Retrieve evidence from devices (File System)

To manage the device
File System:
  • Operations section, double-click an operation, double-click a target, click File System
  • Operations section, double-click an operation, double-click a target, double-click an agent, click File System
Purpose

This function lets you:

What the function looks like

This is what the page looks like:

Area Description
1

RCS menu.

2

Scroll bar

3

Window toolbar. Descriptions are provided below:

Icon Description

Export the complete structure to a .tgz file.

Download: download the selected file to File type evidence.

Retrieve subtree: explore the selected folder content.

Retrieve default: request the first level disk structure.

4

Device hard disk structure.

5

RCS status bar.

 

To learn more

For interface element descriptions see "Shared interface elements and actions".

For more information on exploring the file-systemsee "What you should know about retrieving evidence".

 

Exploring file system content and downloading files

To explore content and download content of interest:

Step Action
1

Select a folder.

2
  • Click Retrieve and set the level of depth of sub-folders
  • Click Save: the structure of the sub-folders up to the required level will be returned at the next synchronization.

Tip: request a few levels at a time, proceed gradually.

3

Repeat steps 1-2 on the sub-folders to be explored.

4

After identifying the file of interest, select it and click Download: the file will be downloaded as File type evidence at the next synchronization.