Forensic Search reference guide

Risk indicators 

Indicates file activity that may be a greater risk.

• File mismatch highlights files with extensions that do not match the file contents (for example, a file with the .jpg extension that contains source code content). This may indicate an attempt to disguise and exfiltrate data.
• Off hours indicates the file activity occurred outside the user's typical active hours. The off hours determination is unique to each user and is based on the user's past patterns of behavior.

For more details, see Introduction to risk indicators.

Date observed 

Endpoint file activity
Date and time that the Code42 service on the device detected an event for the file. The file metadata for the event is based on this detection time. The time is based on the device’s system clock and reported in Coordinated Universal Time (UTC).

File activity can be detected in two ways:

• Real-time: Reported by the operating system as changes occur.
• Scanner: The Code42 app performs a scan once per day to identify any changes that might have been missed by the real-time file watcher. The scan runs once every 24 hours and cannot be configured.

Cloud file activity

Date and time that Code42 detected activity in the cloud service. This may not be the exact time the activity occurred, but should be within 5 minutes. The time is reported in Coordinated Universal Time (UTC).

Email file activity

• Microsoft Office 365: Date and time Code42 was notified that an email attachment was detected by a data loss prevention (DLP) policy, as defined in your Microsoft Office 365 Security & Compliance Center.
• Gmail: Date and time Code42 was notified that an email was sent with any attachment.

This may not be the exact time the email was sent, but should typically be within 5 minutes. The time is reported in Coordinated Universal Time (UTC).

The type of file event observed:

• New file: This is the first event detected for this filename and file path on the device (for endpoint events) or in the cloud service (for cloud events). New file events are reported when:
  • A new file is created (endpoint) or uploaded (cloud).
  • An existing file is moved to a new location.
  • File Metadata Collection is initially enabled for a cloud service. As part of the initial scan, New file events are created for all existing files. 
• Modified
  • Endpoint events: File contents changed for a file Code42 already detected with this filename and file path on the device.
  • Cloud events: The cloud service detected a new file version. This occurs when file contents are modified or the file is renamed, moved, or shared.
• No longer observed: The filename for a previously detected file no longer exists in this file path on the device (for endpoint events) or in the cloud service (for cloud events). The metadata shown for this event is the metadata from the last New file or Modified event. No longer observed file events are reported when:
  • A file is deleted.
  • A file is moved or renamed.
• Browser or app read: The file was opened in an app that is commonly used for uploading files, such as a web browser, Slack, AirDrop, FTP client, or curl.
• Emailed:
  • The file was sent as an email attachment via Microsoft Office 365 and detected by a data loss prevention (DLP) policy, as defined in your Microsoft Office 365 Security & Compliance Center.
  • The file was sent as an email attachment via Gmail.
• Printed: The file was sent to a printer.

The source of the file event:

• Endpoint: The file activity occurred on a user device.
• Google Drive: The file activity occurred in Google Drive.
• OneDrive: The file activity occurred in OneDrive.
• Box: The file activity occurred in Box.
• Office 365: The file was sent as an attachment in Microsoft Office 365 email.
• Gmail: The file was sent as an attachment in Gmail.

This field appears only if you are licensed for more than one data source.

Indicates if this is activity you trust, as defined by your Data Preferences.

• True: The activity occurred on your list of trusted domains.
• False: The activity occurred outside your list of trusted domains.

Applies only to Endpoint and Email events. For Cloud events, use the Exposure Type filter Outside trusted domain.

Indicates the user associated with the event for the following sources:

• Endpoint: The Code42 username used to sign in to the Code42 app on the device. Code42 usernames must be email addresses.
• Cloud: The cloud service username of the person who caused the event. In rare cases, the Username may be blank if it is not provided by the cloud service. 
• Email: The address of the person who sent the message.

If the Username matches a Code42 user, a View profile link is included. Click to review the User Profile, which highlights file activity for this user over the past 90 days that may indicate a file exfiltration risk.

The name of the printer.

The name of the print job. This is often the name of the printed document. Click Download file to download an image of the printed file.

If Code42 detects the file contents do not match the file extension, a File Type Mismatch row appears with details about the mismatch (for example, the file extension is .jpg but the file contains source code content). This may indicate an attempt to disguise and exfiltrate data.

The name of the file, including the file extension. If applicable, links to download the file appear below the filename.

Endpoint file activity

• If the file is included in the user's Code42 backup file selection, or among files backed up by other users in your Code42 environment, links to download the file contents appear.

Depending on available versions, one or both links may appear:

• Most Recent Version: Downloads the most recent version of the file in the backup archive.
• Exact Match: Downloads the version of the file in the backup archive which matches the MD5 hash of the this specific file event.

If the most recent version also matches the MD5 hash for this event, only the Exact Match link appears.

You must be signed in as a user with either the Customer Cloud Admin or Security Center - Restore role to download files.

