Recording forensics
One recorded session, from raw signal to extracted field value- Computer
- MAC-HR-01
- Department
- People & HR
- Role
- People Ops
- Recorder reference
emp_8825- Agent version
- v2.4.1
- Operating system
- macOS 14
- Window
- 08:50–14:00 · Europe/Madrid
- Analysis state
- analyzed
Active vs idle
Active 3.4 h · 66% Waiting / idle 1.8 h · 34%
Active time is the resolved-action count times a measured mean dwell of 2.31 s. The rest of the window is waiting.
What this recording contributed Every stage links to how it works on the discovery screen
6 apps · 44 redactions · 2 capture pauses · 91.9% Contributed to the event log
How this view is scoped
Derived analysis only — no screen replay, no keystroke content. Frames are synthetic demo captures with fields masked at capture. Reported at process and team level; no individual is ranked.
The session, minute by minute
Case spans interleave because real work interleaves · Local time · Europe/MadridCases
EMP-2026-79842 New-hire data entry · 08:56–09:51 · 55m 04s EMP-2026-94433 New-hire welcome sequence · 09:23–10:02 · 39m 19s EMP-2026-95175 New-hire data entry · 09:55–10:25 · 29m 32s EMP-2026-10047 New-hire welcome sequence · 10:26–10:56 · 29m 46s EMP-2026-47397 New-hire data entry · 10:59–12:10 · 70m 53s EMP-2026-10541 New-hire welcome sequence · 11:30–12:05 · 35m 05s EMP-2026-94391 New-hire data entry · 12:02–12:37 · 35m 09s EMP-2026-68091 New-hire welcome sequence · 12:36–13:27 · 50m 31s
Detected activities
AS Assign the manager checklist — 09:00, 28 resolved actions NH Notify HR to assign a manager — 09:03, 28 resolved actions SO Schedule the orientation — 09:40, 48 resolved actions UD Upload the identity documents — 09:47, 53 resolved actions TY Track the reply — 09:52, 44 resolved actions RD Re-type the start date — 10:07, 27 resolved actions OW Open workbook — 10:14, 59 resolved actions OR Open work item — 10:44, 37 resolved actions SE Send email — 10:49, 40 resolved actions AS Assign the manager checklist — 11:15, 68 resolved actions OR Open work item — 11:33, 41 resolved actions TY Track the reply — 11:37, 23 resolved actions NH Notify HR to assign a manager — 11:37, 28 resolved actions CA Create the system account — 12:04, 24 resolved actions NH Notify HR to assign a manager — 12:10, 33 resolved actions SO Schedule the orientation — 12:46, 32 resolved actions AS Assign the manager checklist — 13:08, 37 resolved actions
Applications
Excel 548m
HR portal 402m
Outlook 236m
Chrome 188m
Teams 164m
Word 96m
Resolved actions / min (0–32)
National tax id — 09:12 Phone number — 09:13 National tax id — 09:19 Free-text note — 09:21 IBAN — 09:27 IBAN — 09:37 Phone number — 10:08 Card number — 10:22 National tax id — 11:15 IBAN — 11:54 IBAN — 11:56 Phone number — 12:10 Email address — 12:48 Card number — 12:54
Local time · Europe/Madrid (+02:00)
Selected case Open this process
- Case span
- Idle
- Capture paused — blocklisted app
- Field redacted at capture
Resolved actions
The stream after normalisation — one row per resolved UI action| Timestamp | Application | Screen | Action | Target control | Resolver | Confidence | Case ID |
|---|---|---|---|---|---|---|---|
| 2026-07-08T08:56:31.088+02:00 | Teams | Direct message | Link/Open | DOM | 0.86 | EMP-2026-79842 | |
| 2026-07-08T09:00:27.982+02:00 | Excel | Workbook · line grid | file_save | Field/Reference | DOM | 0.84 | EMP-2026-79842 |
| 2026-07-08T09:04:23.860+02:00 | Excel | Workbook · line grid | keys | typed into Due date, 17 chars | DOM | 0.78 | EMP-2026-79842 |
