Audit & Security – User Guide

This section explains how the workstation audit and future security tools behave: what they scan, what they change (if anything), what reports and logs they produce, and how you can use them in internal investigations or compliance work.

High-level behaviour

Audit tools in this group are designed to run against existing folders or PCs without silently modifying evidence. By default, they scan paths, collect metadata about files, and write reports or logs to a chosen Output location. Only explicit “Secure Delete” actions are allowed to actually remove files, and those actions are meant to be logged.

Sanitize Docs

Clean metadata, comments and hidden data from supported documents in bulk.

What this button does

“Sanitize Docs” scans the Input folder for supported document types and creates cleaned copies in the Output folder with metadata, comments and other hidden content removed where possible.

Meant for “clean before sending” workflows, not for deep forensics.

Folder tree & file types

Reads the full folder tree from the chosen Input path.
Targets common document formats (PDF and office documents).
Leaves other formats either untouched or simply copied, depending on configuration.

The exact set of formats and cleaning rules may evolve between versions.

Output structure

Rebuilds the same relative folder tree under the Output path.
Saves sanitized copies there; originals in Input are not overwritten.

Typical use: compare originals and sanitized copies in a safe review environment.

Processing steps

Enumerates files under Input with supported extensions.
For each, opens or parses the file to locate metadata and hidden data.
Removes or resets fields that should not leave your organisation.
Writes a sanitized copy into the mirrored Output path.

Some fields cannot be fully stripped in all formats; always validate with spot checks.

Audit This PC

Scan drives or folders and build an inventory of potentially sensitive documents.

What this button does

“Audit This PC” scans the selected folder or drive, identifies files that match certain patterns (documents, archives, media, etc.), and builds a report of what was found for later analysis.

Intended as a discovery / mapping tool, not as a cleaning module.

Scope & file types

Can be pointed at a specific folder, a mapped drive or a removable disk.
Records information about document formats, archives and potentially media files.
Ignores many system and temporary files to avoid noise.

Scope is deliberately broad enough for incident response and internal audits.

Output structure

Produces one or more reports in the chosen Output folder (typically Excel or CSV).
May also write a log file summarising the scan configuration and any errors.

The original disk / folder is not changed by the scan.

Typical columns

FullPath, Extension, SizeKB.
Created / Modified timestamps from the file system.
Possibly a simple “category” (Document, Media, Archive, Other).

Use filters in Excel to narrow down to high-risk file types or suspicious locations.

Secure Delete + Audit Trail Planned

Controlled removal of selected files with a clear audit log (future module).

Concept

This planned module is designed to securely delete specific files only when a user explicitly confirms and to write an audit record of what was deleted, when, and from where.

Nothing here runs automatically; it is intended as a deliberate, supervised action.

Expected behaviour

Show a list of candidate files to delete (e.g. from a previous report).
Require explicit confirmation before any file is removed.
Write an audit log that can be attached to internal records.

Exact implementation and data fields may change as the module is developed.

Encryption Planned

One-click packaging of bundles into encrypted containers (future module).

Concept

The Encryption module is intended to take an already hardened bundle and wrap it into an encrypted container or password-protected archive, suitable for sending to external counsel or regulators.

It builds on top of other modules – it does not change how documents are cleaned.

Expected behaviour

Let you pick a folder with finalized, hardened documents.
Create an encrypted package at the Output location.
Optionally write a small manifest or log file with basic details.

Algorithm choice and packaging format will be documented once the module is available.

Back to User Guide overview