  • Endpoint: The file activity occurred on a user device.
  • Google Drive: The file activity occurred in Google Drive.
  • OneDrive: The file activity occurred in OneDrive.
  • Box: The file activity occurred in Box.
  • Office 365: The file was sent as an attachment in Microsoft Office 365 email.
  • Gmail: The file was sent as an attachment in Gmail.

This field appears only if you are licensed for more than one data source.

  Process User The username of the process owner, as reported by the device's operating system.
Applies only to Printed and Browser or app read events.
  Trusted Activity

Indicates if this is activity you trust, as defined by your Data Preferences.

  • True: The activity occurred on your list of trusted domains.
  • False: The activity occurred outside your list of trusted domains.

Applies only to Endpoint and Email events. For Cloud events, use the Exposure Type filter Outside trusted domain.

Print

Early access

Expand the Print section for print event details and to download an image of the printed file. The Print section only appears for Printed event types.

Print detection is only supported on Mac and Linux devices and requires Code42 app version 8.0 or later.

Printer file event details

Item   Description
  Printer Name

The name of the printer.

  Print Job Name

The name of the print job. This is often the name of the printed document. Click Download file to download an image of the printed file.

File

Expand the File section for a link to download the file, and for details such as the file's name, path, owner, and other metadata. 

Forensic File Search results - file event details

Item   Description
  File Type Mismatch
(not pictured)

Early access

 

If Code42 detects the file contents do not match the file extension, a File Type Mismatch row appears with details about the mismatch (for example, the file extension is .jpg but the file contains source code content). This may indicate an attempt to disguise and exfiltrate data.

  Filename

The name of the file, including the file extension. If applicable, links to download the file appear below the filename.


Endpoint file activity

  • If a file matching this filename and file path is included in the user's Code42 backup file selection, links to download the file contents appear.
  • If no file matches the filename and file path in the user's Code42 backup file selection, the option to Search Other Locations appears. Click to search across your entire Code42 environment for a matching file. If a match is found elsewhere in the user's backup archive, or among files backed up by other users, links to download the file contents appear.

Depending on available versions, one or both links may appear:

  • Most Recent Version: Downloads the most recent version of the file in the backup archive.
  • Exact Match: Downloads the version of the file in the backup archive which matches the MD5 hash of the this specific file event.

If the most recent version also matches the MD5 hash for this event, only the Exact Match link appears.

 

You must be signed in as a user with either the Customer Cloud Admin or Security Center - Restore role to download files.

 

Cloud file activity

Click the filename to open the file in the respective cloud service's file viewer. To view the file:

  • The file must still exist in the cloud service.
  • You must have permission to access the file. Depending on how the file is shared, you may have to sign in to your cloud service's user account before viewing it. For example, for Box, you must be logged in to the "Admin Console" for the link to be valid.

Email file activity

Click the filename to open the file attached to the email. (Microsoft Office 365 only)

 

  File Path

The file location on the user's device.

Endpoint file events only. Cloud and email events do not include a file path.

  File Category The type of file, as determined by the file extension and file contents. For example, .gif, .jpg, and .png files are categorized as Image files. For a complete list of file categories and the specific file types in each category, see Forensic Search file categories.
  File Size

Size of the file.

Not available for Google file types (for example, Google Sheets or Google Docs).

  File Owner The name of the user who owns the file, as reported by the device's file system (for endpoint events) or the cloud service (for cloud events).
  MD5 Hash

The MD5 hash of the file contents.

 Not available for:

  • Google file types (for example, Google Sheets or Google Docs).
  • Files in cloud services that have not been modified since Code42's initial extraction.
  SHA256 Hash

The SHA256 hash of the file contents. 

Not available for:

  • Google file types (for example, Google Sheets or Google Docs).
  • Files in cloud services that have not been modified since Code42's initial extraction.
  File Created Date

File creation timestamp as reported by the device's operating system. This appears in Coordinated Universal Time (UTC).

Mac and Windows NTFS devices only.

  File Modified Date File modification timestamp as reported by the device's operating system. This only indicates changes to file contents. Changes to file permissions, file owner, or other metadata are not reflected in this timestamp. This appears in Coordinated Universal Time (UTC).

Device

Expand the Device section for detailed information about the device, including the hostname, IP address, and other metadata.

Device details are only visible only if you are licensed for the endpoint data source. Device details do not apply to cloud events.

Forensic Search results - device event details

Item   Description
Hostname

The device name reported by the device's operating system. The hostname may be different than the device name in the Code42 console.

 

You must enter the complete hostname. Wildcard searches are not supported.