| 2026-07-08T09:08:19.593+02:00 | Excel | Pivot view | focus | Link/Open | OCR fallback | 0.61 | EMP-2026-79842 |
| 2026-07-08T09:12:15.685+02:00 | HR portal | New hire record | navigate | Tab/Details | accessibility-tree | 0.98 | EMP-2026-79842 |
| 2026-07-08T09:16:11.100+02:00 | Excel | Pivot view | navigate | Field/Reference | accessibility-tree | 1 | EMP-2026-79842 |
| 2026-07-08T09:20:07.987+02:00 | Excel | Workbook · summary | scroll | Button/Post | accessibility-tree | 0.93 | EMP-2026-79842 |
| 2026-07-08T09:23:34.201+02:00 | HR portal | New hire record | paste | Toolbar/Save | accessibility-tree | 0.9 | EMP-2026-94433 |
| 2026-07-08T09:24:03.764+02:00 | Excel | Workbook · summary | scroll | Field/Reference | accessibility-tree | 0.92 | EMP-2026-79842 |
| 2026-07-08T09:26:23.730+02:00 | Chrome | Report export | scroll | Toolbar/Save | accessibility-tree | 0.92 | EMP-2026-94433 |
| 2026-07-08T09:27:59.489+02:00 | Chrome | Internal wiki | scroll | Tab/Details | DOM | 0.87 | EMP-2026-79842 |
| 2026-07-08T09:29:11.423+02:00 | Chrome | Supplier portal | click | Tab/Details | accessibility-tree | 0.89 | EMP-2026-94433 |
| 2026-07-08T09:32:00.196+02:00 | Chrome | Report export | scroll | Button/Post | accessibility-tree | 0.91 | EMP-2026-94433 |
| 2026-07-08T09:48:51.217+02:00 | Teams | Channel thread | click | Link/Open | accessibility-tree | 0.94 | EMP-2026-94433 |
| 2026-07-08T09:51:39.427+02:00 | HR portal | New hire record | focus | Toolbar/Save | accessibility-tree | 0.92 | EMP-2026-94433 |
| 2026-07-08T09:54:28.344+02:00 | Teams | Channel thread | paste | Grid/Row[7]/Value | DOM | 0.75 | EMP-2026-94433 |
| 2026-07-08T09:57:16.124+02:00 | Outlook | Inbox | paste | Toolbar/Save | accessibility-tree | 0.97 | EMP-2026-94433 |
| 2026-07-08T10:00:05.716+02:00 | Word | Main view | scroll | Toolbar/Save | accessibility-tree | 0.99 | EMP-2026-94433 |
| 2026-07-08T10:04:22.769+02:00 | Excel | Pivot view | click | Toolbar/Save | DOM | 0.84 | EMP-2026-95175 |
| 2026-07-08T10:06:29.673+02:00 | Teams | Channel thread | Button/Post | DOM | 0.82 | EMP-2026-95175 | |
| 2026-07-08T10:08:35.440+02:00 | Outlook | Draft | scroll | Tab/Details | DOM | 0.86 | EMP-2026-95175 |
| 2026-07-08T10:10:42.358+02:00 | Teams | Channel thread | focus | Grid/Row[24]/Value | DOM | 0.86 | EMP-2026-95175 |
| 2026-07-08T10:12:49.609+02:00 | Teams | Direct message | Toolbar/Save | DOM | 0.86 | EMP-2026-95175 | |
| 2026-07-08T10:14:55.573+02:00 | Chrome | Internal wiki | scroll | Grid/Row[7]/Value | DOM | 0.8 | EMP-2026-95175 |
| 2026-07-08T10:17:02.228+02:00 | Teams | Direct message | scroll | Toolbar/Save | accessibility-tree | 0.97 | EMP-2026-95175 |
| 2026-07-08T10:19:08.234+02:00 | Word | Main view | keys | typed into Due date, 22 chars | OCR fallback | 0.65 | EMP-2026-95175 |
| 2026-07-08T10:21:15.903+02:00 | Teams | Channel thread | Toolbar/Save | accessibility-tree | 0.93 | EMP-2026-95175 | |
| 2026-07-08T10:26:33.758+02:00 | Chrome | Internal wiki | click | Button/Post | OCR fallback | 0.66 | EMP-2026-10047 |
| 2026-07-08T10:28:41.601+02:00 | Outlook | Draft | file_save | Toolbar/Save | OCR fallback | 0.65 | EMP-2026-10047 |
| 2026-07-08T10:30:48.154+02:00 | Excel | Workbook · summary | paste | Grid/Row[7]/Value | DOM | 0.85 | EMP-2026-10047 |
| 2026-07-08T10:32:56.592+02:00 | Outlook | Inbox | keys | typed into Amount, 47 chars | accessibility-tree | 0.95 | EMP-2026-10047 |
