Generate reports

To prepare your data for reporting, review all the items tagged in your case to ensure their relevance to it, and add any comments if necessary. Depending on the fields you want to export, you can create a new Metadata Profile to use with the export. For details, see Build Metadata Profiles under Analyze evidence.

When preparing to send your report on, consider which of the many exporting options available in Nuix Workstation you want to use. This section covers how to generate the following report types:

An Export Summary Report

A Custom Metadata Report

A Report on Windows artifact

A Report on Microsoft Office documents

A Report on graphic files

An Event Map Report

A Network Diagram Report

Generate an Export Summary Report

An Export Summary Report details specifics about the export operation and case information. To generate an Export Summary Report:

Select the required items in the Results pane, right click, and select Export > Export Items.

In the Export Items dialog, select the:

Format in which you want to export the items.

Directory location into which to generate the report.

Required metadata for the Export Summary Report.

Click OK.

The Export Summary Report generates to the Export directory selected. For more details, see the Export data in its native format section in Export data.

Generate a Custom Metadata Report

Creating a Custom Metadata Profile for reporting purposes enables you to export only relevant metadata pertaining to the tagged files into a case report. It is good practice to create these prior to exporting and consider using them across all forensic lab machines for consistency purposes. To achieve this, export the profile out of Nuix Workstation to share it with other members of your team.

To generate a Custom Metadata Report:

Create a Custom Metadata Profile for reporting.

See Add Custom Metadata fields in Set Global Options.

Add fields as required and then use this profile as a template when exporting data.

Generate a report on Windows artifacts

Reporting on different Windows artifacts potentially requires you to produce many specific Metadata Profiles. This ensures a clean and tidy export of data and information about the data. Once you create these profiles, you can use them from case to case on the same machine, as well as export and share them with colleagues in the same forensic lab.

When exporting data in its native format or PDF representations of the file data, the Export Summary Report embeds a hyperlink to the exported data providing access to the raw files.

Microsoft Office document reports

When reporting on Office documents consider all its metadata fields. Nuix Workstation provides a Custom Metadata Profile that extracts information from MS Office documents.

The following lists an example of available metadata that you can extract from a Microsoft Office document.

AppName

AppVersion

Author Comments

Contains Comments

Contains Hidden Text

Contains Track Changes

Contains White Text

Created

DocSecurity

File Accessed

File Changed

File Created

File Modified

File Size

flag.carved

Last Author

Last Saved>

MD5

Digest Name

Page Count

Path Name

Graphic file reports

A graphic file report allows you to collate all tagged images of those you consider to be relevant. In addition to the actual files, you should consider the metadata fields embedded in the images such as Geotag data, Image dates and time, and manufacturer. Because of the many variables associated with EXIF data in JPEG files, you should consider creating ad-hoc Metadata Profiles from a default template and export them as necessary.

Event map reports

The Event Map view provides a static graphical view of communications in the result set against a timeline, displaying who sent them and how they were sent to others.

To generate a report of mapped communication events:

Select your tagged items before performing the export view operation.

Cull the results with a filter or keyword search.

Note: The fewer communication items you depict, the more readable the image.

Select the Export view, and navigate manually to the target folder to open the file.

Select the Export option to export the views, and select either of the following formats:

Scalable Vector Graphics (SVF): For an XML-based vector image format for two-dimensional graphics that supports interactivity and animation.

The SVG specification is an open standard developed by the World Wide Web Consortium (W3C) since 1999.

Portable Network Graphics (PNG): For a Raster graphics file format that supports lossless data compression.

PNG was created as an improved, non-patented replacement for Graphics Interchange Format (GIF), and is the most used lossless image compression format on the Internet.

Network diagram reports

The Network view provides a dynamic view of the communication patterns, including frequency of communication and any outlying communications in a graphical format.