Retrieve evidence from devices (File System)

To manage
the device file system.
  • Operations section, double-click an operation, double-click a target, click File System
  • Operations section, double-click an operation, double-click a target, double-click an agent, click File System
Purpose

This function lets you:

NOTE: the function is only enabled if the user had Explore agent file system authorization.

What the function looks like

This is what the page looks like:

Area Description
1

RCS menu.

2

Scroll bar

3

Window toolbar. Descriptions are provided below:

Icon Description

Export the complete structure to a .tgz file.

Download the selected file to File type evidence.

Explore the selected folder content.

Request the first level disk structure.

View the list of currently suspended File system requests awaiting next synchronization.
4

Device hard disk structure.

5

RCS status bar.

 

To learn more

For interface element descriptions see "Shared interface elements and actions".

For more information on exploring the File system see "What you should know about retrieving evidence".

 

Exploring file system content and downloading files

To explore content and download content of interest:

Step Action
1

Select a folder.

2
  • Click Download subtree and set the level of depth of sub-folders
  • Click Save: any folders with changes are highlighted at the next synchronization.

Tip: request a few levels at a time, proceed gradually.

3

Repeat steps 1-2 on the sub-folders to be explored.

4

After identifying the file of interest, select it and click Download file: the file will be downloaded as File type evidence at the next synchronization.