tw4l / brunnhilde

Siegfried-based characterization tool for directories and disk images
MIT License
82 stars 11 forks source link

Change BE SSN recognition mode? #24

Closed tw4l closed 7 years ago

tw4l commented 7 years ago

See bulk_extractor 1.5 release notes, in particular:

`SSN recognition: you are now able to specify one of three SSN recognition modes:

-S ssn_mode=0 SSN’s must be labeled “SSN:”. Dashes or no dashes are okay.
-S ssn_mode=1 No “SSN” required, but dashes are required.
-S ssn_mode=2 No dashes required. Allow any 9-digit number
that matches SSN allocation range.`

BE currently called with ssn_mode 2, which is resulting in many false positives. Consider switching to mode 1?