KB Article | Forcepoint Support

Notes & Warnings

Important Deleting a partition is irreversible.

Ensure that the Temporary File Location for backup and archival has been configured properly in the DLP installer before performing these steps.

Problem Description

How do I manage old unwanted incidents? They are causing reports to generate slowly as well as filling up the local drive with forensics.


Every quarter, a new partition is created to store incidents by default. These partitions may be archived or deleted to free up space. When an archival of a partition is performed, the SQL tables for the partition are backed up and detached from the wbsn-data-security database. This is then transferred to the archive folder destination as a ZIP archive. In addition, the forensics from the Forensics Repository that correspond with this date range are also moved to the archive folder location in an uncompressed form.

For the main article detailing the archive and restore process, please refer to the official documentation.

  • From the DLP web interface navigate to Settings, General, and then Archive Partitions.
  • Identify the partition you wish to delete or archive.
    • Press either the Delete or Archive button.
    • When archiving a partition, it is saved to \\\archive_mng\storage as a ZIP file by default.
    • To change the archive location: Settings > System > Archive Storage.
    • After archiving, the file may be moved off-box to free up space if not already on a network location.
  • To re-attach a partition, simply restore it back to the \\127.0.01\archive_mng\storage directory or the custom archive location.
    • Within the Manager, select the partition and then click the Restore button.

Keywords: DLP Data Security Manager; DLP Partition Archive; Archive Restoration; Triton Installer Modify; DLP Archiving Issue; DLP Restoration Issue; Low Disk Space; Server Out of Space; Forensics Repository

Article Feedback

Thank you for the feedback and comments.