Product Features

Keywords for Personally Identifiable Information (PII) in Magnet Axiom

We’re often asked at Magnet Forensics, are there any available pre-built PII keyword lists or any other PII specific features available for such a case?

There are a few great resources in respect to PII keywords, but I unfortunately there doesn’t seem to be one single wide-ranging list of PII keywords for the DFIR community.

We decided we needed to fix this issue. Not only for the sake of this customer, but for the DFIR community as a whole. We began compiling some of the more common types of PII that you might come across in an examination and utilized the resources listed below to create a comprehensive keyword list for DFIR examiners. Another big shout out to Mike Williamson, one of Magnet’s Technical Forensic Consultants, for assistance and sanity checks on some of the REGEX keywords. We truly have an amazing forensic army here at Magnet Forensics!

You can access the list here at DFIR.training in a .txt format which is easily importable into Magnet Axiom. The list contains both plain text and regular expression keywords. Here are just a few of the REGEX keywords you’ll find there.

Physical Addresses – This REGEX keyword, adapted from bounteous.com, is an attempt to surface common suffixes of an address. Of course, the shorter ones will generate some false positives, so edit as you see fit!

(street|st|road|rd|drive|dr|lane|ln|avenue|ave|boulevard|blvd|highway|hwy|township|twp|north|south|east|west)

US Phone Numbers – Also adapted from bounteous.com, this expression will find phone numbers from the United States, with or without an area code or extension.

 (?i)((\+?1(\.|-|\s)?)?)\s*((\(?\d{3}\)?(\.|-|\s*)?)?)\s*(\d{3}(\.|-|\s*)?)\s*(\d{4}\s*(((x|ext)\.?(ension)?)\s*\d*)?)

Email Addresses – adapted from cardinalpath.com

([\w\.-]+)@([\da-zA-Z\.-]+)\.([a-zA-Z\.]{2,6})

US Social Security Numbers – Following the rules of US SSNs, this REGEX keyword attempts to find as few false positives as possible. The resource linked is from oreilly.com.

 (?!000|666)[0-8]\d{2}(-|\s)(?!00)\d{2}(-|\s)(?!0000)\d{4}

Credit Card Numbers per Vendor – Regular-expressions.info is an AMAZING resource for writing REGEX patterns.

VISA – 4[0-9]{12}(?:[0-9]{3})?

MasterCard – (?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}

American Express – 3[47][0-9]{13}

Diners Club – 3(?:0[0-5]|[68][0-9])[0-9]{11}

Discover – 6(?:011|5[0-9]{2})[0-9]{12}

JCB – (?:2131|1800|35\d{3})\d{11}

Additional keywords found in the PII keyword list on DFIR.training were found here. And a HUGE shout out to Brett Shavers for hosting the DFIR.training site which houses a TON of other keyword lists and additional resources for the DFIR community.

If you are looking to share with the DFIR community, it’s a great place to submit resources you find useful in your own examinations! Also check out this blog from Jamie McQuaid, Technical Forensic Consultant here at Magnet Forensics, that details utilizing keyword lists in Magnet AXIOM, and this recorded webinar from myself and Trey Amick that shows these keywords in action in Magnet AXIOM Cyber.

So fellow examiners, if you are working an investigation involving PII, and need a starting point of what to search within AXIOM, check out this keyword list for a head start. We encourage you to update, modify, and add to this list to benefit the greater DFIR community! And as always, if you need any assistance with AXIOM, REGEX, or anything in DFIR, please do not hesitate to reach out to any of us here at Magnet Forensics. One of our experienced forensic examiners will be able to assist!

If you’re not already using Magnet AXIOM or AXIOM Cyber in your examinations and want try it for yourself, request a trial today!

Subscribe today to hear directly from Magnet Forensics on the latest product updates, industry trends, and company news.

Start modernizing your digital investigations today.

Top