Using the Fingerprint Search Option

The Fingerprint search option enables you to locate files based on their entire contents. Each file has a unique SHA-1 (Secure Hash Algorithm 1) or MD5 (Message Digest Algorithm 5) value associated with its contents. SHA-1 is a cryptographic hash function designed by the United States National Security Agency (NSA) and is usually expressed as a 160-bit (20-byte) hex number or signature. CloudAdvisor determines the SHA-1 or MD5 cryptographic hash value of each supported file and provides this "fingerprint" as a 40 character (SHA-1) or 32 character (MD5) hexadecimal value in the Current Analyzed Version Tile.

By using the fingerprint search option, you can do the following:

• Locate a file based on its unique content.
• Find all files with identical content, even if the files have different names or reside in different locations in a VM.
• Ensure that a file has not changed over time, by viewing the file fingerprint from different DiscoveryPoints.
• Ensure that a file containing specific content, as identified by the file SHA-1 or MD5 value, does not reside in the CloudAdvisor inventory.

Selecting the Fingerprint option from the Search Builder drop-down menu in the Search tab displays a qualifier menu and a text bar for use in the fingerprint search.

When using a fingerprint in a search, keep the following in mind:

• CloudAdvisor uses fingerprints to perform searches that match the entire contents of supported files.
• You can obtain the fingerprint (SHA-1 or MD5 value) for a file that resides in the CloudAdvisor inventory from the Current Analyzed Version Tile for that file.
• You can compute the SHA-1 cryptographic hash value of a file using utilities or commands specific to your operating system. For example:
  • On Microsoft Windows systems, you can use the File Checksum Integrity Verifier (FCIV) utility. Using a Windows command window, migrate to the folder that contains the FCIV utility and enter the FCIV -sha1 path\filename.ext command, where path\filename.ext is the full path, file name, and extension of the file for which you want to compute the SHA-1 value.
  • On Linux platforms, from a terminal window, enter the sha1sum filename command, where filename is the name of the file for which you want to compute the SHA-1 value.
• You can specify only one fingerprint in a fingerprint term.
• Fingerprints are intended to find exact matches for the entire file content; wildcard values are not supported.
• The fingerprint is not case sensitive; you can specify the fingerprint (SHA-1 or MD5 value) using either uppercase or lowercase letters.
• Multiple fingerprint terms in the search bar are treated using a logical OR function.
• When used in combination with other, non-fingerprint search terms, each different term is treated using a logical AND function.

To add a fingerprint term to the search bar:

1. Click inside the search bar.

2. Select Add Search Option > Fingerprint.

   The Fingerprint option expands to show a menu from which you can choose a qualifier and a text box in which you can specify the fingerprint.

   You can obtain the fingerprint of a file from the Current Analyzed Version Tile.

3. Click Add.

   The Search Builder adds the textual equivalent of your selections to the search bar and automatically reruns the search.