Viewing Detailed Fingerprint Information
When a classification is selected under DeviceLock Enterprise Server > Digital Fingerprints > Fingerprints Database in the console tree, the upper part of the details pane lists the fingerprints attributed to that classification. In the lower part, the console displays information about versions and sources of the fingerprint selected in that list.
Fingerprints held in the database are taken from certain information samples (such as documents or image files), referred to as fingerprint sources. The server registers these sources with the database when adding or updating fingerprints.
When initially adding a fingerprint, the server registers its source as the only source of that fingerprint. For fingerprints existing in the database, the server may register additional sources. Thus, the server registers a new source file for an existing fingerprint in the following cases:
•The task has detected that the path or name of the earlier-registered source file changed. The file registers as a new source with the respective path and name.
•The task has added the fingerprint of a certain file as a version of the existing fingerprint and the file is not among the registered sources of that fingerprint. The file registers as a new source along with the new version of the fingerprint.
Having created a fingerprint, the server may add it to the database as a new fingerprint or as a version of another fingerprint that already exists in the database. A version is added if the percentage of matching elements of the existing fingerprint and the newly created one exceeds the threshold value specified by the respective setting (see
Fingerprinting Options).
Different versions of a fingerprint can be created by tasks of different classifications. As a result, the elements of the fingerprint are distributed among multiple classifications. Such a fingerprint is said to conform to multiple classifications, with some (non-zero) percentage of conformity to each classification.
Note: When matching the inspected content to a fingerprint from the database, a comparison is performed with the elements (hashes) of all versions of that fingerprint. |
The console provides the following information about the versions and sources of each fingerprint:
•Version - The number of the version. Initially the fingerprint has a single version with the number of one (1). Adding every new version increments the version number by one.
If necessary, the administrator can delete individual versions of the fingerprint by clicking the red X in the Remove column next to a version number in the list.
•Path - The full path and name of the fingerprint’s source. This may be a path on a local disk, or a UNC path on a network file server. If the source is contained in an archive file, the full path is composed of the path to the archive file and the path to the source within the archive.
Some versions may contain fingerprint elements (hashes) of multiple sources. In this case, the path and name of all those sources are listed in the Path column next to the number of the version.
The color of the icon in the Path column indicates the state of the fingerprint source:
•Green - Means that the source with the specified path and name exists and is scanned by some fingerprinting task on a regular basis.
•Gray - Appears in the following occurrences:
•The source with the specified path and name no longer exists (for instance, the source file has been renamed, moved or deleted).
•Date added - The date and time that the server last added to the database the fingerprints of the source specified.
•Last scan time - The date and time when fingerprinting tasks last scanned the given source.
•<Classification name> (%) - The percentage of the fingerprint’s elements (hashes) that conform to the classification specified. The list may contain several names since different elements of the fingerprint may conform to different classifications.