Viewing the Forensic Export History

The Forensic Export History tab (on the Monitoring Results page) displays a list of all the exported Client sessions in a grid for the Clients the user has permissions for.

Exports performed both by yourself and by other users can be viewed.

The Forensic Export History grid displays the following information, in the corresponding columns:

• Export Date: The date and time when the session was exported.

• Client Name: The name of the computer on which the Client is installed.

• User: The name of the user logged in to the Client computer.

• Session Start Date: The date and time when the session started.

• Session End Date: The date and the time when the session finished.

• Export Type: The export type, which can be one of the following:

- Full Session: For a full exported session.

- Full Session (no text data): For a full exported session, but without the text data (i.e. clipboard data and keystrokes).

- Truncated Full Session: For an exported session that has more than 20,000 activities, and where exporting has been truncated to 1 GB.

- [From] - [To]: For part of an exported session, only during the specified time interval.

• Status: The status of the session export (In progress along with the percentage complete so far, Generated, Generation failed, or Canceled).

NOTE: Forensic Export tasks can be canceled while they are in progress on the Tasks List tab (on the Health Monitoring page).

• File Size: The size of the resulting file (or n/a for failed session exporting).

• File Hash (SHA256): The calculated SHA256 of the file that can be used to verify the integrity of the exported session.

•

• Remove All: Can be clicked (in the column header) to delete all exported sessions from the Application Server, or the Remove (

To download the Ekran Forensic Player (in order to view the exported data), click the Ekran Forensic Player link (at the top of the Forensic Export History page).