Manual archiving

Administrators can manually initiate archiving for a partition. This archives all incident records and their forensics data from that 91-day period. This archiving method is called public, because Forcepoint DLP administrators can view and restore the manually archived records.

If an administrator archives a partition that has already—in whole or in part—been automatically archived, the previously archived records are merged into the manual archive (see Automatic archiving). These records are now also available to Forcepoint DLP administrators for viewing and restoring. The original (automatically- created) copies of all merged records are then deleted to conserve disk space.

When an administrator triggers an archiving operation, an archiving record ID number is issued. This can be used to restore the archive (see Archive formatting and restoration).

To initiate manual archiving:

Steps

  1. Log on to the Data Security module of the Security Manager.
  2. Go to the Settings > General > Archive Partitions page.
  3. Select one or more partitions.
  4. Click Archive in the toolbar at the top of the page.
  5. Optionally add comments.
  6. Click OK.

Next steps

See the Forcepoint DLP Administrator Help for more information.