Case Report

WinHex & X-Ways

Case Report

 

You may create a report from the File menu of the Case Data window. The report is saved as an HTML file and can thus be displayed and opened in a variety of applications. For example, you may view it in your favorite Internet browser and open and further process it in MS Word. The application to open the report in can be specified in Options | Viewer Programs. If no such program is defined, the report file will be opened in the application that is associated with the file extension on your computer. With the Open Report command you can select any existing file and open it in the defined or associated application.

 

The report can consist of the following elements:

 

• Basic report: Starts with an optional header line, an optional logo, an optional preface (in which you may use HTML code), the case title and details, followed by a list of hyperlinks to the individual evidence object sections. For each evidence object, the report specifies its title, details, and technical description, your comments, your annotations. If only half checked, technical details about the evidence objects are not included in the case report, the evidence objects are merely listed.

 

• Report tables: All files in selected report tables can be output to the report, with selected metadata such as filename, path, timestamps, comments. Files can be optionally copied off the evidence objects into a subdirectory of where the report is saved. Then they will also be linked from the report. Either all files can be copied or merely pictures. If only pictures, for videos at least the first still image (if available) will be copied and used to represent the video in the report. By default, pictures will be displayed directly in the HTML report file and not merely linked. They are resized to the maximum dimensions you specify while retaining their aspect ratio. If you specify maximum dimensions of 0×0, then the pictures will only be linked, just as other files. If you choose to output multiple files in the same line (to render the report more compact when printing), you will appreciate that long filenames and paths can be artificially broken into multiple lines after a user-defined number of pixels, to make sure the width does not exceed the paper size.

 

There is an option to only make a copy of tagged files for inclusion in a case report instead of all or none. Useful if you wish to reference all notable files with their metadata in your report, but show only a subset of those.

 

Files can be output either grouped by evidence object and sorted by internal ID or in the order as they are currently listed in the case root window, where you can freely change the order thanks to up to 3 sort criteria. If no files are currently listed in the case root (because it has not been explored recursively), then the second option is grayed out. Explore the case root recursively first to make it available (right-click it). Note that if you choose the second option, files that are not listed in the case root window will not be output, even if they are part of a report table. That means that current filter settings have an effect on the generation of the report, too. If files are omitted because they are not listed in the case root window at the time of report generation, you will be notified of that in the report and in a message box.

  If the box to output report tables is only half checked, then only the number of items in each report table will be reported.

 

Many different settings allow to tweak the report to your liking. For example, "Name output files after unique ID" will ensure filenames that are succinct, unique, trackable and reproducible, and will also ensure that if the same files is associated with multiple report tables, it will be copied to the report subdirectory only once. That saves time and drive space. "List each file only once" is a 3-state checkbox. If fully checked, no file will be referenced in the report by more than one report table. Note that you can still see all report table associations of a file when it is listed in its first report table in the report, if you output the field "Report table". If the checkbox is half-checked, that means that a file will still be referenced (listed) by additional report tables in the report if it has multiple associations, but copied only once and linked only from the first report table.

 

A special option allows to output the complete internal metadata from a file in the case report as known from Details mode, in HTML format, instead of the extracted subset in the Metadata column in plain text.

 

Smaller versions of pictures can optionally be generated specifically for the report, to greatly reduce the memory requirements of the Internet browser or word processing application when loading the HTML report, and to accelerate loading. This can make a big difference for reports with many high-resolution photos. The JPEG compression factor is user-definable. The resolution depends on the specified "maximum dimensions of pictures". The checkbox that represents this option is a 3-state checkbox. If half checked, the smaller versions of the pictures are used only for the preview directly in the HTML report. If fully checked, even when clicking the picture in the report you will only see the smaller version, and the original larger file is not included in the report at all. This can be beneficial if your main concern is the drive space requirement of your report with linked files, not the output quality of pictures.

 

The report can optionally also show previews/thumbnails of non-picture files, e.g. Office documents, e-mails, web pages, programming source code, etc. etc., similar to the gallery. You can shrink the preview representation slightly or a lot or not at all, to either be able to read some of the text right in the report without opening the document or to get a better impression of the overall formatting of the text and just see logos etc.

 

• Search hits that are marked for inclusion in the report can be output optionally, with their context to the left and to the right. File-related search hits are output in the report table section about the respective file, along with all the selected file metadata, if the file is part of a report table and that report table is actually output in the report. If not, such search hits can be found in the section about the evidence object to which they belong. Purely physical user search hits (defined in Disk/Partition mode, not File mode) are always output in in the section about the evidence object.

 

• Case log

 

By default, the report is created for the entire case. Optionally it is created for selected evidence objects only. It is relatively easy to use CSS (cascading style sheets) for case report format definitions. In addition to defining the parameters for standard HTML elements, key elements of the report are assigned "class" parameters to simplify targeting those for formatting purposes. Example style sheets are available to use as a basis for further modification. The report options allow picking or editing a CSS file as part of the reporting process. The default is "Case Report.txt". The default look from v18.0 and earlier is still available as "Case Report Classic.txt".