Browsing the file system on an endpoint

If you are viewing an endpoint in Reporting, you can browse the file system on connected endpoints and download files. You can delete files on an endpoint if you have the direct connect file write permission

1. Click an endpoint in an investigation.

   Click an online endpoint in an investigation.

2. Click File Browser to open a file browser at the root directory. On Windows endpoints the default location is c:\. On macOS and Linux endpoints the default location is /. File Browser requires an active direct connection. When you click File Browser on an online endpoint, a direct connection is initiated.

3. Navigate the file system by typing a path, or by clicking directories in the file browser of the breadcrumbs of the path. For each file in a directory you can view the size, creation date, modification date, and the permissions for the file. Symbolic links are visible while file browsing in a live connection.

4. Click one or more files to download or delete. To delete a file, ensure that you have the direct connect file write permission and click the delete icon at the end of the row. Click Delete.