Software audit
Software audit enables you to determine which operating system and
computer programs have been installed on hardware disk of a computer user.
Additionally, information on computer subassemblies is retrieved. When an audit
is completed, information found is sent to uplook In a computer network audit can be
performed remotely using Agents. If
users’ computers are not connected to a network or Agent
installation is not possible, audit is performed by an
external file scanner.
Software audit consists of several stages such as:
- Scanning hard disk drives using Agent or an
external file scanner. While
scanning the program fetches information on all executable files, stored
in a computer which is being audited. It is also possible to collect
information on files of any type - defined
by a user. Besides, the operating system is identified and installed
application data, which is available from a registry, is read. To relate
audit results uniquely to a specific computer, information on BIOS,
processor, memory, hard disk drives and network cards is fetched.
- Sending
results to uplook.
If Agent was used for scanning, results are sent automatically
when scanning is completed. If a connection with Agent has been already closed, the results are sent once the
next connection is established. In the case of an external file scanner,
it is necessary to import audit results.
- Identifying
applications. It
is the most significant stage of software audit. Information on each application
retrieved in the course of hard disk scanning, is compared with a pattern base.
Additionally, the relation between executable files which have been read
and information fetched from a registry is checked, which helps to
identify software packages.
- Preparing
reports for specific computers. A report is a summary of audit for a
single computer. It can be printed or saved as a Microsoft Excel
workbook. You can enter adjustments while editing the report, for
example delete some applications, including freeware software or
elements of an operating system
- Preparing
a summary report. This
report type enables to group and sum up audit for all or selected
computers. You receive an overview of software according producers with optional
identification of users for each program or an overview of programs
according to users. A summary report can be printed or saved as a
Microsoft Excel workbook.
|
In the process of software identification an application pattern base is used. As new programs
appear on the market, the base is updated and you can download its updated version for
free. Considering the fact that it is unfeasible to create a base including
information on all programs, uplook enables
to extend the base by adding patterns created
by a user. This way you can “teach” uplook
to detect many applications which are unique or specialist and are not
widespread.
|
The identification process is divided into the four following stages:
- Analysis
according to patterns defined by a user for Microsoft Windows
applications.
- Analysis
according to patterns defined by the producer for Microsoft Windows
applications.
- Analysis
according to patterns defined by users for console applications, DOS or
Windows 3.x.
- Analysis
according to patterns defined by the producer for console applications,
DOS or Windows 3.x.
|
The mechanism of identification which was applied in uplook uplook has one more essential
attribute. When the base is updated or specific application patterns are
defined, it is not necessary to perform software audit once again. After each pattern modification all programs which
were found in the course of previous audits are identified again.
uplook
classifies
programs into the four following groups:
- Identified
applications. The group includes all programs which have been
identified in the process of comparing with an application pattern base
and are not treated as omitted.
- Identified
applications - omitted. The group includes
all programs, which have been identified in the process of comparing with
a pattern base, but they are marked as to be omitted in this base. It
applies to most of freeware software and elements of an operating system
or unessential elements of software packages.
- Unidentified
applications. This group includes all programs
which have been identified in the course of comparing with an
application pattern base, but they provide information required to
create a relevant pattern.
- Unidentified
applications – omitted. This group includes
all unidentified programs, which do not provide complete information
required to create a pattern. It is, however, possible to identify a
pattern on the basis of general parameters of an executable file. This
group includes most applications designed for Windows 3.x or DOS
environments.
|
Using a compare audit function you can
compare any two audits performed on the same computer. This way you can obtain
information on the changes entered between two audits.
How to create efficient application patterns
|