Evaluating Identity Finder Results in Windows

1. You will receive an email from the Identity Finder Enterprise Console with the results of the PSI scan on your computer.  If you are trying to evaluate the results of a scan that was not initiated by the management console, but instead run by yourself see our other documentation on evaluating scan results from the Windows client.
   

   Evaluating Scan Results Using the Identity Finder Client on Windows

2. Open the email, right click the attachment, and select “Save As”.

3. Browse to wherever you would like to save the file, name the file, and click “Save”.

4. Browse to where you saved your file and open it by double clicking it.

5. The document will look something like this when you first open it. Feel free to resize the columns.

6. These are the columns we are mainly interested in.

    

7. The “Owner” column lists the owners of each document that has been flagged as possibly containing sensitive information.

8. The “Identity Type” column lists the type of information the scan believes it has found.

9. The “Identity Match” column lists the whole or partial data of the sensitive information it believes it found in a file. (Ex. It may list a full social security number or just a partial number.)

10. The “Match Quantity” column lists how many times the information in question was found in the file.

11. The “Location” column lists the location of the file on the computer.

12. The “Location Type” column lists the type of document containing the information.

13. You will now look through all of the results to determine if the information found is truly PSI as defined by the IT Policy   or if it is just a false positive.

14. Start by right clicking the “Location” cell of the first result and selecting “Copy”.

15. Next open a Windows Explorer window. Do this by clicking the Windows Explorer Icon in Windows 7 or it can be done by opening “My Computer”.

16. Paste the location you copied from your document into the browser bar by first left clicking it to select the bar, then right clicking the bar and selecting “Paste”.

17. Once the file path is in the browser bar press the “Enter” key to open the document.

18. Here is the document opened in the example. At first glance you can tell it contains PSI and is not a false positive.

19. Say you determine that you do not need this PSI on your machine therefore you will delete it.

20. Close the document then repeat steps 14-16 to enter the location of the document in Windows Explorer again. However, instead of hitting enter this time you will select the text on the right hand side of the last “\” and delete it using either the "Backspace" key, the "Delete" key, or by right clicking the selected text and clicking "Delete". This is so that you point Windows Explorer to the location of the document instead of directly to the document. Once the filename text is removed you can press the “Enter” key.

21. Now locate the file, right click it, and delete it.

22. You will then click on the “Desktop” to navigate to the “Recycle Bin”.

23. Right click on the “Recycle Bin” and select “Empty Recycle Bin”.

 

24. Return to my list of Identity Finder results repeat steps 14-17 to open the next document to be evaluated.

25. This example is a large Excel spreadsheet. You can tell the document is fairly large due to the small scroll bar on the right. You do not see any PSI at first glance.

26. To make searching for the information in question faster, go back to the Identity Finder scan results document to copy the information in question. This is so you can enter the data into Internet Explorer in order to try and find the information quickly and determine if it is PSI or a false positive. Right click and copy the cell in question from the Identity Match column.

27. Now go back to the file you had opened and press the “Ctrl” and the “F” key simultaneously to open the Find Bar.

28. Right click and “Paste” the data you obtained from the spreadsheet into the Find Bar

29. This should then take you to the section of the document that displays the data you are interested in. This is a false positive triggered by a document that was fabricated for this demonstration. False positives can either be ignored or deleted.

30. It should be noted that using this find technique will work in most of the large documents you come across.  You should now have the tools you need to evaluate Identity Finder Scan Results from the .csv file.