Analyzing Extracted Results

Here are some Helpful hints for analyzing the SlackExtract Output.

*Note that the text files are written in UTF-16 format so standard grep will not work. PowerShell is the way to go in this case.

Useful Searches on User Data:

• Extract all names

dir -Recurse | select-string `"name`" (the grave accent mark, or back tick, is the PowerShell way to escape a special character)

• Extract all email addresses

dir -Recurse | select-string `"email`"

• Extract names and job titles

dir -Recurse | select-string "(`"title`"|`"name`")"

• Write just the names to a file

( dir -Recurse | select-string "(?<=`"name`":\s*`")(.*)(?=`")" ).matches.value | Out-File usernames.txt

(?<=`"name`":\s*`") means the value to match is proceeded by "name": and any number of spaces and then a double quote

(?=`") means the value to match is followed by a double quote

(.*) means to match zero or more of any character between the two things described above