  Fully Qualified Domain Name Fully qualified domain name (FQDN) for the user's device at the time the event is recorded. If the device is unable to resolve the domain name of the host, it reports the IP address of the host.
Username (Code42)

The Code42 username used to sign in to the Code42 app on the device. Code42 usernames must be email addresses.

 

Click View profile to review the User Profile, which highlights file activity for this user over the past 90 days that may indicate a file exfiltration risk.

 

The username is reported independently of file activity. If the username hasn’t been reported yet, the username may be blank or may display NAME_NOT_AVAILABLE.

  Username (signed in to device)

The username signed in to the device when the file activity was observed, as reported by the device’s operating system. 

 

For devices with multiple user accounts, this helps you identify the user responsible for the file activity.

  IP Address (public)

The external IP address of the user's device, as seen by Code42 via the device's outbound connection to the Code42 cloud.

 

If the IP address is not included in your list of in-network IP addresses, it is labeled Remote activity.

IP Address (private)

The IP address of the user's device on your internal network. This includes:

  • Network interfaces
  • Virtual network interface controllers (VNICs)
  • Loopback/non-routable addresses (for example, 127.0.01)

If there is more than one active network interface, this displays a comma-separated list.

Cloud

Expand the Cloud section for detailed information about how and where the file is exposed in the cloud service.

Visible only with licensing for one or more cloud service data sources. Cloud details do not apply to endpoint events.

Forensic File Search results - cloud event details

Item   Description
  Directory ID
 

Unique identifier of the cloud drive or folder that contains the file. Search by this ID to find events for files within the same drive or folder.

 

Google Drive files that exist at the root level of the cloud drive display the value None.

 

Some cloud services allow users to add a file to multiple folders, so Directory ID may display a list of values.

 

Actor

 

The cloud service username of the person who caused the event.

 

If multiple users interact with the same file within a 5-minute window, only the last user to take an action on the file is displayed.

Shared With
 

At the time the event occurred, the list of users who have been granted to access the file. Click View to display a searchable list of usernames.

 

This only includes users the file is explicitly shared with. It does not capture users who only accessed a shared link.

 

This list can include specific usernames and general groups of users, including:

  • External (public): The file is indexed by public search engines and can be accessed by anyone. 
  • External (anyone with a link): The file can be accessed by anyone who has the link, but is not indexed by public search engines.
  • Internal: If the Shared With value includes the display name for this data source, it indicates that the file can be accessed by any user in your domain with access to this instance of the cloud service.
  Shared
 

Indicates the shared status of the file at the time the event occurred, but does not capture whether or not a link to the file has been shared:

  • True: One or more users were granted explicit access to the file.
  • False: No users were granted explicit access to the file.
 

File exposure changed to

Indicates the file permissions changed to a value that increases exposure:

  • Public via direct link: The file is not listed in public search engines, but is available to anyone who accesses the link. Users do not need to be signed in to a cloud services account to see the file.
  • Public on the web (Google Drive only): The file is available on public search engines and accessible to the entire World Wide Web. Users do not need to be signed in to a cloud services account to see the file.
  • Outside trusted domain: The file is shared with a domain not included in your list of Trusted Domains.

Exposure

Expand the Exposure section for detailed information about where the file is exposed.

Forensic File Search results - exposure event details

Each Exposure Type displays different metadata
No single event contains values for all items in the table below. For example, the image above does not include removable media metadata (such as Device Name), because this exposure event was detected in a web browser, not on removable media.
Item   Description
  Exposure Type

The type of exposure risk, based on both cloud and device activity.

 

In cloud services
  • Public on the web (Google Drive only): The file is available on public search engines and accessible to the entire World Wide Web. Users do not need to be signed in to a cloud services account to see the file. The method used to share the file appears in the Google Drive UI as "Public on the Web."
  • Public via direct link: The file is not listed in public search engines, but is available to anyone who accesses the link. Users do not need to be signed in to a cloud services account to see the file. The method used to share the file appears in the cloud service UI as follows:
    • Box: "People with the link"
    • Google Drive: "Anyone with the link"
    • Microsoft OneDrive: "Anyone with the link"
  • Shared with corporate domain: The file is not publicly accessible, but is available to all users on your corporate domain. For Google Drive, this includes both files that users on your domain can find on their own, and files that require users to know the specific link. The method used to share the file appears in the cloud service UI as follows:
    • Box: "People in your company"
    • Google Drive: "Anyone at <your company> with the link"
    • Microsoft OneDrive: "People in <your company> with the link"
  • Outside trusted domain: The file is shared with a domain not included in your list of Trusted Domains. Applies only to Cloud file activity. For Endpoint and Email activity, use the Trusted Activity filter.