| 2026-07-08T10:35:03.483+02:00 | HR portal | Document checklist | navigate | Tab/Details | DOM | 0.85 | EMP-2026-10047 |
| 2026-07-08T10:37:11.241+02:00 | Outlook | Draft | focus | Link/Open | accessibility-tree | 0.99 | EMP-2026-10047 |
| 2026-07-08T10:39:18.557+02:00 | Excel | Workbook · line grid | Toolbar/Save | accessibility-tree | 0.89 | EMP-2026-10047 | |
| 2026-07-08T10:41:26.586+02:00 | Outlook | Message detail | paste | Field/Reference | DOM | 0.85 | EMP-2026-10047 |
| 2026-07-08T10:54:11.122+02:00 | Word | Main view | keys | typed into Vendor name, 25 chars | DOM | 0.86 | EMP-2026-10047 |
| 2026-07-08T10:59:18.465+02:00 | Outlook | Inbox | file_save | Field/Reference | DOM | 0.8 | EMP-2026-47397 |
| 2026-07-08T11:04:22.408+02:00 | Chrome | Internal wiki | paste | Tab/Details | accessibility-tree | 0.88 | EMP-2026-47397 |
| 2026-07-08T11:09:26.756+02:00 | Chrome | Supplier portal | scroll | Tab/Details | OCR fallback | 0.63 | EMP-2026-47397 |
| 2026-07-08T11:38:13.121+02:00 | Teams | Channel thread | click | Grid/Row[6]/Value | DOM | 0.72 | EMP-2026-10541 |
| 2026-07-08T11:39:48.011+02:00 | HR portal | New hire record | keys | typed into Subject, 25 chars | accessibility-tree | 0.89 | EMP-2026-47397 |
| 2026-07-08T11:40:43.459+02:00 | Teams | Direct message | paste | Button/Post | OCR fallback | 0.51 | EMP-2026-10541 |
| 2026-07-08T11:43:14.672+02:00 | Excel | Pivot view | scroll | Field/Reference | accessibility-tree | 0.97 | EMP-2026-10541 |
| 2026-07-08T11:44:52.639+02:00 | HR portal | Document checklist | paste | Button/Post | DOM | 0.87 | EMP-2026-47397 |
| 2026-07-08T11:45:44.749+02:00 | Outlook | Message detail | navigate | Grid/Row[14]/Value | OCR fallback | 0.24 | EMP-2026-10541 |
| 2026-07-08T11:48:15.426+02:00 | Chrome | Supplier portal | paste | Field/Reference | accessibility-tree | 0.96 | EMP-2026-10541 |
| 2026-07-08T11:49:56.773+02:00 | Word | Main view | file_save | Toolbar/Save | accessibility-tree | 0.94 | EMP-2026-47397 |
| 2026-07-08T11:50:45.791+02:00 | Excel | Workbook · line grid | Toolbar/Save | DOM | 0.79 | EMP-2026-10541 | |
| 2026-07-08T11:53:15.413+02:00 | Outlook | Inbox | keys | typed into Amount, 48 chars | DOM | 0.71 | EMP-2026-10541 |
| 2026-07-08T11:55:00.863+02:00 | Chrome | Supplier portal | Button/Post | DOM | 0.81 | EMP-2026-47397 | |
| 2026-07-08T11:55:46.882+02:00 | Teams | Channel thread | navigate | Field/Reference | DOM | 0.79 | EMP-2026-10541 |
| 2026-07-08T11:58:16.923+02:00 | Teams | Channel thread | keys | typed into Subject, 42 chars | accessibility-tree | 0.95 | EMP-2026-10541 |
| 2026-07-08T12:00:03.454+02:00 | Word | Main view | focus | Toolbar/Save | accessibility-tree | 0.98 | EMP-2026-47397 |
| 2026-07-08T12:02:18.259+02:00 | Excel | Workbook · summary | click | Tab/Details | DOM | 0.84 | EMP-2026-94391 |
| 2026-07-08T12:04:49.353+02:00 | HR portal | New hire record | Tab/Details | accessibility-tree | 0.99 | EMP-2026-94391 | |
| 2026-07-08T12:05:07.184+02:00 | Teams | Direct message | paste | Tab/Details | OCR fallback | 0.6 | EMP-2026-47397 |
| 2026-07-08T12:07:19.618+02:00 | HR portal | Document checklist | file_save | Tab/Details | accessibility-tree | 0.93 | EMP-2026-94391 |
| 2026-07-08T12:09:50.002+02:00 | Teams | Channel thread | Field/Reference | accessibility-tree | 0.91 | EMP-2026-94391 | |
| 2026-07-08T12:12:21.279+02:00 | Chrome | Internal wiki | scroll | Link/Open | accessibility-tree | 0.96 | EMP-2026-94391 |
| 2026-07-08T12:14:51.616+02:00 | Excel | Workbook · summary | Field/Reference | DOM | 0.87 | EMP-2026-94391 | |
