---
title: Preview evidence files
description: Preview Data Loss Prevention Incident Response evidence files in the DLP IR Analyst workspace.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/data-loss-prevention/preview-file-proofpoint.html
release: australia
product: Data Loss Prevention
classification: data-loss-prevention
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
keywords: [Preview Evidence Files, DLP analyst workspace, Data Loss Prevention Incident Response]
breadcrumb: [Create a Profile for Proofpoint DLP integration, Data Loss Prevention Incident Response Integration with Proofpoint, Integrate, Data Loss Prevention Incident Response, Security Operations]
---

# Preview evidence files

Preview Data Loss Prevention Incident Response evidence files in the DLP IR Analyst workspace.

## Before you begin

**Important:** While using the Evidence files action in the DLP analyst workspace, the evidence files are temporarily stored in the ServiceNow database in an unencrypted format. If you don't want to store the evidence files, disable the Evidence Files preview feature. For more information, see [Configure advanced settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/data-loss-prevention/configure-advanced-settings-dlp.md).

Role required: sn\_dlir.analyst

## Procedure

1.  Navigate to **All** > **DLP Incident Management** > **DLP Analyst Workspace**.

2.  Open a DLP incident record.

3.  From the contextual sidebar, select the Evidence files icon \(\[Omitted image "icon-evidence-files.png"\] Alt text: Evidence files icon.\).

4.  On the **Evidence Files** tab, select the **Evidence File** card to preview the evidence files in the document viewer.

    The preview feature is different for each file type, as listed in the following table.

<table id="table_bfs_kyj_k2c"><thead><tr><th>

File Format

</th><th>

File Extension

</th></tr></thead><tbody><tr><td>

Image

</td><td>

.bmp, .gif, .ico, .jpeg, .jpg, .png, .svg, and .webp.Image files open in the document viewer mode.

</td></tr><tr><td>

Microsoft Office files

</td><td>

.doc, .docx, .ppt, .pptx, .xls, and .xlsx Office files open in the document viewer mode.

</td></tr><tr><td>

Text files

</td><td>

.txtText files open in text editor mode.

</td></tr><tr><td>

Mail files

</td><td>

.eml**Note:** The file size must be less than 5MB. You must first download the file to preview its content.

</td></tr><tr><td>

PDF files

</td><td>

.pdf -   Enter a keyword to search the document.
-   Zoom-in and zoom-out features to adjust the view for better readability.
-   Rotate the page clockwise or counterclockwise to view the content more clearly.


</td></tr></tbody>
</table>    **Note:**

    Binary files won’t be rendered and have to be downloaded to preview their content. The preview evidence file feature also works for archived incidents.


**Parent Topic:**[Create a Profile for Proofpoint DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/data-loss-prevention/create-profile-proofpoint-dlp-integration.md)