Forensic files for the e-mail client channel not being sent to the Officescan server is a known issue in OfficeScan XG. Hence, Control Manager is unable to get the file when downloading it from the incident details.

As a workaround, disable the multi-part scan feature on the Officescan server:

1. Open the ofcscan.ini file in the \PCCSRV\ folder of the OfficeScan server.
2. Under the Global Setting section, manually add the following key and set its value to "0":

   [Global Setting]
   EnableDlpMPScan=0

    

   To enable the setting again, set it as "EnableDlpMPScan=1".

    
3. Save the changes and close the file.
4. Open the OfficeScan server management console and click Agents > Global Agent Settings on the main menu to access the Global Agent Settings page.
5. Click Save to deploy the setting to agents.

The OfficeScan server deploys the command to agents and adds the following registry entry on all agent computers:

Path: HKLM\SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion\DlpLite
Key: EnableMPScan
Type: dword
Value: 0