How to Use WSScan for Dell Data Security

A user can analyze the WSScan results through:

• WSScan user interface (UI)
• WSScan.log, located by default at %temp%

An example WSScan UI output:

Below is a line from WSScan output:

Time of Scan

Time WSScan scanned the file.

Key

Data Centric can contain five type of keys depending on how policies are configured:

• SDE Key

This is a file that is encrypted under the "Fixed Disk" policies. This key is unlocked during boot. We unlock this key by validating the hardware profile, and validating checksums on some operating systems files to prevent hacking attempts. Each partition is assigned Key Computer ID (KCID) that is tied to the same SDE bundle.

Example of a SDE key in WSScan:
[2015-08-28 14:01:48] SysData.1gx8z64b._SDENCR_: "C:\Windows\Web\Wallpaper\Theme2\img7.jpg" is still AES256 encrypted.

• SDUser

This is a subkey of SDE that is unlocked when an authenticated user logs in. This is treated similarly to Common and how it is unlocked. Namely, files in any user's My Documents folder that are encrypted by SDE cannot be opened unless there is a user that is logged into the computer interactively. Files that fall under this definition are labeled as SDUSER encrypted. Situations that warrant the use of SDUSER encryption are, for example, an unmanaged user's My Documents folder or all users' My Documents folder if the policy is SDE only. Although the name could be interpreted to imply that User encryption is in play, it is not.

Example of a SDUser key in WSScan:
[2015-08-28 14:00:25] User.1gx8z64b._SDUSER_: "C:\Users\Public\Documents\desktop.ini" is still AES256 encrypted.

• Common

Common key is unlocked when a managed user successfully authenticates to an endpoint. A managed user is someone who has activated successfully against the Dell Data Security product. Only one common key exists.

Example of a Common key in WSScan:
[2015-08-28 15:17:19] Common.G4FHL19J._DEVICE_: "C:\Users\UserName\Desktop\Access Encrypted Files (Mac).dmg" is still AES256 encrypted.

• User

User keys are unlocked when a specific managed user successfully authenticates to an endpoint. Only that specific user has access to files protected with their User key. User keys have the UID populated.

Example of a User key in WSScan:
[2015-08-28 15:17:19] User.G4FHL19J.4N5A97MG: "C:\Users\UserName\Desktop\Test.txt" is still AES256 encrypted.

• UserRoaming

UserRoaming keys are unlocked when a specific user successfully authenticates to a device. Unlike User key, the UserRoaming key may be used on multiple endpoints. UserRoaming keys have the UID populated.

[2015-08-28 15:17:19] UserRoaming.X8FDSH9A.5D4VHGN2: "E:\Sample\Example.docx" is still AES256 encrypted.

DCID

Device Computer ID. This is the ID that the Dell Security Management Server assigns to a unique Machine ID (MCID).

UID

User ID of the managed user. The UID is a unique identifier that is associated to a UserRoaming or User Key for a specific user.

Encryption Type

Algorithm being used to encrypt the files. Data Centric Encryption may use:

• RIJNDAEL 128
  • Deprecated as of client v8.6.1
• RIJNDAEL 256
  • Deprecated as of client v8.6.1
• AES 128
• AES 256
• 3DES
  • Deprecated as of client v8.0