Citadel / Controls / ExportedFiles

ExportedFiles Control

What does this control check?

The ExportedFiles control scans your Downloads folder for old data export files (CSV, JSON, and TXT files with "export" in the name) that haven't been accessed recently. These files often contain sensitive business data and should be deleted when no longer needed.

Important: Data exports from business systems often contain sensitive information like customer lists, financial data, employee information, or analytics. These files accumulate over time in your Downloads folder and create security risks. If your computer is compromised, stolen, or improperly disposed of, these old exports can expose confidential business data. Many data breaches have occurred because of forgotten export files containing thousands of customer records.

Why is this important?

📊

Data Accumulation

Export files accumulate over time as you download reports and data from various systems. Each file may contain sensitive information that's no longer needed but remains vulnerable.

🎯

Breach Risk

Old export files are often forgotten but remain accessible to malware, thieves, and unauthorized users. A single export file can contain thousands of sensitive records.

⚖️

Compliance

Many regulations (GDPR, HIPAA, SOC 2) require proper handling and disposal of exported data. Keeping old exports indefinitely violates data retention policies.

How to fix this

Finding and Removing Old Export Files on Windows

Step 1: Find old export files

  1. Open File Explorer
  2. Navigate to your Downloads folder
  3. Click in the search box (top-right) and type: *export*.csv OR *export*.json OR *export*.txt OR *export*.xlsx OR *export*.xls
  4. Press Enter to search
  5. Click Date modified column header to sort by date
  6. Identify files that are old and no longer needed

Step 1b: Show hidden files

Some export files may be hidden — their names start with a dot (e.g. .export.csv, .export-2023.json). Windows hides these by default, but they are still fully accessible to malware and attackers. To reveal them:

  1. Open File Explorer and navigate to Downloads
  2. On Windows 11: click View → Show → Hidden items
  3. On Windows 10: click the View tab and check Hidden items
  4. Hidden files will appear, slightly greyed out
  5. Repeat the search from Step 1 to include hidden files in the results

You can safely delete most hidden export files you find in Downloads — they are typically leftovers from tools or scripts that generated exports automatically. If you are unsure what a file contains, right-click it and select Properties for details.

Step 2: Review and delete the files

  1. For each old export file:
    • Ask yourself: "Do I still need this data?"
    • If unsure, check when it was last modified or accessed
    • If you haven't used it in 30+ days, you probably don't need it
  2. Select the files you want to delete — including any greyed-out hidden files
  3. Press Shift + Delete for permanent deletion
  4. Click Yes to confirm
⚠️ Important notes:
  • If you need the data long-term, export it again directly to a secure, backed-up location
  • Don't keep exports "just in case" - download fresh data when you actually need it
  • Regularly clean your Downloads folder to prevent accumulation
  • When in doubt about whether to delete, consult with IT or your manager

Finding and Removing Old Export Files on macOS

Step 1: Find old export files

  1. Open Finder
  2. Navigate to your Downloads folder
  3. Press Command + F to open search
  4. Set the search scope to "Downloads"
  5. Click the + button to add search criteria
  6. Set criteria to search for files:
    • Name contains "export"
    • Kind is "CSV", "JSON", or "Plain Text"
  7. Click on Date Modified to sort by date
  8. Identify files that are old and no longer needed

Step 1b: Show hidden files

Some export files may be hidden — their names start with a dot (e.g. .export.csv, .export-2023.json). macOS hides these from Finder by default, but they are still fully accessible to malware and attackers. To reveal them:

  1. Open Finder and navigate to your Downloads folder
  2. Press Command + Shift + . (period)
  3. Hidden files will appear, greyed out to indicate they are normally invisible
  4. Repeat the search from Step 1 — hidden files will now be included in the results
  5. Press the same shortcut again to hide them when you are done

You can safely delete most hidden export files you find in Downloads — they are typically leftovers from tools or scripts that generated exports automatically. If you are unsure what a file contains, right-click it and select Get Info for details.

Step 2: Review and delete the files

  1. For each old export file:
    • Ask yourself: "Do I still need this data?"
    • Right-click and select Get Info to see when it was last opened
    • If you haven't used it in 30+ days, you probably don't need it
  2. Select the files you want to delete — including any greyed-out hidden files
  3. Press Command + Delete to move to Trash
  4. Empty the Trash: Finder → Empty Trash
For secure deletion: Hold Command + Option while clicking "Empty Trash" to securely erase files and prevent recovery.
⚠️ Important notes:
  • If you need the data long-term, export it again directly to a secure, backed-up location
  • Don't keep exports "just in case" - download fresh data when you actually need it
  • Regularly clean your Downloads folder to prevent accumulation
  • When in doubt about whether to delete, consult with IT or your manager

Verifying the fix

After deleting old export files, Citadel will automatically verify this control during its next check.

To verify old exports are removed:

  1. Open File Explorer and go to Downloads
  2. If some of the identified files are hidden, show hidden files first:
    • Windows 11: View → Show → Hidden items
    • Windows 10: View tab → check Hidden items
  3. Search for: *export*.csv OR *export*.json OR *export*.txt
  4. Review the results and check the Date modified column
  5. All remaining export files — visible or hidden — should be recent (less than 30 days old)

To verify old exports are removed:

  1. Open Finder and navigate to Downloads
  2. Press Command + Shift + . to also show hidden dot-files
  3. Press Command + F to search
  4. Search for files with "export" in the name that are CSV, JSON, or TXT files
  5. Review the results and check Date Modified
  6. All remaining export files — visible or hidden — should be recent (accessed within 30 days)
  7. Press Command + Shift + . again to hide dot-files when done

Tip: Right-click any greyed-out hidden file and select Get Info to understand what it is before deciding whether to delete it.