FAQs
General
Installation
Review
- What applications can File Scrub review?
- What common applications are not supported by File Scrub?
- Why must I have Office 2007 on the File Scrub machine to review Office 2007 files?
- If I upgrade to Office 2007, can I still review older Office files with it? Will they come out as Office 2007 cleansed files (with the docx extension)?
- If I have Office 2007 on the machine, and open an Office file using File Scrub's external tool review feature, will File Scrub convert the document to an Office 2007 document (with the docx extension)?
- Will cleansed files come out with Office 2007 extensions, so they can only be opened with Office 2007 after they go through File Scrub?
- Can I review Office 2007 files on a Mac?
- Why does File Scrub offer low, medium, high, and unlimited settings for the number of files it can review?
- Does File Scrub automate the review process?
- What is steganography?
- Can File Scrub find pictures or graphics that contain hidden information or cover other graphics?
- If the File Scrub Review log shows the presence of keywords, cropped pictures, or some other problem that indicates a visual review of the document, what is the easiest way to perform that visual review?
- Does File Scrub record in the logs when system date and time are changed?
- Does File Scrub cleanse the metatags and hidden code in .html source files?
- Can a file that has a stop sign state be transferred out of File Scrub Trusted Copy if it is reviewed again and cleared by appropriate personnel?
- I experimented with File Scrub, reviewing three or four MS Word files. All of the files came back marked “failed.” I believe I am running Word in an out-of-the-box configuration without any special features, macros, and so forth. Why are the files failing?
- When a file's review comes back “Failed. See review log,” does that mean I can’t transfer the file using File Scrub Trusted Copy?
(back to the top)
Transfer (Trusted Copy only)
(back to the top)
Miscellaneous
(back to the top)
General
How does File Scrub differ from its predecessor, Multi-Platform Trusted Copy (MPTC)?
The main difference between MPTC and File Scrub is that File Scrub now offers a review-only version in addition to the full trusted copy version. MPTC is no longer supported, so users are urged to upgrade to File Scrub.
(back to the top)
Installation
Do I need administrative privileges in order to install File Scrub?
Yes!
If you are working on Solaris or Linux platforms, you will need root access to install for multiple users. We recommend installing in /opt for
multiple users.
Also, Solaris users must have administrative privileges in order to transfer files to CDs using File Scrub Trusted Copy.
If you are working on one of the Windows platforms, you will need administrative privileges. File Scrub's ability to programmatically review a WordPerfect document is dependent upon the Microsoft COM interface. COM permission levels are set in the Windows Registry. See the File Scrub Online Help for further details.
You also need administrative privileges on Windows to install for multiple users. The default installation location for a multiple user install is Program Files.
On Windows, if you try to write to a directory for which you do not have write access, an error message will be displayed stating that the directory is not writable.
Mac users need administrative privileges to install File Scrub in the recommended location, /Applications. If you do not have these privileges, you can install to /Users/username.
I am currently running a version of File Scrub's predecessor, MPTC. Do I need to keep that earlier version in place in order to install and run File Scrub?
We do not recommend keeping MPTC or earlier versions of File Scrub on your system. You are advised to uninstall all previous versions of MPTC and File Scrub before installing the new File Scrub. See the Installation Instructions for details.
What happens to previous log files when a new installation is made?
Log files remain on the system until deliberately removed by the user.
I already have a version of File Scrub installed. When upgrading, how can I keep my customized keyword file?
If your customized keyword file is in the directory where your current installation is located, simply move that file elsewhere before you install the new version. Afterwards, you can move it back or you can use the File Scrub Persistent Configurations File Options window to specify the new location of the customized keyword file.
File Scrub doesn't find my CD drive. What can I do?
Instructions for Windows XP users and Windows 2000 users follow.
If you are running File Scrub on a Windows XP system:
There is a setting in Windows XP that controls access to lower-level CD-ROM-related functions. By default this setting is off. You can change this setting (as an administrator) by doing Start->Run, typing gpedit.msc, and pressing Enter. A GUI will come up. Navigate through the following options:
Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options
Now find "Devices: Restrict CD-ROM access to locally logged-on user only" and set it to Enable. Reboot the system. This should allow the locally logged-in user to access the CD drive and detect drives with File Scrub.
See this link for more information:
http://technet2.microsoft.com/windowsserver/en/library/4b7ba021-90c2-4139-a847-95eb6c6dcc6f1033.mspx?mfr=true
If you are running File Scrub on a Windows 2000 system:
As administrator, edit two keys in the registry, allocatecdroms and allocatedasd, that are located at
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Set both keys to 1 rather than 0. You do not need to reboot the system. Locally logged-on users can now access the CD drive and detect drives with File Scrub.
If you still have problems, please contact the File Scrub team.
