39
Ch a p t e r 1 7 – R e p o r t s M o d u l e
203 | Page
Copyright GetData Forensics Pty Ltd 2010 - 2014, All rights reserved.
17.5
CREATING REPORTS
Whilst the Forensic Explorer Reports module can be effectively used to create one off
reports on a case by case basis, the power of the module comes from the ability to
design, use, and then re-use automated report templates in future cases.
As described in the sections above, Forensic Explorer reports are created from
bookmarked items. A methodical approach to bookmark structure will ensure that
report templates can be used again and again.
Forensic Explorer can report on a single bookmarked item and its attributes, or iterate
through a list of bookmarked files and their attributes. The following exercises provide
examples of how to design basic report templates.
17.5.1
REPORT EXERCISES
In order to work through the exercises below it is necessary to have a basic
understanding of how to create a case, add evidence and bookmark files.
To prepare for the exercises:
STEP 1 – START A CASE AND BOOKMARK FILES
a.
In the evidence module, create a new case, adding a forensic image that
contains JPG files.
b.
In the File System module, select a group of JPG files, right click and ͞Add
Bookmark.
c.
In the Add Bookmark window, add the files to the Pictures bookmark folder.
d.
Switch to the Bookmarks module.
e.
Review the Pictures bookmark folder to ensure that it contains the
bookmarked files.
STEP 2 – CREATE A NEW BLANK REPORT
a.
Switch to the Reports module.
b.
In the Reports tree, select New > Blank Report. Exercise 1: Reporting on a
single bookmarked item
