File scanning tool

A method of determining the origin location of compromised information in a structured data file, comprising:

• receiving, in a scanning tool, at least one of format information or content information from the compromised information in the structured data file, using a processing device operatively coupled to a memory device and a communication device, and configured to execute computer-readable program code of the scanning tool;
• scanning a plurality of networked devices for origin structured data files with the format information or content information similar to the compromised information in the structured data file, using the processing device, wherein scanning comprises:
• identifying a header in a scanned origin structured data file;
• determining the content of the header in the scanned origin structured data file;
• identifying a sample value in a scanned origin structured data file;
• determining the format of the sample value in the scanned origin structured data file;
• determining the content of the sample value in the scanned origin structured data file;
• assigning the header most likely associated with the sample value in the scanned origin structured data file when the sample value does not have a header;
• comparing at least one of the header or the sample value from the compromised information in the structured data file with the corresponding header or the sample value from the origin structured data files;
• and
• outputting a potential origin location for the compromised information in the structured data file based on the location of the origin structured data files scanned, using the processing device.

A file scanning tool system for determining the origin location of compromised information in a structured data file, comprising:

• a memory device;
• a communication device;
• a processing device, operatively coupled to the memory device and the communication device, and configured to execute computer-readable program code to:
• receive format information or content information from the compromised information in the structured data file;
• scan a plurality of networked devices for origin structured data files with at least one of format information or content information similar to the compromised information in the structured data file;
• and
• output a potential origin location for the compromised information in the structured data file based on the location of the origin structured data files scanned.

A computer program product for a file scanning tool, for determining the origin location of compromised information in a structured data file, comprising at least one computer-readable medium having computer-readable program code portions embodied therein, the computer-readable program code portions comprising:

• an executable portion configured for receiving format information or content information from the compromised information in the structured data file, using a processing device operatively coupled to a memory device and a communication device;
• an executable portion configured for scanning a plurality of networked devices for origin structured data files with at least one of format information or content information similar to the compromised information in the structured data file, using the processing device;
• and
• outputting a potential origin location for the compromised information in the structured data file based on the location of the origin structured data files scanned, using the processing device.