(back to the top)
Review
What applications can File Scrub review?
File Scrub can review text files (including .html and CAD .dxf files); MS Office 2000, XP, 2003, and 2007 files (Word, PowerPoint, Excel, and Access); WordPerfect files; and PDF files. To review Office 2007 files, you must have a Windows machine with Office 2007 loaded. Review of MS Access and PDF files is limited to keyword search and cleansing of file properties. File Scrub can review JPEG files for steganography on all platforms. Mac users can review Office X and Office 2004 files, excluding Access, and must have Office 2004 loaded (NOT Office X for Mac).
MS Office 97 is not supported and was not tested. While MS Office 97 should run, we do not provide support for MS Office 97.
What common applications are not supported by File Scrub?
File Scrub cannot review MS Project, Primavera, or any e-mail programs.
Why must I have Office 2007 on the File Scrub machine to review Office 2007 files?
File Scrub opens Office 2007 applications to aid in the review. Because the format of Office 2007 files is fundamentally different from previous versions of Office, only the Office 2007 applications will
permit a correct review. This is why you cannot open Office 2007 files
with any previous version of Office.
If I upgrade to Office 2007, can I still review older Office files with it? Will they come out as Office 2007 cleansed files (with the docx extension)?
Yes, you can still review files created with previous versions of Office if you have Office 2007 on your machine. File Scrub will not automatically update old Office files to the
new 2007 format.
If I have Office 2007 on the machine, and open an older Office file using File Scrub's external tool review feature, will File Scrub convert the document to an Office 2007 document (with the docx extension)?
No, the files will not be converted to the Office 2007 format.
Will cleansed files come out with Office 2007 extensions, so they can only be opened with Office 2007 after they go through File Scrub?
Cleansed files will only be created with the Office 2007 extensions if the original files also have 2007 extensions. File Scrub will not convert old Office files to the new format.
Can I review Office 2007 files on a Mac?
No. Office 2007 cannot be installed on a Mac, and because File Scrub must open Office during reviews, Office 2007 files cannot be reviewed on a Mac.
Why does File Scrub offer low, medium, high, and unlimited settings for the number of files it can review?
Speed is the reason. The search algorithms take time, especially if you selected all options available on the Review window. Search time combined with large file sizes could lead you to believe, incorrectly, that File Scrub is hung. For this reason, File Scrub offers a range of settings including, for the first time, the option of reviewing an unlimited number of files in one session. If, in reviewing a large number of files during a review session, you find that reviews seem to be taking too long, we suggest reviewing fewer files at a time—which will also make reviewing the log files easier.
Does File Scrub automate the review process?
File Scrub is intended to be a tool that assists the reviewer in determining whether a file contains classified information. File Scrub is not designed for use without reviewer participation.
What is steganography?
Steganography is a message “hiding in plain sight.” One way of hiding a message within an image is to change the least significant bits so that they become the message bits. Because of their invasive nature, most steganography systems leave detectable traces within a medium’s characteristics, traces that allow the open source tool StegDetect that is distributed with File Scrub to detect specific types of steganography in JPEG files. In so doing, File Scrub reveals the presence of the secret communication but is not able to decode the information.
(back to the top)
Can File Scrub find pictures or graphics that contain hidden information or cover other graphics?
Yes. File Scrub has several features that enable the search for pictures and graphics that cover other objects or information.
File Scrub searches for steganography (messages that are hidden in plain view) in JPEG files and reports the risk of its presence. This feature is available on all platforms.
File Scrub treats a picture differently than a graphic object because a picture is a specific type of element in Word. When a picture is cropped in an MS Word document, the cropped area is not removed from the file; it is simply cropped in the visual rendering that appears on the screen or in the printed document. Therefore, if classified content is cropped from a picture, a casual visual inspection of the file will not disclose the classified information, although in most cases, manually selecting Reset Picture in the MS Word Pictures toolbar will reveal the cropped content. File Scrub locates cropped pictures and hidden objects in MS Word documents, and the Review log reports the presence of the cropped objects.
For all applications, File Scrub reports the number and, when possible, the types of embedded graphic objects. For PowerPoint, it reports the number of objects found on each slide.
Review results should always be verified by visually inspecting the file.
If the File Scrub Review log shows the presence of keywords, cropped pictures, or some other problem that indicates a visual review of the document, what is the easiest way to perform that visual review?
File Scrub provides a convenient mechanism for launching external review tools that are already on your computer—from File Scrub’s Tools menu, you can open the file using the various applications. When an external review tool is launched by File Scrub, log entries are created. These entries provide an audit trail of the steps taken to ensure that the file was more thoroughly examined. For more information about this feature, refer to the section "File Scrub and External Review Tools" in File Scrub’s Online Help.
