cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

not for recognition evidence

Is it possible to view the machines where evidence that is marked "not for recognition" in FNMS

0 Kudos
6 Replies
tjohnson1
Level 7 Flexeran
Level 7 Flexeran

You should be able to open the evidence record and then click on the Devices tab to see the devices where the evidence was found.

0 Kudos

I do not have that option.  All I see is the General and Applications tab.

0 Kudos

That would be the problem.  We are on 2019 R2.  I am wondering if it is possible to run a query on the backend to get this information.  Thanks

0 Kudos

You could run something like this against your compliance database. You just need update FILE in the last line with the file you are interested in.

select
ic.ComputerName,
ic.ComplianceComputerID,
ic.SerialNo,
ic.InventoryDate,
ic.InventoryAgent,
iie.Company,
iie.filename,
iie.FileVersion,
iie.Description,
'file' as 'type',
iiiep.ExternalFilePath as 'path'
from ImportedComputer ic
left outer join ImportedInstalledfileEvidence iiie
on iiie.ComplianceConnectionID = ic.ComplianceConnectionID
and iiie.ExternalID = ic.ExternalID
left outer join ImportedfileEvidence iie
on iie.ComplianceConnectionID = iiie.ComplianceConnectionID
and iie.ExternalfileID = iiie.ExternalFileID
left outer join ImportedInstalledFileEvidencePath iiiep
ON iiiep.ComplianceConnectionID=iiie.ComplianceConnectionID
and iiiep.ExternalFilePathID=iiie.ExternalFilePathID
where iie.FileName = 'FILE'

On Windows, because install evidences are efficent, most of File evidence are "not for reco", which means only for usage.  They are some exception, like teams or zoom, application which are not really installed, and then "at least one" is needed. If you find a evidence where you are note happy whith not for reco, just created a local file evidence with "at least one".

 

0 Kudos