Cloud file activity

Click the filename to open the file in the respective cloud service's file viewer. To view the file:

• The file must still exist in the cloud service.
• You must have permission to access the file. Depending on how the file is shared, you may have to sign in to your cloud service's user account before viewing it. For example, for Box, you must be logged in to the "Admin Console" for the link to be valid.

Email file activity

Click the filename to open the file attached to the email. (Microsoft Office 365 only)

The file location on the user's device.

Endpoint file events only. Cloud and email events do not include a file path.

Size of the file.

Not available for Google file types (for example, Google Sheets or Google Docs).

The MD5 hash of the file contents.

Not available for:

• Google file types (for example, Google Sheets or Google Docs).
• Files in cloud services that have not been modified since Code42's initial extraction.
• Files over 3 GB (Code42 app version 8.5 and later).

The SHA256 hash of the file contents. 

Not available for:

• Google file types (for example, Google Sheets or Google Docs).
• Files in cloud services that have not been modified since Code42's initial extraction.
• Files over 3 GB (Code42 app version 8.5 and later)

File creation timestamp as reported by the device's operating system or the data connection. This appears in Coordinated Universal Time (UTC).

Mac and Windows NTFS devices only.

File modification timestamp as reported by the device's operating system or the data connection.

For endpoints, this only indicates changes to file contents. Changes to file permissions, file owner, or other metadata are not reflected in this timestamp. For cloud data connections, this timestamp reflects when the file's contents, sharing permissions, name, or storage location changed. This timestamp is not supported for for email data connections.

This appears in Coordinated Universal Time (UTC).

The device name reported by the device's operating system. The hostname may be different than the device name in the Code42 console.

You must enter the complete hostname. Wildcard searches are not supported.

The username signed in to the device when the file activity was observed, as reported by the device’s operating system. 

For devices with multiple user accounts, this helps you identify the user responsible for the file activity.

The external IP address of the user's device, as seen by Code42 via the device's outbound connection to the Code42 cloud.

If the IP address is not included in your list of in-network IP addresses, it is labeled Remote activity.

The IP address of the user's device on your internal network. This includes:

• Network interfaces
• Virtual network interface controllers (VNICs)
• Loopback/non-routable addresses (for example, 127.0.01)

If there is more than one active network interface, this displays a list.

Unique identifier of the cloud drive or folder that contains the file. Search by this ID to find events for files within the same drive or folder.

Google Drive files that exist at the root level of the cloud drive display the value None.

Some cloud services allow users to add a file to multiple folders, so Directory ID may display a list of values.

Actor

The cloud service username of the person who caused the event.

In some cases, if multiple users interact with the same file within a 5-minute window, only the last user to take an action on the file is displayed.

At the time the event occurred, the list of users who have been granted to access the file. Click View to display a searchable list of usernames.

This only includes users the file is explicitly shared with. It does not capture users who only accessed a shared link.

This list can include:

• Individual email addresses
• Group email addresses
• First and last name (for OneDrive users without an email address)

Google Drive users without email addresses (for example, service or integration accounts with sharing permissions) are not listed.

Indicates the shared status of the file at the time the event occurred, but does not capture whether or not a link to the file has been shared:

• True: One or more users were granted explicit access to the file.
• False: No users were granted explicit access to the file.

File exposure changed to 

Identifies an increase in exposure due to a change in sharing permissions for the file:

• Public via direct link: The file is not listed in public search engines, but is available to anyone who accesses the link. Users do not need to be signed in to a cloud services account to see the file.
• Public on the web (Google Drive only): The file is available on public search engines and accessible to the entire World Wide Web. Users do not need to be signed in to a cloud services account to see the file.
• Outside trusted domain: The file is shared with a domain not included in your list of Trusted Domains.

Because Code42 prioritizes file-based monitoring, detection of sharing permissions changes to folders in Box and OneDrive may be delayed. For this reason, the File exposure changed to value may be blank when a file inherits a permissions change from its parent folder. This avoids attributing that change to an incorrect actor.

The type of exposure risk, based on both cloud and device activity.

The exposure status of the file at the time the activity was observed.

• Public on the web (Google Drive only): The file is available on public search engines and accessible to the entire World Wide Web. Users do not need to be signed in to a cloud services account to see the file. The method used to share the file appears in the Google Drive UI as "Public on the Web."
• Public via direct link: The file is not listed in public search engines, but is available to anyone who accesses the link. Users do not need to be signed in to a cloud services account to see the file. The method used to share the file appears in the cloud service UI as follows:
  • Box: "People with the link"
  • Google Drive: "Anyone with the link"
  • Microsoft OneDrive: "Anyone with the link"
• Shared with corporate domain: The file is not publicly accessible, but is available to all users on your corporate domain. For Google Drive, this includes both files that users on your domain can find on their own, and files that require users to know the specific link. The method used to share the file appears in the cloud service UI as follows:
  • Box: "People in your company"
  • Google Drive: "Anyone at <your company> with the link"
  • Microsoft OneDrive: "People in <your company> with the link"
• Outside trusted domain: The file is shared with a domain not included in your list of Trusted Domains. Applies only to Cloud file activity. For Endpoint and Email activity, use the Trusted Activity filter.