| 2026-07-08T12:17:22.192+02:00 | Teams | Direct message | paste | Button/Post | accessibility-tree | 0.92 | EMP-2026-94391 |
| 2026-07-08T12:32:26.523+02:00 | Chrome | Internal wiki | focus | Tab/Details | accessibility-tree | 0.91 | EMP-2026-94391 |
| 2026-07-08T12:34:56.078+02:00 | HR portal | New hire record | scroll | Link/Open | accessibility-tree | 0.9 | EMP-2026-94391 |
| 2026-07-08T12:36:58.273+02:00 | Excel | Workbook · summary | paste | Tab/Details | DOM | 0.86 | EMP-2026-68091 |
| 2026-07-08T12:40:35.291+02:00 | Excel | Workbook · line grid | file_save | Tab/Details | accessibility-tree | 0.9 | EMP-2026-68091 |
| 2026-07-08T13:02:14.701+02:00 | Outlook | Message detail | click | Grid/Row[22]/Value | accessibility-tree | 0.98 | EMP-2026-68091 |
| 2026-07-08T13:05:50.794+02:00 | Outlook | Inbox | paste | Grid/Row[6]/Value | accessibility-tree | 0.97 | EMP-2026-68091 |
| 2026-07-08T13:09:27.438+02:00 | Outlook | Message detail | paste | Field/Reference | DOM | 0.81 | EMP-2026-68091 |
| 2026-07-08T13:13:03.370+02:00 | Chrome | Internal wiki | keys | typed into Vendor name, 34 chars | DOM | 0.81 | EMP-2026-68091 |
| 2026-07-08T13:16:40.827+02:00 | HR portal | New hire record | file_save | Grid/Row[6]/Value | DOM | 0.83 | EMP-2026-68091 |
| 2026-07-08T13:20:16.668+02:00 | Word | Main view | click | Button/Post | accessibility-tree | 0.97 | EMP-2026-68091 |
| 2026-07-08T13:23:53.149+02:00 | Excel | Workbook · line grid | focus | Tab/Details | accessibility-tree | 0.95 | EMP-2026-68091 |
This table is a stratified sample of the recording. The counts above it are exact.
Captured data
The field values read off screen, and the case each correlated into · 40| Field | Type | Occurrences | Sample value | Masking | Case ID | Process |
|---|---|---|---|---|---|---|
employee_ref Correlation key | string | 31 | EMP-2026-79842 | Not masked | EMP-2026-79842 | New-hire data entry |
start_date | date | 20 | 2026-07-02 | Not masked | EMP-2026-79842 | New-hire data entry |
department | string | 12 | People & HR | Not masked | EMP-2026-79842 | New-hire data entry |
contract_type | string | 36 | Fixed term | Not masked | EMP-2026-79842 | New-hire data entry |
national_id | string | 34 | ••••••••K | Masked at captureNational tax id masked at capture | EMP-2026-79842 | New-hire data entry |
employee_ref Correlation key | string | 22 | EMP-2026-94433 | Not masked | EMP-2026-94433 | New-hire welcome sequence |
start_date | date | 12 | 2026-06-21 | Not masked | EMP-2026-94433 | New-hire welcome sequence |
department | string | 42 | People & HR | Not masked | EMP-2026-94433 | New-hire welcome sequence |
contract_type | string | 46 | Permanent | Not masked | EMP-2026-94433 | New-hire welcome sequence |
national_id | string | 20 | ••••••••X | Masked at captureNational tax id masked at capture | EMP-2026-94433 | New-hire welcome sequence |
employee_ref Correlation key | string | 21 | EMP-2026-95175 | Not masked | EMP-2026-95175 | New-hire data entry |
start_date | date | 15 | 2026-06-18 | Not masked | EMP-2026-95175 | New-hire data entry |
department | string | 6 | People & HR | Not masked | EMP-2026-95175 | New-hire data entry |
contract_type | string | 44 | Fixed term | Not masked | EMP-2026-95175 | New-hire data entry |
national_id | string | 20 | ••••••••V | Masked at captureNational tax id masked at capture | EMP-2026-95175 | New-hire data entry |
employee_ref Correlation key | string | 27 | EMP-2026-10047 | Not masked | EMP-2026-10047 | New-hire welcome sequence |
