How to download an attachment removed by checkpoint?

[jnoble]

Hi,

One of our users received an email with .mp3 extension from our client and the attachment was removed by checkpoint.

Is there a way to retrieve it?

Thanks.

[PhoneBoy]

If I'm not mistaken, these attachments aren't saved anywhere.
There may be hints in the log files referred to here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Dilian_Chernev]

Open the Summary report from logs and download it from there: 

Password for the archive should be: infected

[jnoble]

Hi Dilian,

Can you give me the steps in detail?

Is there a built in summary report?

Thanks.

[Dilian_Chernev]

Yes, for every "malicious" file there should be a Summary and Detailed per OS reports.

First locate the blocked connection in logs:

Second: open the log record and check the summary report. It is best viewed with Chrome/Firefox.

Third: will see the Summary report and can download prevented file, as on my first post.