Electronic PII discovery or "What PII is squirrelled away in fileshares?"

[pete]

For some things (Office365 and credit card/passport/NIN/driving license etc) this is reasonably doable.

 

For others (how do we pick out a document containing d.o.b vs general datestamps, what's our threshhold?) it's rather more complex.

 

Has anyone got as far as a reasonably usable strategy/tool/series of powershell scripts for discovery purposes?

[enjay]

Google Vault could probably do it, with an audit on the student's name.

 

Of course, no search will find all the stuff on memory sticks or paper...

[pete]

I amused myself yesterday with a simple

 

Get-ChildItem -Path “\\server\staffhomedirshare\” -Recurse -Force -Include *.doc, *.docx, *.xls, *.xlsx, *.txt, *.pdf, *.ppt, *.pptx | Select-String “[P|p]assport” | Select-Object Path, Line, LineNumber | Export-Csv “c:\users\pete\quickppsearch.csv

 

to see if people were cleaning up after themselves once trips have finished. It does give an indication of where that sort of data is, but (for ~450GB of data) it takes a fair while to run and that's just one search term.

 

My aim is to give people targetted "you need to look in this folder structure" guidance when we start the clearout.

[pete]

There's also this that I spotted the other day. If you have 2012 or better fileservers, FSRM supports PII discovery via regex.

 

https://4sysops.com/archives/file-server-resource-manager-fsrm-part-6-classification-management/

 

edit: actually works on 2008R2 too, it's just not as fancy.

Edited October 6, 2017 by pete