Viewing the Forensic Export History

The Forensic Export History page displays a list of all the exported Client sessions in a grid for the Clients the user has permissions for.

Exports performed both by yourself and by other users can be viewed.

The Forensic Export History grid displays the following information, in the corresponding columns:

• Export Date: The date and time when the session was exported.

• Client Name: The name of the computer on which the Client is installed.

• User: The name of the user logged in to the Client computer.

• Session Start Date: The date and time when the session started.

• Session End Date: The date and the time when the session finished.

• Export Type: The export type, which can be one of the following:

- Full: For a full exported session.

- Full (no text data): For a full exported session, but without the text data (i.e. clipboard data and keystrokes).

- Truncated Full: For an exported session that has more than 20,000 activities, and where exporting has been truncated to 1 GB.

- [From] - [To]: For part of an exported session, only during the specified time interval.

• Status: The status of the session export (In progress along with the percentage complete so far, Generated, Generation failed, or Canceled).

NOTE: Forensic Export tasks can be canceled while they are in progress on the Task Lists tab (on the Health Monitoring page).

• File Size: The size of the resulting file (or n/a for failed session exporting).

• File Hash (SHA256): The calculated SHA256 of the file that can be used to verify the integrity of the exported session.

: The Download icon next to the required exported session (on the right) can be clicked to download any exported session.

• Remove All: Can be clicked (in the column header) to delete all exported sessions from the Application Server, or the Remove () icon can be clicked next to the required exported session (on the right) to delete any exported session.

To download the Ekran Forensic Player, click the Ekran Forensic Player link (at the top of the Forensic Export History page).