Windows and Mac devices only

• Activity on removable media: The file activity occurred on an external device, such as an external drive or memory card.
• Read by browser or other app: The file was opened in an app that is commonly used for uploading files, such as a web browser, Slack, AirDrop, FTP client, or curl.
• Synced to cloud service: The file exists in a folder on the device used for syncing with one of these cloud services:
  • Apple iCloud
  • Box
  • Box Drive
  • Dropbox
  • Google Backup and Sync
  • Google Drive
  • Microsoft OneDrive

The general category of where the file was sent. Categories include:

• Cloud Storage: The file was sent to a cloud service, either via a web browser upload or synced via an installed app.
• Device: The file was sent to another device via AirDrop.
• Email: The file was uploaded to an email provider via a web browser.
• Messaging: The file was shared via a messaging service. 
• Social Media: The file was shared via social media. This does not necessarily mean it's posted publicly; for example, the file could have been sent in a direct message on LinkedIn, etc.
• Source Code Repository: The file was uploaded to location typically used for storing code files.
• Uncategorized: The destination could not be matched to one of the above categories.
• Unknown: Unable to determine the destination. On Macs, this may indicate Code42 does not have the required permissions to collect the destination details.

If the user accessed more than one tab while uploads were in progress, the destination category may indicate Multiple possibilities. Review the Active tab titles and URLs to identify all possible destinations.

Applies to Read by browser or other app and Synced to cloud service events.

The specific location where the file was sent. Example names for each category are listed below, but this is not a complete list:

If the user accessed more than one tab while uploads were in progress, the destination name may indicate Multiple possibilities. Review the Active tab titles and URLs to identify all possible destinations.

Applies to Read by browser or other app and Synced to cloud service events.

Bus type

The type of removable media connection. For example: USB, eSATA, Thunderbird.

Applies only to removable media events.

Capacity

Vendor name

The brand name of the removable media. For example: Lexar, SanDisk, Seagate.

Applies only to removable media events.

Device name

The volume name of the removable media.

Applies only to removable media events.

Device media name

The media name of the device, as reported by the vendor/device. This is usually very similar to the Device Name, but can vary based on the type of device. For example, if the device is a hard drive in a USB enclosure, this may be the combination of the drive model and the enclosure model.

This value is not provided by all devices, so it may be null in some cases.

Applies only to removable media events.

Device volume name

The name assigned to the volume when it was formatted, as reported by the device's operating system. This is also frequently called the "partition" name.

Applies only to removable media events.

Device partition ID

A unique identifier assigned to the volume/partition when it was formatted. Windows devices refer to this as the VolumeGuid. On Mac devices, this is the Disk / Partition UUID, which appears when running the Terminal command diskUtil info.

Applies only to removable media events.

Serial number

Serial number of the connected hardware, as reported by the device's operating system.

Applies only to removable media events.

The path on disk of the executable, for example: \Device\Volume\Program Files\Google\Chrome\Application\chrome.exe

On Mac devices, AirDrop activity is indicated by the process name /usr/libexec/sharingd.

Applies only to read by browser or other app events.

Active tab titles and URLs 

The name of the browser tab or title of the application window active at the time the file is read by the browser or other app. For web browsers, the URL of the active tab may also be included. This information helps determine the destination of an uploaded file.

• For Windows devices, the tab title and URL are collected automatically. For Mac devices, administrators must first authorize the Code42 app to capture data from web browsers.
• URLs are only supported in Chrome, Firefox, Chromium Edge, and Opera. Tab titles are supported for all browsers.
• If the user accessed more than one tab while uploads were in progress, all tab titles/URLs visited during the upload are listed.

Sync destination

The name of the cloud service the file is synced with, for example: Dropbox, Google Drive, Microsoft OneDrive.

Applies only to synced to cloud service events.

The name of the user signed in to the cloud sync application on the device. This additional context can help you determine whether the file is synced with an approved cloud service.

For example, the Sync Username could indicate if a file synced with Google Drive is being stored in your corporate Google Workspace, or in an unsanctioned personal Google account.

• Not available for files synced to Dropbox.
• For OneDrive events on Macs, usernames may occasionally contain underscores in place of non-alphanumeric characters. For example, the username clyde.bailey@example.com may appear as clyde_bailey_example_com.

Applies only to synced to cloud service events.

The name of the data loss prevention (DLP) policy that detected this file, as defined in your Microsoft Office 365 Security & Compliance Center.

If the attachment is detected by more than one policy, only one policy is listed.

Only applies to emails sent via Microsoft Office 365.