[Safeguarding] Searching Google Drive & Mail with an MD5?

[Garacesh]

The police will soon be contacting me with a hash (which I assume is MD5 checksum, but can't confirm) of a file.

This is a file that, knowing its brief description, I absolutely do not want to open. Obviously I can't say more, but I'm sure you all get what ballpark we're playing in right now.

 

I'm pretty sure I could set up and use GAM for searching Drive, but the support docs for Vault doesn't list anything of that nature for emails, the closest I've got is has:attachment

 

Personally, I'd rather just dump all data, encrypt it, pass it over, change the pupil's email and honeypot the original account but.. Apparently that's not what I'm being asked to do

Edited September 25, 2020 by Garacesh

[mavhc]

https://stackoverflow.com/questions/23462168/google-drive-md5-checksum-for-files has info for Drive, I get things like

 

{

"originalFilename": "fizzbuzz.py",

"md5Checksum": "9c2debaf2e48397c473c3f281e0e73c7"

},

[mavhc]

Don't see anything similar for email attachments though, as it's a legal matter possibly worth phoning google support

[paulkerton]

https://stackoverflow.com/questions/23462168/google-drive-md5-checksum-for-files has info for Drive, I get things like

 

{

"originalFilename": "fizzbuzz.py",

"md5Checksum": "9c2debaf2e48397c473c3f281e0e73c7"

},

Oh that's really useful. Thanks mavhc. Worth keeping this one to hand.

 

I assume that if you confirm the existence of that file, then the police would have to head to Google with a warrant of some sort?

[Garacesh]

Yeah, I have Drive sorted with GAM

GAM.exe user [color="#FF0000"][user][/color] show filelist md5checksum

 

It's the e-mail bit I'm concerned about.

Might have to get on to support, see what they say.

 

I assume that if you confirm the existence of that file, then the police would have to head to Google with a warrant of some sort?

Maybe? With a question mark?

 

I would have expected it's trying to chase down the file and the sendee, but if they already have the hash, then they already have the file.

Truth be told I'm not really sure what to expect now. With present information, the best I can do is confirm the file exists/was sent to the pupil. Not sure what use that is to them.

[dhicks]

I'm pretty sure I could set up and use GAM for searching Drive

 

GAM XTD3 allows you to download attachments:

 

https://github.com/taers232c/GAMADV-XTD3/wiki/Users-Gmail-Messages-Threads#download-attachments

 

You'd need to write something to calculate the checksum for each file downloaded and compare with the checksum you're given.

[Garacesh]

Aye, that's my backup plan.

I'm just really hoping I can get away with not having to have any access to the files at all.

 

Well, that, and I'm not sure if GAM can pull back deleted e-mails (or files, to be fair..) like Vault can?

 

This is the first (and hopefully last..) time I've had to do anything like this.

Edited September 25, 2020 by Garacesh

[paulkerton]

https://support.google.com/vault/answer/6099459?hl=en

 

This document has some strange formatting, but it suggests that it can pull checksums from Vault.

 

I guess your vault hold and retain would be based on the information you got from Drive (ie file type/date/etc) and then you'd find the matching checksum in the export maybe?

[Garacesh]

https://support.google.com/vault/answer/6099459?hl=en

 

This document has some strange formatting, but it suggests that it can pull checksums from Vault.

See, I read that as it gives you the MD5 for the export?

Perhaps I misunderstood.

 

I'm on hold with Google support at the moment...

I'm resigning myself to the prospect of having to manually export everything from Vault and then script a way to search through it.. Really don't want to have to do that, and I'm not entirely convinced I should be the one doing this, either..

 

Might have to discuss with whoever from the police gets me the file hash...

[Garacesh]

And Google support's verdict: Computer says no.

They just haven't programmed Vault so it can search by MD5.

 

I can probably download everything and write a script to just MD5 each individual file and dump out a spreadsheet of name/path/hash.

But still, going to discuss that one with the cops before I do it.