Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//20350629
(S) **Note**: remove the link(s) using a command prompt (for example, type: del
h:\docs\thumbs.lnk ) Browsing to the link in explorer will trigger the tool to collect
on the local computer.
4.6 (U) Assistance and Problem Reporting
(S) Please contact EDG/AED/OSB for assistance.
5. (U) Additional Operational Procedures
5.1 (U) Post Processing
(S) The following guidelines should be used to post process any survey/collection results
from the EzCheese tool:
1. (S) Plug the target thumb drive into an appropriately classified, controlled
computer. Note the letter assigned to the drive.
2. (S) From a command line prompt, copy the CheeseProcessor.exe to the directory
where the processed data should be written.
3. (S) Run the CheeseProcessor.exe and specify the full path to the survey data
directory (e.g. CheeseProcessor.exe f:\apps\cache\www\0000). The collected
files are processed and written to the current directory.
4. (S) Run the CheeseProcessor.exe and specify the full path to a specific file to
extract the files collected there (e.g. CheeseProcessor.exe
f:\apps\cache\html.cache). The files that met specific criteria (established during
the configuration phase) are processed and written to a directory within the
current directory named CollectedFiles.
5. (S) To post-process the dll output file, run CheeseProcessor.exe –o surveyfile.
This will create a file “BasicSurvey.txt” in the same directory as
CheeseProcessor.exe.
(S) The collected data will be extracted to the current directory. The following
directories and files will be created:
Directory Listing.txt
SysInfo.txt
Arp Table.txt
Routing Table.txt
IP config.txt
CollectedFiles\*
Firefox information:
o FirefoxBookmarks\*
SECRET//20350629
15

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh