New Flexible Reporting Template in EnCase App Central

Ken Mizota

Recently, a new type of app was added to the EnCase App Central store: the Flexible Examination Report Template. We’re excited to offer this new Case Template, to the EnCase community. If you haven’t done so already, check out EnCase App Central to download the template for free.

Report Templates are used to store the configurations and customizations an investigator makes for a given case, to be reused and reapplied for other similar cases. This template provides a simple, Bookmark structure that is designed to be easy to work with and modify. In this post, I’ll walk you how this new tool can help make your investigations more efficient.
If you are an EnCase Version 7 user, you likely understand the power of customization provided by the EnCase Report Object Creation Code (i.e. ROC) language. For many investigators, customization and control of precisely what goes in the report, and how it is presented provides a higher quality, more credible deliverable of the forensic investigation. ROC and Case Templates in particular, were built to enable granular yet repeatable customization.

For other investigators, high levels of customization and tailored formatting are only one of many priorities. EnCase users familiar with Version 6 and prior worked with a less customizable, but simpler method of crafting examination reports. This leaves many investigators in a bind: They want to perform some basic customization but don’t necessarily have the time to fully customize a report template.

The Flexible Examination Report Template includes:

• A single set of formats: There is one format for each type of Bookmark Type. For example, if the Investigator wants to view Pictures in the same way throughout the entire Examination Report, a single Format may be edited.
• Customizable Bookmark Folder Structure: This Report Template is built to facilitate Bookmark Folder customization. When a Bookmark Folder is added to the Examination folder, it will automatically appear in the Examination Report.

Of course, since it is a Case Template, you’ll be able to store the configurations and preferences that work for you, for reuse in any subsequent case.

How it Works
After downloading the Flexible Examination Report Template, copy the template to your EnCase installation directory, in the Template folder:

Launch EnCase, and create a new case. You’ll notice the Flexible Examination Report template will appear in the Templates list:

Select the Flexible template populate the Case Name, Examiner Name, and any other case information as you normally would. Click OK to create your case.

Before adding evidence to the case, let’s take a look at the details of the Flexible Examination Report Template. Click View → Bookmarks. You can also view Bookmarks from the Case Home tab.

Bookmarks are setup in two sections:

1. Examination: All Bookmarks and Bookmark Folders are placed in this folder.
2. Glossary: Any definitions, notes or additional information needed for the reader to interpret the contents of the report can be placed here.

Any custom Bookmark Folder structures may be added underneath the Examination folder. How Bookmark Folders are structured are likely highly specific to a case. In one case it may be effective to structure the report by victim, in another case, the Investigator may want to categorize by artifact type.

We’ll create a Pictures folder and a Movies folder:

Next, add evidence, and drill into the evidence to begin the investigation.

We’ll first run the Pictures from Entries filter and Bookmark a handful of entries. We’ve selected three pictures and clicked Bookmark → Selected Items. Bookmarks are placed in the Pictures folder.

The resulting report for these bookmarks looks like this:

If you want to change the metadata, change the size of the image or make any changes otherwise, the Flexible Examination Report template makes it easy.

Click View → Report Templates and double click on the formats column within the “Examination” section:

Select the Formats tab and double click the Image Format to edit:

To add metadata, Physical Size for example, we can use a dropdown menu. You don’t need to know how to “code” to make changes to Report Templates:

The metadata is added to the format:

And now, every Image in our report will now have Physical Size information included:

As you can see, with little effort, we’re able to use and customize the Flexible Examination Report template. The changes we make to Images are used throughout the entire case, making this template ideal for investigators that are looking for a simpler, yet still flexible way to build examination reports.

While we’ve just scratched the surface of the reporting power in EnCase Version 7, I hope the Flexible Examination Report Template helps get cases done faster and in the manner you choose.

If you are interested to learn more about how EnCase can generate comprehensive examination reports, more efficiently, we encourage you to reach out to Guidance Software’s Training division, where you can learn more tips, tricks, and best practices on how to leverage this powerful capability.