Record Export

A subject uses reporting, query, or export functions to generate a separately usable copy of records held within an organizational application or database in preparation for an infringement. The subject may run an existing report, select particular fields or record populations, expand reporting parameters, or perform repeated exports to assemble the required information. The records may concern customers, personnel, financial transactions, cases, or other organizational activity. The resulting extract may be retained as a report, spreadsheet, data file, or saved dataset, including within an organizational system without being downloaded to the subject’s device.

The defining behavior is the production of a record-level extract from underlying application or database content, rather than the retrieval of pre-existing files. The subject may use legitimately assigned permissions without circumventing a technical control. Investigators should establish which records and fields were included, whether the output was successfully generated and retained, and how its creation relates to the subject’s responsibilities, approved tasks, and subsequent activity. Possession of export permissions, creation of a report definition, or ordinary viewing of records does not independently establish this behavior. An export’s size or sensitivity alone does not establish preparation for an infringement.