Local Storage and Local Memory

This section covers the following topics:

• Supported Operating Systems
• Local Storage
• Local Process Memory

Supported Operating Systems

Local storage and local memory are included by default as available scan locations when adding a new server or workstation Target.

ER2 supports the following operating systems as local storage and local memory scan locations:

Microsoft Windows Operating Systems

Ground Labs supports and tests ER2 for all Windows versions supported by Microsoft.

Prior versions of Windows may continue to work as expected. However, Ground Labs cannot guarantee support for these versions indefinitely.

Linux Operating Systems

Ground Labs supports and tests ER2 for all Linux distributions listed under Supported Operating Systems. However, other Linux distributions that are not indicated may work as expected.

Local Storage

Local Storage refers to disks that are locally mounted on the Target server or workstation. The Target server or workstation must have a Node Agent installed.

You cannot scan a mounted network share as Local Storage.

To scan Local Storage:

1. From the New Search page, Add Targets.
2. In the Enter New Target Hostname field, enter the host name of the server or workstation.
3. Click Test. If the host name is resolved, the Test button changes to a Commit button.
4. Click Commit.

5. In Select Types, select Local Storage. You can scan the following types of Local Storage:

   Local Storage	Description
   Local Files	To scan all local files: Select All local files. Click Done. To scan a specific file or folder: Click Customise next to All local files. Enter the file or folder Path and click + Add Customised. Windows: C:\path\to\folder\file.txt; Unix and Unix-like file systems: /home/username/file.txt.
   Local Shadow Volumes	Windows only To scan all local shadow volumes: Select All local shadow volumes. Click Done. To scan a specific shadow volume: Click Customise next to All local shadow volumes. Enter the Shadow volume root and click + Add Customised.
   Local Free Disk Space	Windows only Deleted files may persist on a system's local storage, and can be recovered by data recovery software. ER2 can scan local free disk space for persistent files that contain sensitive data, and flag them for remediation. To scan the free disk space on all drives: Select All local free disk space. Click Done. To scan the free disk space of a specific drive: Click Customise next to All local free disk space. Enter the drive letter to scan and click + Add Customised. Scanning All local free disk space is only available for Windows environments.

   Recommended Least Privilege User Approach

   Data discovery or scanning of data requires read access. Remediation actions that act directly on supported file systems including Delete Permanently, Quarantine, Encryption and Masking require write access in order to change, delete and overwrite data.

   To reduce the risk of data loss or privileged account abuse, the Agent user provided for the intended Target should only be granted read-only access to the exact resources and data that require scanning. Never grant full user access privileges or unrestricted data access to any application if it is not required.

Local Process Memory

During normal operation, your systems, processes store and accumulate data in memory. Scanning Local Process Memory allows you to check it for sensitive data.

To scan local process memory:

1. From the New Search page, Add Targets.
2. In the Enter New Target Hostname field, enter the host name of the server or workstation.
3. Click Test. If the host name is resolved, the Test button changes to a Commit button.
4. Click Commit.
5. In Select Types, select Local Memory > All local process memory.
6. Click Done.

To scan a specific process or process ID (PID):

1. From the New Search page, Add Targets.
2. In the Enter New Target Hostname field, enter the host name of the server or workstation.
3. Click Test. If the host name is resolved, the Test button changes to a Commit button.
4. Click Commit.
5. In Select Types, select Local Memory. Next to All local process memory, click Customise.
6. Enter the process ID or process name in the Process ID or Name field.
7. Click + Add Customised.