 

On the device

Windows and Mac devices only

  • Activity on removable media: The file activity occurred on an external device, such as an external drive or memory card.
  • Read by browser or other app: The file was opened in an app that is commonly used for uploading files, such as a web browser, Slack, FTP client, or curl.
  • Synced to cloud service: The file exists in a folder on the device used for syncing with one of these cloud services:
    • Apple iCloud
    • Box
    • Box Drive
    • Dropbox
    • Google Backup and Sync
    • Google Drive
    • Microsoft OneDrive
 

Bus Type

The type of removable media connection. For example: USB, eSATA, Thunderbird.

Applies only to removable media events.

 

Capacity

The storage capacity of the removable media.
Applies only to removable media events.
 

Vendor Name

The brand name of the removable media. For example: Lexar, SanDisk, Seagate.

Applies only to removable media events.

 

Device Name

The volume name of the removable media.

Applies only to removable media events.

 

Device Media Name

The media name of the device, as reported by the vendor/device. This is usually very similar to the Device Name, but can vary based on the type of device. For example, if the device is a hard drive in a USB enclosure, this may be the combination of the drive model and the enclosure model.

 

This value is not provided by all devices, so it may be null in some cases.

Applies only to removable media events.

 

Device Volume Name

The name assigned to the volume when it was formatted, as reported by the device's operating system. This is also frequently called the "partition" name.

Applies only to removable media events.

 

Device Partition ID

A unique identifier assigned to the volume/partition when it was formatted. Windows devices refer to this as the VolumeGuid. On Mac devices, this is the Disk / Partition UUID, which appears when running the Terminal command diskUtil info.

Applies only to removable media events.

 

Serial Number

Serial number of the connected hardware, as reported by the device's operating system.

Applies only to removable media events.

 

  Executable Name

The path on disk of the executable, for example: \Device\Volume\Program Files\Google\Chrome\Application\chrome.exe

Applies only to read by browser or other app events.

Tab/Window Title

The name of the browser tab or title of the application window active at the time the file is read by the browser or other app. This information helps determine the destination of an uploaded file.

 

For Windows devices, Tab/Window Title is collected automatically. For Mac devices on macOS Catalina 10.15 or Mojave 10.14, administrators must first authorize the Code42 app to capture data from web browsers.

 

Applies only to read by browser or other app events.
 

Tab URL

For files read by a browser, the URL of the active tab at the time the file is read. This information helps determine the destination of an uploaded file.

 

For Windows devices, Tab URL is collected automatically. For Mac devices on macOS Catalina 10.15 or Mojave 10.14, administrators must first authorize the Code42 app to capture data from web browsers.

 

Tab URL is only supported in Chrome, Firefox, Chromium Edge, and Opera. Tab/Window Title (above) is supported for all browsers.

Applies only to read by browser or other app events.

 

Sync Destination

The name of the cloud service the file is synced with, for example: Dropbox, Google Drive, Microsoft OneDrive.

Applies only to synced to cloud service events.

Email

Expand the Email section for detailed information about the email sender, recipients, and DLP policy that detected this file (if applicable).

Visible only with licensing for one or more email data sources. Email details do not apply to endpoint or cloud events.

Forensic File Search results - email event details

Item   Description
  Policy Names

The name of the data loss prevention (DLP) policy that detected this file, as defined in your Microsoft Office 365 Security & Compliance Center.

 

If the attachment is detected by more than one policy, only one policy is listed.

 

Only applies to emails sent via Microsoft Office 365.

  Subject The subject of the email message.
  Sender The address of the entity responsible for transmitting the message. In many cases, this is the same as From, but it can be different if the message is sent by a server or other mail agent on behalf of someone else.
  From The display name of the sender, as it appears in the "From" field in the email. In many cases, this is the same as Sender, but it can be different if the message is sent by a server or other mail agent on behalf of someone else.
  Recipients The email addresses of those who received the email. Includes the To, Cc, and Bcc recipients.

Saved searches

Saved searches list

Item   Description
a Name The name of the saved search.
b Created by User who created the search.
c Date Created Date the search was created.
d Last Modified by Last user to modify the search.
e Last Modified Most recent date the search was modified.
f Expand and collapse details icon Expand / collapse search details Click to view and edit search details, including the search name and any notes about the search (items i and j below).
g Execute Search icon Execute search Executes the saved search and displays the search results.
h

Search options icon Search options

Click to view search options:

  • Edit Filters: Opens the Search tab, from which you can add, remove, and update search criteria.
  • Delete Saved Search: Permanently deletes the saved search for all users in your Code42 environment.
i Name Editable name of this search
j Notes (Optional) Free-form text field to enter detailed notes about the search. Notes are limited to 2,500 characters.
  • Was this article helpful?