PANScout Download PANScout

PANScout user guide

For PANScout 1.0.1

Find payment-card data in files on your computer and mounted shares, review protected findings, and keep evidence of what was inspected. This guide covers the desktop application and the card-detector command-line scanner.

Getting started

Obtain software from the official PANScout download route and follow your organisation's software approval process. Choose the package for your operating system and processor. If you see a signature or integrity warning, check that you have the correct package and contact support if the warning persists.

Windows

Supported systems: Windows 11 or Windows Server 2022, with an x86-64 processor.

macOS

Supported systems: macOS 13 or later, on Apple silicon or Intel. Choose the package matching your Mac's processor; you can check it in About This Mac.

Linux

The initial supported desktop baseline is Ubuntu 24.04 with an x86-64 processor.

After installation

Installation may require an administrator; scans run as your ordinary signed-in user. You can inspect only files that user can read.

For the standalone CLI, keep the supplied worker and document-runtime together with the controller. Copying only the scanner executable loses PDF/image inspection support.

The desktop User guide action opens this document in your default browser, without changing your scan. The bundled guide works offline and describes the version shown above. The online user guide may cover a newer release. Use the contents links, your browser's Find command, zoom controls or Print command to navigate and read this guide.

Trial and paid licences

The Licence screen shows expiry dates and Choose licence file. This example shows an ended trial; your dates and status will differ.
The Licence screen shows expiry dates and Choose licence file. This example shows an ended trial; your dates and status will differ.

On first use, PANScout creates a local 14-day trial. Open Licence in the desktop to see the status and fixed expiry date. The Scan screen also shows your current access. No account or internet connection is needed for local trial verification or scanning.

To activate a paid licence, open Licence, choose Choose licence file, and select the signed licence file supplied for your purchase. PANScout checks it before replacing the installed licence. The selected source file is unchanged. An invalid, expired or not-yet-valid file does not replace a working licence. Keep the file private and do not edit it.

Desktop and CLI share the signed-in user's installed licence and trial. In a terminal:

card-detector licence status
card-detector licence activate --file ./customer.licence
card-detector licence status

Starting or resuming a scan requires an active trial or paid licence. If access expires, existing history, masked findings, reviews and reports remain available; a scan already running may finish. Do not delete trial records to resolve a verification error. Check the selected licence and contact support if verification still fails.

Choose what to scan

Use Add files or Add folder on the Scan screen. This example has an ended trial, so a current licence is needed before Start scan becomes available.
Use Add files or Add folder on the Scan screen. This example has an ended trial, so a current licence is needed before Start scan becomes available.

In Scan, use Add files or Add folder to select locations. You can select several locations and remove individual selections before starting. For a file share, first mount or map it in your operating system, confirm that you can read it, and select its local path. PANScout does not connect directly to mailboxes, databases or cloud accounts.

Choose locations relevant to your investigation: shared working folders, document exports, logs and archived files. Scanning one location does not establish coverage of the rest of your environment. Consider permissions and share availability before starting a large scan.

Open Options to add exact file or folder exclusions. Remove an exclusion to include that location again. User exclusions are recorded separately from automatic exclusions of PANScout state and report artifacts. Excluded content has not been inspected. The application remembers the last directory used by its file and folder pickers, falling back to the operating-system default if it is no longer available.

Inspection options and supported files

The Options dialog with Inspect PDFs and images enabled, exclusion controls and collapsed advanced inspection limits.
The Options dialog with Inspect PDFs and images enabled, exclusion controls and collapsed advanced inspection limits.

Open Options and enable PDF/image inspection when those files are relevant. This enables the bundled PDF and OCR tools; it can take longer than text scanning. It is off by default. The choice is retained during the current desktop session, including New scan, but is not silently saved across launches.

PANScout identifies content rather than trusting filename extensions. Supported content includes text (including extensionless text, CSV, TSV, JSON, XML, logs and Markdown), DOCX, XLSX, PPTX, ZIP, TAR, GZIP and ZLIB. With PDF/image inspection enabled it also inspects PDFs and PNG/APNG, JPEG, TIFF, GIF, BMP, WebP, JPEG 2000 and PBM/PGM/PPM images. Common text encodings and conservatively identified IBM037, IBM1047 and IBM1140 EBCDIC text are supported; arbitrary binary records and every EBCDIC code page are not guaranteed.

OCR can miss numbers in blurred, cropped, highly skewed or otherwise difficult images. A supported format does not guarantee complete extraction. Encrypted documents and unavailable content remain coverage gaps. Read the outcomes in the report even when no findings appear.

The advanced section in Options controls file size, file/worker timeouts, archive depth and expansion, extracted text and PDF page limits. Start with safe defaults. Raise a limit only when a reported coverage gap justifies the additional time or resource use. Reset safe defaults restores inspection configuration and removes user exclusions; your selected scan locations remain. Limits apply to the scan and are recorded with its effective configuration.

Run, pause and resume a desktop scan

Choose Start scan. Each start creates a separate scan and evidence report. Progress shows files processed out of files discovered when enumeration can determine the total; otherwise progress remains indeterminate. Live finding and coverage counts can change while work continues.

Pause stops work safely and saves completed and remaining files. Choose Resume scan to continue the same run, reusing unchanged completed files. You can also resume a paused scan from Scan history after restarting PANScout. Keep the source locations available; changed or inaccessible files may need further attention.

Cancel ends that run and preserves partial evidence. The desktop does not offer the paused-scan resume workflow for a cancelled run. To inspect again, start a new scan.

Scan history lists previous scans and their coverage/finding totals. Open a scan to review its saved results or report; Back to scan history returns to the list. New scan clears the current locations, exclusions and visible result without deleting previous evidence. Opening the user guide leaves your current view, selections and running work unchanged.

