Re: [sleuthkit-users] [OT] Bulk_extractor and SSN's

[Simson G. <si...@ac...>]

Hi, Barry.

What do you consider confusing? We’ll try to clear it up.

The SSN detector was cleaned up in version 1.5. You can download the code from the github repo and run it with version 1.4 if you wish. We have created multiple modes for SSN detection which you can set from the command line given the kind of case that you are working.

Simson


On Mar 11, 2014, at 2:27 PM, Grundy Barry J TIGTA <Bar...@ti...> wrote:

> Good Afternoon,
>  
> Looking for a quick answer, so I thought I’d post here for cross users. 
>  
> I’ve been using bulk_extractor for awhile, and it works well.  I’m come across an instance where I need to find SSN’s (in the thousands) in an image.  While there are other ways to do it, I really like the feature file and histogram output of BE.  There’s some very confusing info on the web regarding the ‘accts’ scanner and SSN’s.  Is it able to find the numbers or not?  It has not worked for me on test files, but I’ve found a number of references that mention it should (The BitCurator Wiki on BE scanners, for example).
>  
> I’ve used the “-f [regexp]” option, but was still wondering if there is a built in scanner.
>  
> Thanks,
>  
> /*******************************************
> Barry J. Grundy
> Assistant Special Agent in Charge
> Digital Forensic Support Group 
> Electronic Crimes and Intelligence Division
> Treasury Inspector General for Tax Administration
> (301) 210-8741 (w)
> (202) 527-5778 (c)
> Bar...@ti...
> ********************************************\
>  
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech_______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org