internet monitor internet monitor buy statlook internet monitor internet monitor
surveillance software
surveillance software
screen capture
remote desktop
internet monitor
productivity improvement
spector pro
surveillance software
-- previous chapter -- -- table of contents -- -- next chapter --

Software audit

Software audit enables you to determine which operating system and computer programs have been installed on hardware disk of a computer user. Additionally, information on computer subassemblies is retrieved. When an audit is completed, information found is sent to uplook In a computer network audit can be performed remotely using Agents. If users’ computers are not connected to a network or Agent installation is not possible, audit is performed by an external file scanner.

Software audit consists of several stages such as:

  • Scanning hard disk drives using Agent or an external file scanner. While scanning the program fetches information on all executable files, stored in a computer which is being audited. It is also possible to collect information on files of any type - defined by a user. Besides, the operating system is identified and installed application data, which is available from a registry, is read. To relate audit results uniquely to a specific computer, information on BIOS, processor, memory, hard disk drives and network cards is fetched.
     
  • Sending results to uplook. If Agent was used for scanning, results are sent automatically when scanning is completed. If a connection with Agent has been already closed, the results are sent once the next connection is established. In the case of an external file scanner, it is necessary to import audit results.
     
  • Identifying applications. It is the most significant stage of software audit. Information on each application retrieved in the course of hard disk scanning, is compared with a pattern base. Additionally, the relation between executable files which have been read and information fetched from a registry is checked, which helps to identify software packages.
     
  • Preparing reports for specific computers. A report is a summary of audit for a single computer. It can be printed or saved as a Microsoft Excel workbook. You can enter adjustments while editing the report, for example delete some applications, including freeware software or elements of an operating system
     
  • Preparing a summary report. This report type enables to group and sum up audit for all or selected computers. You receive an overview of software according producers with optional identification of users for each program or an overview of programs according to users. A summary report can be printed or saved as a Microsoft Excel workbook.

In the process of software identification an application pattern base is used. As new programs appear on the market, the base is updated and you can download its updated version for free. Considering the fact that it is unfeasible to create a base including information on all programs, uplook enables to extend the base by adding patterns created by a user. This way you can “teach” uplook to detect many applications which are unique or specialist and are not widespread.

The identification process is divided into the four following stages:

  • Analysis according to patterns defined by a user for Microsoft Windows applications.
  • Analysis according to patterns defined by the producer for Microsoft Windows applications.
  • Analysis according to patterns defined by users for console applications, DOS or Windows 3.x.
  • Analysis according to patterns defined by the producer for console applications, DOS or Windows 3.x.

The mechanism of identification which was applied in uplook uplook has one more essential attribute. When the base is updated or specific application patterns are defined, it is not necessary to perform software audit once again. After each pattern modification all programs which were found in the course of previous audits are identified again.

uplook classifies programs into the four following groups:
  • Identified applications. The group includes all programs which have been identified in the process of comparing with an application pattern base and are not treated as omitted.
     
  • Identified applications - omitted. The group includes all programs, which have been identified in the process of comparing with a pattern base, but they are marked as to be omitted in this base. It applies to most of freeware software and elements of an operating system or unessential elements of software packages.
     
  • Unidentified applications. This group includes all programs which have been identified in the course of comparing with an application pattern base, but they provide information required to create a relevant pattern.
     
  • Unidentified applications – omitted. This group includes all unidentified programs, which do not provide complete information required to create a pattern. It is, however, possible to identify a pattern on the basis of general parameters of an executable file. This group includes most applications designed for Windows 3.x or DOS environments.

Using a compare audit function you can compare any two audits performed on the same computer. This way you can obtain information on the changes entered between two audits. 

 

How to create efficient application patterns

-- previous chapter -- -- table of contents -- -- next chapter --
surveillance software