Did Data Leave?

An attacker trying to send a file is different from a file actually leaving. Your report needs to distinguish those two outcomes.

Read the practice computer’s transfer record:

seclab logs

Look for these lines:

2026-11-01 08:58:00 practice-laptop DATA_TRANSFERRED demo-upload: training-records.csv

DATA_TRANSFERRED confirms that training-records.csv left through demo-upload. A CONNECTION_BLOCKED record would tell you that a connection attempt was stopped instead.

A successful cleanup cannot undo a transfer that already happened. You still need to record the confirmed loss so the team can decide what to do next.

Record only the filename supported by the transfer record:

seclab answer transferred training-records.csv

You should see:

Recorded your answer to transferred.