Click the Forensic Copy tab.

For each document, the list shows:

• Timestamp - The date and time of the violation.
• Violated Policy - The policy that was violated.
• Cloud - The cloud account on which the quarantine copy action was made.
• Subject - The text of the subject line.
• User - The name of the user associated with the document or the sender’s email address.
• Recipient - The recipient of the email.
• File Name - The file name of the attachment or email file, if any.
• File Size - The file size of the attachment or email file, if any.
• Policy Type - The type of protection for the policy that applies to the document.