Hi
I've just had a visit from my public protection office, I have file auditing turned on filled my c drive event log store in under an hour!!  I've had a look through and their tool appears to be proprietory and access a number of areas. I'm still going through the log but it appears to do the following
Scan for all executables on your hard drive on all partitions
Scan for all images
Checks for any proxy usage
Scans for all images - to what end i'm not sure. I mean does it copy them or just write the names into a text file?
The program is called: osTriage2.0.0.3.exe and the event log entry is below
There is also a helperapp that runs.


My concern is that if the app does the following
1 - Copies personally identifiable informaiton to an unencrypted drive
2 - is designed to allow someone with little or no experience to run and potentially arrest someone for just ticking a box.

==========================================================
An attempt was made to access an object.

Subject:
Security ID:J***********\*****
Account Name:james
Account Domain:***************
Logon ID:0x2A7F0696

Object:
Object Server:Security
Object Type:File
Object Name:\onedrive\OneDrive - **********\private\salvage\recovered\DSC02402.jpg
Handle ID:0x840
Resource Attributes:S:AI

Process Information:
Process ID:0x40e0
Process Name:\Device\HarddiskVolume12\osTriage2.0.0.3 - SOPO\osTriage2.0.0.3.exe

Access Request Information:
Accesses:ReadData (or ListDirectory)

Access Mask:0x1
================================================

It also accesses the recycle bin too

A handle to an object was requested.

Subject:
Security ID:J*******
Account Name:********
Account ******************************
Logon ID:0x2A7F0696

Object:
Object Server:Security
Object Type:File
Object Name:\$RECYCLE.BIN\S-1-5-21-81388288-117615736-41980065-1001\$R5TN288.JPG
Handle ID:0x2b4
Resource Attributes:-

Process Information:
Process ID:0x40e0
Process Name:\Device\HarddiskVolume12\osTriage2.0.0.3 - SOPO\osTriage2.0.0.3.exe

Access Request Information:
Transaction ID:{00000000-0000-0000-0000-000000000000}
Accesses:SYNCHRONIZE
ReadData (or ListDirectory)
ReadAttributes

Access Reasons:SYNCHRONIZE:Granted byDA;ID;FA;;;BA)
ReadData (or ListDirectory):Granted byDA;ID;FA;;;BA)
ReadAttributes:Granted byDA;ID;FA;;;BA)

Access Mask:0x100081
Privileges Used for Access Check:-
Restricted SID Count:0

==========================================

This is the process starting
A new process has been created.

Creator Subject:
Security ID:***************
Account ***************
Account Domain:***************
Logon ID:0x2A7F0696

Target Subject:
Security ID:NULL SID
Account Name:-
Account Domain:-
Logon ID:0x0

Process Information:
New Process ID:0x29a0
New Process Name:\Device\HarddiskVolume12\osTriage2.0.0.3 - SOPO\Plugins\__tmp\c5865ccc-74af-498f-bba3-6157e3a3b34b\osTriageHelperApp.exe
Token Elevation Type:%%1937
Mandatory Label:Mandatory Label\High Mandatory Level
Creator Process ID:0x40e0
Creator Process Name:\Device\HarddiskVolume12\osTriage2.0.0.3 - SOPO\osTriage2.0.0.3.exe
Process Command Line:

oh as a side note - it appeared to monitor my arp cache and dns servers!!