STRSRCH and URL_SRCH
May 01, 2008
Mares and CompanyProduct:
c£48 plus a one-off dongle fee of c£13
- Ease of Use:
- Value for Money:
- Overall Rating:
- Strengths: A fast way to perform basic searches
- Weaknesses: Many all-in-one utilities provide the same functionality
- Verdict: For forensic toolkits on a budget these utilities are a fit
Many multifunction utilities such as AccessData's Forensic Toolkit include similar functionality, but STRSRCH and URL_SRCH are purported to be faster.
The commands can be a bit confusing to the first-time user as both STRSRCH and URL_SRCH use many switches. The basic command structure for STRSRCH is strsrch -p c:\ -s string.fle -o d:output.fle, which makes the utility search the entire C: drive for anything listed in the string.fle file. The resulting output is stored on d: in a file named output.fle.
The basic command structure for URL_SRCH is URL_SRCH -p d:\path -o c:\tmp\output -w -m 200 -d "|". This command searches the d:\path directory and all subdirectories for URLs, IPs and email addresses. When found the results are stored in a wide format with a maximum length
of 200 characters and separated by the pipe symbol "|". The greatest advantage to the utilities is the cost. These utilities can be used as an inexpensive way to search large firewall, router or intrusion detection/intrusion prevention log files for specific strings.
For example, a search can be run against a content filter system for inappropriate words for use in an internet abuse investigation. The same strings can be used against a Check Point firewall log to look for access to inappropriate images, or even to search a local system for the same. Also, these utilities can be combined with the free AccessData Forensic Imager to create an inexpensive toolkit.
There are help files included on the website for download and purchase of the utilities. Each is quite lengthy and covers most if not all command-line options.
The developers say that as of April 2008 all Maresware software will be shipping via a CD-Rom and a licence dongle. The dongle is only used to initialise the software with ownership information to prevent software theft. This has been reflected in the purchase price.
SC Webcasts UK
Information Security Manager
Infosec People - Hammersmith, West London
Security Architect, Cardiff - to £70k Basic
Infosec People - Cardiff, Wales
Interim CISO (Chief Information Security Officer) - Cyber Security Director
CYBER EXECS - London (Central), London (Greater)
Junior Penetration Tester, Hertfordshire, to £35k + benefits
Infosec People - England, Hertfordshire
Cyber Security Architect
CYBER EXECS - London (Greater)
Sign up to our newsletters
SC Magazine UK Articles
- Tesco Bank allegedly ignored warnings of hack from Visa
- Investigatory Powers and Digital Economy Bills could threaten economy
- Updated: A million German routers knocked offline by failed Mirai botnet attack
- Gooligan ad fraud malware infects 1.3M Android users, installs over 2M unwanted apps
- Microsoft update left Azure Linux virtual machines open to hacking
- SC Awards Europe 2016 winners announcements!
- ISIS radicalises 'lone wolves' through strong social media presence
- Updated: How will Brexit affect the cyber-security industry in UK and Europe?
- 9.2 million medical records for sale on darkweb
- Microsoft Office 365 hit with massive Cerber ransomware attack, report