Review: STRSRCH and URL_SRCH

For: A fast way to perform basic searches
Against: Many all-in-one utilities provide the same functionality
Verdict: For forensic toolkits on a budget these utilities are a fit

Many multifunction utilities such as AccessData's Forensic Toolkit include similar functionality, but STRSRCH and URL_SRCH are purported to be faster.

The commands can be a bit confusing to the first-time user as both STRSRCH and URL_SRCH use many switches. The basic command structure for STRSRCH is strsrch -p c:\ -s string.fle -o d:output.fle, which makes the utility search the entire C: drive for anything listed in the string.fle file. The resulting output is stored on d: in a file named output.fle.

The basic command structure for URL_SRCH is URL_SRCH-p d:\path -o c:\tmp\output -w -m 200 -d "|". This command searches the d:\path directory and all subdirectories for URLs, IPs and email addresses.

When found the results are stored in a wide format with a maximum length of 200 characters and separated by the pipe symbol "|".

The greatest advantage to the utilities is the cost. These utilities can be used as an inexpensive way to search large firewall, router or intrusion detection/intrusion prevention log files for specific strings.

For example, a search can be run against a content filter system for inappropriate words for use in an internet abuse investigation. The same strings can be used against a Check Point firewall log to look for access to inappropriate images, or even to search a local system for the same. Also, these utilities can be combined with the free AccessData Forensic Imager to create an inexpensive toolkit.

There are help files included on the website for download and purchase of the utilities. Each is quite lengthy and covers most if not all command-line options.

The developers say that as of April 2008 all Maresware software will be shipping via a CD-Rom and a licence dongle. The dongle is only used to initialise the software with ownership information to prevent software theft. This has been reflected in the purchase price.

andsecurity