Command-line scans

The executable is named card-detector (card-detector.exe on Windows). The CLI keeps concise built-in help; the full guide is available on the website. These commands do not open a browser:

card-detector --help
card-detector scan --help
card-detector licence --help
card-detector --version

Choose output locations you control. A state database is required for HTML reports and resume. JSON is written to standard output unless --output is supplied. Examples below create a checkpoint, JSON results and an HTML report.

Linux:

card-detector scan /srv/shared-data --state ./card-scan.db --output ./card-results.json --report ./card-report.html

macOS:

card-detector scan "/Users/example/Documents" --state ./card-scan.db --output ./card-results.json --report ./card-report.html

Windows PowerShell:

card-detector.exe scan "D:\SharedData" --state ".\card-scan.db" --output ".\card-results.json" --report ".\card-report.html"

Add --enable-workers to inspect PDFs and supported images. The worker must be beside the controller or selected with --worker PATH, with its complete document-runtime beside it. PANScout does not fall back to PDF/OCR tools installed elsewhere on your computer.

Use Ctrl+C to request cancellation. When an interrupted CLI scan has a checkpoint, use its scan ID from the JSON report and the same state database to resume the incomplete run. Replace SCAN-ID with that actual value; do not enter the placeholder literally:

card-detector scan --state ./card-scan.db --resume SCAN-ID --output ./card-results.json --report ./card-report.html

There is no separate CLI pause command, desktop finding-review command or user-exclusion flag. Select narrower scan roots where needed. Use scan --help for the supported options. --format accepts json; -o is the short form of --output. Numeric size limits are bytes, and durations use values such as 30s or 2m.

Default CLI limits are --max-file-bytes 100000000, --file-timeout 2m, --max-archive-depth 3, --max-archive-entries 1000, --max-expanded-bytes 268435456, --max-entry-bytes 67108864, --max-compression-ratio 100, --max-extracted-bytes 134217728, --max-pdf-pages 500 and --worker-timeout 2m. An option adjustment does not guarantee that difficult content can be inspected.

Scan exit statuses:

Licence commands return 0 after a verified status or successful activation/import, 2 for invalid command input, and 3 when the licence or protected local record cannot be verified, installed or saved. Read the returned status as well as the exit code to determine whether a licence is active.

Understand findings and coverage

Findings show masked card numbers, issuer/validation signals, confidence and a location such as a page, cell or archive entry. High, medium and low confidence help prioritise review; they do not replace verification. Recognised published test numbers are identified separately. Full card numbers are not stored in scan state or reports.

No findings and complete inspection are different outcomes. Check files not fully inspected and exclusions alongside findings. A completed run may still have unsupported, encrypted or inaccessible files. PANScout's report supports investigation and evidence gathering; it does not certify PCI DSS compliance, decide scope or prove the absence of payment-card data.

Use the report's grouped coverage reasons and suggested next steps:

Review findings and evidence

In the desktop finding list, choose Not reviewed, Confirmed card number, False positive, Remediation required or Resolved as appropriate. Add optional decision context after selecting a review status, then choose Save review. Notes are limited to 500 characters. Never enter a full card number; PANScout also masks card-number-like sequences before saving. Returning a finding to Not reviewed removes its saved review and note.

Saving a review regenerates the JSON and HTML evidence. Marking a finding Resolved records your decision; it does not delete, redact or modify the source file. Perform remediation through your organisation's approved process and run a follow-up scan to assess the result.

Use the report action in the scan results or Scan history to open the HTML evidence. Desktop scans create their JSON, HTML and SQLite state under the application's local data directory; the CLI uses your selected output paths. HTML reports are self-contained and can be opened in a browser. Keep related checkpoint data if you need to resume work. Do not manually edit application history or state databases.

Reports contain masked findings, filenames, paths, locations, coverage and saved review notes. These can still be sensitive. Use approved storage and access controls when retaining or sharing evidence, and follow your organisation's retention policy. Never assume a report is safe for public upload merely because card numbers are masked.

Troubleshooting and support

The Diagnostics screen explains what the support file includes and excludes before you choose Export diagnostics.
The Diagnostics screen explains what the support file includes and excludes before you choose Export diagnostics.

If a scan cannot start, check Licence, selected locations and permissions. For missing PDF/OCR capabilities, check that the complete PANScout package is installed and enable PDF/image inspection; do not replace bundled tools with arbitrary downloads. If a scan is slow, inspect the progress and coverage reasons, try a smaller selection and consider whether OCR is necessary. For output errors, check free space and write access to the destination.

If User guide cannot open the bundled file or no browser is configured, the app offers a separate Open online guide action. This requires internet access and your explicit selection. You can also visit the online guide in a browser manually. The app cannot confirm that a browser displayed a page after the operating system accepted the request.

In the desktop, open Diagnostics and choose Export diagnostics. In the CLI:

card-detector diagnostics > panscout-diagnostics.json

Diagnostics includes versions and capability availability. Desktop diagnostics can include licence category/status and aggregate recent coverage gaps; CLI diagnostics does not aggregate desktop history. It excludes paths, filenames, findings, card numbers, review notes and source contents. Review the export before sharing it.

Use the contact route published on the PANScout website. Describe the action, visible error, product version and operating system. Do not submit card numbers, source files, scan evidence reports, secrets, licence files or complete logs. Attach only the reviewed privacy-safe diagnostics if requested. Local scanning and saved results do not depend on the support service.

PRIVACY CHOICES

Necessary security, checkout and trial functions always operate. These optional categories concern only the public website, never PANScout scans or application activity.