Does File Scrub record in the logs when system date and time are changed?
File Scrub does not monitor changes to the system date and time in the log files—only File Scrub information. The date/time specifications on the log files are derived from the system clock. So, if the system date/time is changed when File Scrub is running, the date/time stamp of the Session log will not be changed because the Session log was started when the user launched File Scrub. However, each Review and Transfer log reflects the date/time of the system when each review and transfer occurred.
Does File Scrub cleanse the metatags and hidden code in .html source files?
No, it does not cleanse these .html file metatags and hidden code because information in .html files is present in clear text. File Scrub examines the source file, not the file displayed by the browser. Cleansing is done only in MS Office, WordPerfect, and PDF file formats.
Once a file is transferred to another medium, is that medium treated as "Protect as Classified" until it is reviewed by the second reviewer?
The answer to this question varies with the site. See your location’s security plan.
(back to the top)
Can a file that has a stop sign state be transferred out of File Scrub Trusted Copy if it is reviewed again and cleared by appropriate personnel?
A stop sign state indicates that the file has failed the hidden data stream review, has a binary or archive file extension, or is found to contain steganography or an intelligent agent. If the file has a stop sign state, that file cannot be transferred using File Scrub.
I experimented with File Scrub, reviewing three or four Word files. All of the files came back marked “failed.” I believe I am running Word in an out-of-the-box configuration without any special features, macros, and so forth. Why are the files failing?
The Word files may be failing review because the View Hidden Text option is turned off in Word. Windows users can set Word to display hidden text through the Tools > Options menu by selecting View > Formatting Marks > Hidden Text. Mac users choose Word > Preferences > View and check the Hidden Text check box. This adjustment only has to be performed once for a given installation of Word because View Hidden Text is an application-level setting. Always check the Review log to see which tests the file failed.
When a file's review comes back “Failed. See review log,” does that mean I can’t transfer the file using File Scrub Trusted Copy?
When a file fails review with a review state icon that is a red check mark with a circle bar, you can still transfer the file. However, during transfer, a Comments window will be displayed, and in the Comments, you should enter your justification for continuing the transfer. Your comments are recorded in the Transfer log. Then, complete the transfer.
(back to the top)
Transfer (Trusted Copy only)
What transfer media are supported?
Most media, except Windows mapped drives, are supported for transfer. Included are CDs, USB thumb drives, floppy disks, Jaz, zip, and, on some systems, peerless drives.
Why doesn’t File Scrub Trusted Copy support remotely mounted drives?
Remotely mounted drives are not supported because mapped drives that contain a large number of files can have performance and security issues.
Does File Scrub Trusted Copy do a standard Windows copy that copies the slack space on the file as well as the rest of the file, or does it copy only the exact file size to ensure that extra or previous data will not also be copied?
Residual sector data is not transferred with the file. Please refer to the Online Help section "How File Scrub Transfers Files" for an in-depth discussion of this subject.
Why two reviewers?
The Master Security Plan at Los Alamos National Laboratory specifies two reviewers. The Department of Energy issued a directive that requires two reviewers when copying from a classified environment to a nonclassified environment. Your site requirements may differ.
When the second reviewer reviews the file, does this reviewer get a new comment box in the Additional Comments window during the transfer?
The comment box is only displayed when the user transfers the file. Therefore, if the two reviews were done in separate File Scrub sessions, there will be two different logs. The second reviewer can add comments when the transfer occurs.
(back to the top)
Miscellaneous
Can File Scrub scan e-mail?
File Scrub cannot scan e-mail but it can review an e-mail attachment if the attachment is in a supported file format.
How do I get File Scrub or File Scrub Trusted Copy?
You must submit a Conditions of Use form before you can download either File Scrub or File Scrub Trusted Copy. You can link to this form from the Downloads page. After your Conditions of Use form is approved, you can obtain File Scrub or File Scrub Trusted Copy, detailed download instructions, and the File Scrub decryption software from the Downloads page. If you are unable to download the software or are experiencing problems, contact the File Scrub specialist at 505-667-2975 or e-mail filescrub@lanl.gov.
What training is available?
The User Tutorial is a step-by-step manual of exercises that demonstrate File Scrub’s operation and features. Using the tutorial, you will learn to select files for review, review files and examine those that fail for specific reasons, and transfer files to external media.
The User Tutorial (Tutorial.pdf) is available in the doc folder in the install package.
File Scrub Help is included in the install package in the doc folder (FileScrubHelp.pdf) and is accessible inside the application by clicking Help on the menu bar.
What future platforms will be supported?
Feedback from users regarding desired platform and application support is welcomed.
Can log files be deleted?
Yes, log files can be deleted, moved, or archived, according to the user’s security plan.
(back to the top)
 |
