When forensics data collection is enabled on the Web > Settings > Reporting > Dashboard page in the Forcepoint Security Manager, transaction details related to attempts to send data out of your network, as well as the actual data files involved, are recorded in a forensics repository.