How do I decide what to do with the results of the Identity Finder search?

  1. If the files are no longer needed, Shred (secure delete) them – even if they are documents that reside in email.
  2. If the files are needed, but the identifying information is not needed, remove the identifying information from the files. The Scrub function in Identity Finder is able to automatically redact just the PII information from a file.
  3. If the match is a false positive, use the Ignore option within Identity Finder to remove them from the results list. You only have to ignore a file or match one time – once the collection is ignored, Identity Finder will not flag it in successive runs.
  4. If the files are needed and the identifying information must be kept:
    • Determine if they can be moved to a more secure location such as a department file share.
    • If the file can’t be moved, do not take any action with Identity Finder.

Can I install Identity Finder on my home computer?

The University of Rochester license covers only University owned computers. Personal computers are not covered under the University’s license. However, Identity Finder offers a free version for home use with limited functionality, available from their web site.

Do I have to be connected to the University's network to run an Identity Finder search?

No, you do not need to be connected to the network to run a search. The initial software installation is the only time when you must be connected to the University’s network.

I get a warning saying Windows Firewall blocked Identity Finder. What do I do?

When Identity Finder is first installed or is upgraded, sometimes a Windows 7 computer will show an alert that the firewall blocked Identity Finder from connecting:

firewall warning screenshot

When you receive this message, choose “Allow access” to allow Identity Finder to function. If you receive the message again, try selecting all three options – Domain, Private and Public – and then choose “Allow access.”

How will I know if Identity Finder is running a scheduled scan (one I did not start myself)?

University IT runs monthly scans of all computers with Identity Finder. You do not need to take any action to begin the scan, but will notice that the Identity Finder application loads in the dock and is minimized. These scans may be scheduled during working hours, as you need to be logged into the computer when the scan starts so the software can search your personal email and files.

On Windows an icon will appear in your system tray and show this notification alert:

identity finder screenshot

You can double click the system tray icon at any time to view the status of the search. Another notification will appear when the search has finished, and you will be presented with a report of the results for you to take action.

On a Mac, the Identity Finder application will appear briefly, then be minimized to your dock. You can maximize the application at any time to view the status of the search. When the search completes, the application will maximize and present a report of the results for you to take action.

What is Identity Finder configured to search?

On Mac, Identity Finder will search files on all locally attached devices, including thumb drives and CD-ROMs. Folders in your personal profile such as Desktop and Documents are included in the search. Email is not searched.

On Windows, Identity Finder will search files on all locally attached devices, including thumb drives and CD-ROMs. Folders in your personal profile such as the Desktop and My Documents are included in the search. Additionally, your Exchange email account will be searched, including your primary mailbox, PST mail archives, and any shared mailboxes to which Outlook is attached.

Can I search my home drive (personal network share) with Identity Finder?

Yes, you can manually search your home drive with Identity Finder. To search your home drive, open My Computer and right click on your home drive. Select the Identity Finder submenu and choose Search. Identity Finder will open and begin searching.

identity finder screenshot

Identity Finder says the file is read only and can't be shredded. What should I do?

Identity Finder will not shred a file if it is marked as “Read Only” by Windows. To change this property and allow Identity Finder to shred the file, right click on the file and choose “Properties.” Under “Attributes” unselect “Read-only” and click “OK.” Then try shredding the file again from within Identity Finder.

What email within Outlook will be searched?

If multiple profiles are set up with different types of accounts or accounts for different people, they will all be searched. All shared mailboxes such as departmental mailboxes attached to those profiles will be searched. Exchange Public Folders are not searched. Both email messages and attachments are searched.

If an email attachment has a finding and I shred it, what happens?

If an email attachment has a match and an action is taken, the whole message is affected. For example, if you shred an attachment, the whole email message is shredded.

 

Can I search Entourage or Outlook on a Mac?

No, Exchange email through Entourage or Outlook on a Mac cannot be searched. If you need to search your email, you should log into a Windows computer that has Outlook installed and use Identity Finder on that computer to search your mailbox.

Identity Finder keeps freezing on my Mac and I can't complete a search. What can I do?

A search in the Identity Finder Mac client can take a long time depending on the size of your hard drive and the types of files stored on it. If it appears that Identity Finder is frozen, try pausing and resuming the search. If it successfully pauses and resumes but still appears stuck on the same file, let it sit for at least one hour.

If you have an external hard drive connected that is used for Time Machine, you can also try disconnecting it and running another search.

Should the Identity Finder title bar show "(Guest Profile)"?

Yes, it should. The University’s Identity Finder policy configuration requires that the guest profile be used.

What information is reported back to the central server?

Computer information, match locations and counts, and user name are reported back to the server. The actual match data itself is not sent (for example, the SSN numbers are not reported).

Why can't I scrub this file?

The Scrub option can only be performed on certain types of files – specifically plain text and non-proprietary file types. Email messages, attachments, PDF files, and files within .zip files cannot be scrubbed.

What if I don't know what a file is?

If you don’t know what the file is, don’t delete it. Consult with your IT support representative first to make sure that the file is not critical to an application or the operating system.

Why do I get a message saying "No Identity Match Selected" when trying to ignore an identity match?

This occurred because you were selecting a file with multiple matches. To use Ignore Identity Match, you must expand the file to view all the matches and select one particular identity match number to ignore.

Why does Identity Finder show a message saying Mac OS has reported a disk error?

Occasionally, when running an Identity Finder search on your Mac, you may be prompted with a message notifying you that Mac OS has reported a disk error. These errors occur during regular use of your Mac computer. To fix them, please run the Disk Utility following the instructions in this Identity Finder Knowledge Base article.

Why does Sophos Antivirus alert me that I have a virus every time Identity Finder runs?

When an Identity Finder search runs, it looks in every file and email attachment on your computer. Some files such as .zip files must be copied to a temporary folder to be searched. As the files are opened, Sophos also checks the file for malware. If Sophos finds malware in the file, it will only be able to clean the file from the temporary location where Identity Finder put it to be searched. To determine the original location of the infected file and clean it, you should run a full virus scan of your computer. Please note that the full virus scan will not search your email messages or attachments, so any malware from email will have to be located manually.