STRSRCH and URL_SRCH are command line utilities which can search text files for IP addresses, email addresses, URLs and strings. The biggest advantage to STRSRCH and URL_SRCH is the speed at which they can process large amounts of data. In the help files for STRSRCH and URL_SRCH, the output from AccessData’s FTK drive freespace is mentioned. Many multifunction utilities, such as AccessData’s FTK, also include this functionality, but STRSRCH and URL_SRCH are purported to be faster.
The commands can be a bit confusing to the first-time user as both STRSRCH and URL_SRCH use many switches. The basic command structure for STRSRCH is strsrch -p c: -s string.fle -o d:output.fle, which has the utility search the entire C: drive for anything listed in the string.fle file. The resulting output is stored on d: in a file named output.fle.
The basic command structure for URL_SRCH is: URL_SRCH -p d:path -o c:tmpoutput -w -m 200 -d "|". This command searches the d:path directory and all subdirectories for URLs, IPs and email addresses. When found, the results are stored in a wide format with a maximum length of 200 characters separated by the pipe symbol “|”.
The greatest advantage to the utilities is the cost at $95 plus a one-time dongle fee of $25. These utilities can be used as an inexpensive way to search large firewall, router or intrusion detection/intrusion prevention log files for specific strings. For example, a search can be run against a content filter system for inappropriate words for use in an internet abuse investigation. The same strings can be used against a Check Point firewall log to look for access to inappropriate images, or even to search a local system for the same. Also, these utilities can be combined with the free AccessData Forensic Imager to create an inexpensive toolkit.
There are help files included on the website for download and for purchase of the utilities. Each is quite lengthy and covers most, if not all, command line options.
The STRSRCH and URL_SRCH utilities are $95, plus a one-time dongle fee of $25.
The commands can be a bit confusing to the first-time user as both STRSRCH and URL_SRCH use many switches. The basic command structure for STRSRCH is strsrch -p c: -s string.fle -o d:output.fle, which has the utility search the entire C: drive for anything listed in the string.fle file. The resulting output is stored on d: in a file named output.fle.
The basic command structure for URL_SRCH is: URL_SRCH -p d:path -o c:tmpoutput -w -m 200 -d "|". This command searches the d:path directory and all subdirectories for URLs, IPs and email addresses. When found, the results are stored in a wide format with a maximum length of 200 characters separated by the pipe symbol “|”.
The greatest advantage to the utilities is the cost at $95 plus a one-time dongle fee of $25. These utilities can be used as an inexpensive way to search large firewall, router or intrusion detection/intrusion prevention log files for specific strings. For example, a search can be run against a content filter system for inappropriate words for use in an internet abuse investigation. The same strings can be used against a Check Point firewall log to look for access to inappropriate images, or even to search a local system for the same. Also, these utilities can be combined with the free AccessData Forensic Imager to create an inexpensive toolkit.
There are help files included on the website for download and for purchase of the utilities. Each is quite lengthy and covers most, if not all, command line options.
The STRSRCH and URL_SRCH utilities are $95, plus a one-time dongle fee of $25.
