diff --git a/app/Http/Controllers/Staff/AttachmentController.php b/app/Http/Controllers/Staff/AttachmentController.php
index 0fa0177..4292a43 100644
--- a/app/Http/Controllers/Staff/AttachmentController.php
+++ b/app/Http/Controllers/Staff/AttachmentController.php
@@ -5,7 +5,9 @@
 use App\Http\Controllers\HashidControllerBase;
 use App\Models\Enums\Permission;
 use App\Models\Study;
+use App\Services\AuditTrail\Activity;
 use Illuminate\Http\Request;
+use Spatie\MediaLibrary\MediaCollections\Models\Media;
 
 class AttachmentController extends HashidControllerBase
 {
@@ -23,6 +25,11 @@ public function upload(Request $request)
             $study->addMedia($file)->toMediaCollection(Study::MEDIA_COLLECTION);
         }
 
+        audit()
+            ->did(Activity::Attachment_Upload)
+            ->on($this->key)
+            ->log();
+
         return response()->json(['success' => 'Files uploaded successfully']);
     }
 
@@ -36,9 +43,22 @@ public function delete(string $hashId, int $mediaId)
         if ($media !== null) {
             $media->delete();
 
+            audit()
+                ->did(Activity::Attachment_Delete)
+                ->on($this->key)
+                ->log();
+
             return redirect()->back()->with('success', 'File deleted successfully');
         }
 
         return redirect()->back()->with('error', 'File not found');
     }
+
+    public function view(string $uuid)
+    {
+        $media = Media::findByUuid($uuid);
+        abort_if($media === null, 404);
+
+        return response()->file($media->getPath());
+    }
 }
diff --git a/app/Services/AuditTrail/Activity.php b/app/Services/AuditTrail/Activity.php
index 9911d95..a1ad7c7 100644
--- a/app/Services/AuditTrail/Activity.php
+++ b/app/Services/AuditTrail/Activity.php
@@ -22,6 +22,9 @@ final class Activity
     public const int Study_Archived = 108;
 
     public const int Study_Delete = 109;
+    public const int Attachment_Upload = 110;
+    public const int Attachment_Download = 111;
+    public const int Attachment_Delete = 112;
 
     // report
 
diff --git a/resources/views/staff/history/partials/_uploaded-studies-list.blade.php b/resources/views/staff/history/partials/_uploaded-studies-list.blade.php
index ee67bcf..da8b0e4 100644
--- a/resources/views/staff/history/partials/_uploaded-studies-list.blade.php
+++ b/resources/views/staff/history/partials/_uploaded-studies-list.blade.php
@@ -20,14 +20,14 @@
                     <div class="d-flex justify-content-start align-items-center">
                         <div class="avatar-wrapper">
                             <div class="avatar me-2">
-                                <a target="_blank" href="{{ $media->getUrl() }}">
+                                <a target="_blank" href="{{ route('staff.attachment.view', $media->uuid) }}">
                                     <img class="rounded" src="{{ thumb_url($media) }}"/>
                                 </a>
                             </div>
                         </div>
                         <div class="d-flex flex-column">
                             <a data-bs-popper="{{ $media->file_name }}" class="text-heading fw-medium" target="_blank"
-                               href="{{ $media->getUrl() }}">
+                               href="{{ route('staff.attachment.view', $media->uuid) }}">
                                 {{ chomp($media->file_name, 20) }}
                             </a>
                         </div>
diff --git a/routes/web.php b/routes/web.php
index 41ad377..7bd40e2 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -71,8 +71,9 @@
         });
 
         Route::group(['prefix' => 'attachment', 'as' => 'attachment.'], function () {
-            Route::post('upload/{hashid}', [AttachmentController::class, 'upload'])->name('upload');
-            Route::delete('delete/{hashid}/{media}', [AttachmentController::class, 'delete'])->name('delete');
+            Route::get('{uuid}', [AttachmentController::class, 'view'])->name('view');
+            Route::post('{hashid}', [AttachmentController::class, 'upload'])->name('upload');
+            Route::delete('{hashid}/{media}', [AttachmentController::class, 'delete'])->name('delete');
         });
 
         Route::group(['prefix' => 'meta', 'as' => 'meta.'], function () {