Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//20350629
write the survey results to the exact path provided - it will not adjust to the drive
letter of the USB drive on the target machine.
Figure 3: (S) File Pattern Collection Tab
(S) The third tab allows for configurable File Pattern Collection (see figure 3). Again, the
user must check the Enable file pattern collection check box to enable the screen. For
each file pattern entered, collection criteria is created and saved as a row in the collection
priorities table. Wildcards and environment variables may be used in the file pattern field.
For example, a file pattern of *.doc will collect all Microsoft Word docs off of all fixed
drives in the system. A file pattern of C:\*.doc will collect all Microsoft Word docs off of
the C drive. Note that 2007 Office docs have an x on the extension, so to include all 2007
Word docs search with C:\*.docx or C:\*.doc*. To search for specific files, enter the
entire path to the file: C:\Program Files\sample.txt.
(S) To enable the date controls and the min/max file size fields, the appropriate check
boxes must be selected. Also for each file pattern, an output filename must be specified.
This should be the full path to the file on the USB drive, minus the drive letter (i.e. it
should always start with a backslash such as “\output\outputFile.dat” or it should use
the %drive% substitution such as “%drive%\output\outputFile.dat”).
(S) Once collection criteria are set, click the Add Row button. This will add a row to the
table on the lower part of the screen. To add additional file patterns with different
SECRET//20350629
6

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh