Search
eHelp  

eHelp » Security » Removing SSNs - Windows

Using Virginia Tech's "Find_SSNs" Tool

Find_SSNs is a simple-to-use Windows application. Developed by Virginia Tech, Find_SSNs searches for files that may contain data matching the known patterns of social security numbers. The program scans for SSN in the following formats (where N is a number and the numbers as a whole are validated as a potential SSN):

• NNN-NN-NNNN
• NNN NN NNNN
• NNNNNNNNN

Unfortunately, Find_SSNs is not a foolproof solution. It will also find false positives. You must verify the existence of the data before taking action to protect, remove or delete the data from your files.

Important Notes:

Consult your local campus technician; it is best to involve him/her. Your technician helps ensure correct procedures are followed.

Clear your web browser’s cache. Clearing the cache before running Find_SSNs usually eliminates many of the files that will be flagged.

Find SSN will scan:

• Microsoft Word, Excel and Access as well as file formats that store data in plain text
• The OASIS Open Document XML format (Open Office 2) and the Microsoft Office 2007 Open XML format

Find_SSNs will not scan:

• PDF (Adobe Portable Document Format) and PST (Microsoft Outlook) files
• Encrypted files
• Nested zip archives
• Files larger than 100 Megabytes
• System files and multimedia files

Downloading Find_SSNs

Cal Poly Pomona has customized a version of Find_SSNs for its internal users.

Note: This software program requires access authorization for downloading.

Download for Windows: Download Find_SSNs

Notes:

• The Find_SSNs tool is in a ZIP file format. If you are not sure how to open (unzip, decompress) ZIP files, see http://www.csupomona.edu/~ehelp/security/remove_ssn_extracting_zipfiles.shtml (link opens in a new window).
• Find_SSNs does not require any installation.
• You can download the Find_SSNs tool to your desktop, My Documents folder, thumb drive or other data source.

 

Running Find_SSNs

1. Run the downloaded file, Find_SSNs.exe.
2. A warning window appears, saying, "There may be periods of inactivity in the program. Please be patient."
   1. Click OK.
      
      
      
3. Select the folder or drive you want to scan.
   
   Note: If you choose My Computer, you will be scanning any mounted or network attached devices as well as removable media. It is advisable to scan hard drives by selecting them individually.
   
   
4. Once you have selected the scanning destination, select the OK button.
   
   
   
5. A window will appear, asking if you want to continue using the computer during the scanning process. Click Yes.
   
   
6. The scan will begin and you will see a progress bar.
   
   
   
7. When the scan is completed, you will see a screen that details the next steps as well as the location of the scan results.
8. Print or save the directions on this screen (Find_SSNs Instruction Screen).
   
   Note: This screen will close when you select OK, and will not be available unless you repeat the scan.
   
   
   
   
9. Open the results.html in the Scan_Results folder.
   
   Note: Make sure you read the results.html file in your web browser (Internet Explorer, Fire Fox, etc.).
   
   
   1. Suspect files are listed in the results.html file with a link to each file and the suspicious number.
   2. Examine the files carefully to verify they contain social security numbers.
      
      Note: Find_SSNs can produce a number of false alarms due to the method it uses to locate potential social security numbers. You must verify each file to ensure the data is truly a social security number before deciding what to do with the file.
      
      For example, Bronco ID numbers are nine digits and may be the source of many false positives.
      
      
   3. If you no longer need the files containing the SSN, securely delete them and empty your computer's trash or Recycle Bin. To learn how to securely delete SSNs, see http://www.csupomona.edu/~ehelp/security/remove_files_securely.shtml.
      
      Microsoft Office files maintain memory of deleted items. Simply removing a column in a spreadsheet or Word document does not adequately remove the Social Security number.
      
      
   4. If you need the files containing the SSN, store them in a secure, encrypted location.
      
      
10. Promptly remove the Find_SSNs log file. The Find_SSNs logs must be protected. They are often a direct road map to your files containing sensitive information. Whenever possible, remove the log files after you have protected or removed the files that contain restricted SSN data. To learn how to securely delete sensitive files, see http://www.csupomona.edu/~ehelp/security/remove_files_securely.shtml.

 

If you have any questions or concerns about the Find_SSNs process, submit a Help Desk ticket or stop by the I&IT Help Desk. The I&IT Help Desk is located in Building 1, Room 100. It is open Monday - Thursday, 7:30 AM - 6:00 PM and Friday, 8:00 AM - 5:00 PM (excluding state holidays).

For more eHelp security information, including tips, see http://www.csupomona.edu/~ehelp/security/index.html.

This page was last updated on October 1, 2008.