In NetWitness Suite Investigation, when you have the data for a drill point displayed in the Navigate view, you can:
- Extract files from a session and choose the type of files to extract: archives, audio BitTorrent, documents, executable, images, other, video, and web.
- Export the drillpoint as a packet capture (PCAP) file, a log file or a meta data file.
The details being exported are affected by both the time range and drill point at the time of exporting.
To export a drill point from the Navigate view:
- Conduct an investigation until you reach the desired drillpoint.
- In the toolbar, select Actions > Export and select one of the export options: PCAP, Logs, or Meta.
The drill point is extracted, and a message advises that the job is scheduled. You can check the jobs page for the status.
- When the scheduled file extraction is complete, it is displayed in the Job Notifications tray.
- Click the View link in the Jobs tray sand download the specific extraction file requested.