When forensics data collection is enabled on the Settings > Reporting > Dashboard page in the Web module of the TRITON Manager, transaction details related to attempts to send data out of your network, as well as the actual data files involved, are recorded in a forensics repository.