start_date | date | 19 | 2026-06-30 | Not masked | EMP-2026-10047 | New-hire welcome sequence |
department | string | 45 | People & HR | Not masked | EMP-2026-10047 | New-hire welcome sequence |
contract_type | string | 21 | Fixed term | Not masked | EMP-2026-10047 | New-hire welcome sequence |
national_id | string | 39 | ••••••••J | Masked at captureNational tax id masked at capture | EMP-2026-10047 | New-hire welcome sequence |
employee_ref Correlation key | string | 10 | EMP-2026-47397 | Not masked | EMP-2026-47397 | New-hire data entry |
start_date | date | 47 | 2026-06-22 | Not masked | EMP-2026-47397 | New-hire data entry |
department | string | 16 | People & HR | Not masked | EMP-2026-47397 | New-hire data entry |
contract_type | string | 18 | Fixed term | Not masked | EMP-2026-47397 | New-hire data entry |
national_id | string | 18 | ••••••••M | Masked at captureNational tax id masked at capture | EMP-2026-47397 | New-hire data entry |
employee_ref Correlation key | string | 10 | EMP-2026-10541 | Not masked | EMP-2026-10541 | New-hire welcome sequence |
start_date | date | 12 | 2026-07-11 | Not masked | EMP-2026-10541 | New-hire welcome sequence |
department | string | 29 | People & HR | Not masked | EMP-2026-10541 | New-hire welcome sequence |
contract_type | string | 7 | Fixed term | Not masked | EMP-2026-10541 | New-hire welcome sequence |
national_id | string | 15 | ••••••••X | Masked at captureNational tax id masked at capture | EMP-2026-10541 | New-hire welcome sequence |
employee_ref Correlation key | string | 31 | EMP-2026-94391 | Not masked | EMP-2026-94391 | New-hire data entry |
start_date | date | 28 | 2026-06-28 | Not masked | EMP-2026-94391 | New-hire data entry |
department | string | 11 | People & HR | Not masked | EMP-2026-94391 | New-hire data entry |
contract_type | string | 30 | Fixed term | Not masked | EMP-2026-94391 | New-hire data entry |
national_id | string | 22 | ••••••••D | Masked at captureNational tax id masked at capture | EMP-2026-94391 | New-hire data entry |
employee_ref Correlation key | string | 7 | EMP-2026-68091 | Not masked | EMP-2026-68091 | New-hire welcome sequence |
start_date | date | 8 | 2026-06-21 | Not masked | EMP-2026-68091 | New-hire welcome sequence |
department | string | 42 | People & HR | Not masked | EMP-2026-68091 | New-hire welcome sequence |
contract_type | string | 44 | Permanent | Not masked | EMP-2026-68091 | New-hire welcome sequence |
national_id | string | 21 | ••••••••U | Masked at captureNational tax id masked at capture | EMP-2026-68091 | New-hire welcome sequence |
All values are synthetic demo data. Masked values were redacted on the device before upload; originals are not retained.
UI region captures
Synthetic demo frames — fields masked at capture, originals not retained · 8 / 9- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked regionMasked region UI region capture · synthetic demo frame
- Masked regionMasked region UI region capture · synthetic demo frame
What this recording lost
No recording contributes everything it saw- Orphan actions (no case key)
- 431
- Quarantined below 0.70 confidence
- 8
- Unclassified activity instances
- 5
- Blocklist pauses
- 2
- Redactions applied
- 44
- Contributed to the event log
- 91.9%
- 10:03–10:14 Password manager Application on the capture blocklist · 11m 32s
- 11:53–12:06 Banking Application on the capture blocklist · 13m 47s
No recording contributes 100% of its actions — this one contributed 91.9%.