Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//20350629
%\surveyOutput. Note: If a drive letter is included, the application will attempt to
write the survey results to the exact path provided - it will not adjust to the drive
letter of the USB drive on the target machine.
Figure 3: (S) File Pattern Collection Tab
(S) The third tab allows for configurable File Pattern Collection (see figure 3). Again, the
user must check the Enable file pattern collection check box to enable the screen. For
each file pattern entered, collection criteria is created and saved as a row in the collection
priorities table. Wildcards and environment variables may be used in the file pattern field.
For example, a file pattern of *.doc will collect all Microsoft Word docs off of all fixed
drives in the system. A file pattern of C:\*.doc will collect all Microsoft Word docs off of
the C drive. Note that 2007 Office docs have an x on the extension, so to include all 2007
Word docs search with C:\*.docx or C:\*.doc*. To search for specific files, enter the
entire path to the file: C:\Program Files\sample.txt.
(S) To enable the date controls and the min/max file size fields, the appropriate check
boxes must be selected. Also for each file pattern, an output filename must be specified.
This should be the full path to the file on the USB drive, minus the drive letter (i.e. it
should always start with a backslash such as “\output\outputFile.dat” or it should use
the %drive% substitution such as “%drive%\output\outputFile.dat”).
SECRET//20350629
6