The commands can be a bit confusing to the first-time user as both STRSRCH and URL_SRCH use many switches. The basic command structure for STRSRCH is strsrch -p c: -s string.fle -o d:output.fle, which has the utility search the entire C: drive for anything listed in the string.fle file. The resulting output is stored on d: in a file named output.fle.
The basic command structure for URL_SRCH is: URL_SRCH -p d:path -o c:tmpoutput -w -m 200 -d "|". This command searches the d:path directory and all subdirectories for URLs, IPs and email addresses. When found, the results are stored in a wide format with a maximum length of 200 characters separated by the pipe symbol “|”.
The greatest advantage to the utilities is the cost at $95 plus a one-time dongle fee of $25. These utilities can be used as an inexpensive way to search large firewall, router or intrusion detection/intrusion prevention log files for specific strings. For example, a search can be run against a content filter system for inappropriate words for use in an internet abuse investigation. The same strings can be used against a Check Point firewall log to look for access to inappropriate images, or even to search a local system for the same. Also, these utilities can be combined with the free AccessData Forensic Imager to create an inexpensive toolkit.
There are help files included on the website for download and for purchase of the utilities. Each is quite lengthy and covers most, if not all, command line options.
The STRSRCH and URL_SRCH utilities are $95, plus a one-time dongle fee of $25.