You can investigate the forensic data collected in a triage or data acquisition in the Audit Viewer.
Process the acquisition. See Processing the acquisition .
View the acquisition in the Audit Viewer. See Viewing the acquisition data .
When the forensic data is viewable in the Audit Viewer, you can select the data you want to see, find data, manipulate the columns, filter and sort the data, tag rows of data, and add comments. See the following sections:
Note
If the sum of the unzipped sizes of the audits included in an acquisition exceeds 3 GB, an error message displays indicating that the acquisition cannot be viewed in the Audit Viewer.
Exploit Guard data cannot currently be viewed in the Audit Viewer.
Analyst, Senior Analyst, Investigator, or Admin access