Open Report Builder from the ribbon bar. There are two options to choose when working with Report Builder.

Add selected data

You can add selected data to include selected artifacts or other data from the current case to Report Builder as Data blocks.

View report

You can create, manage, and preview reports. If you have previously worked in Report Builder and saved a report, it will automatically be opened when you open the case.

Note: You can open a pre-defined template and apply it to your case, see Report templates.

The panes on the View report tab

• Input – Different types of blocks are available in the INPUT pane, to use when building a report. There are System blocks, Data blocks, and Tag blocks.

• Report – The REPORT pane is where the customized report is set up, created, and modified.

• Preview – The PREVIEW pane displays a preview of selected block, chapter, or entire report.

System blocks are always displayed in the INPUT pane, while Tag blocks and Data blocks are displayed once tagged or added. The System blocks, Data blocks and Tag blocks are by default listed vertically with their block name and the number of artifact(s), when applicable.

System blocks

You can drag and drop the blocks into the REPORT pane multiple times, to create the content of the report.

When you drag and drop System blocks, an options dialog will appear where you can enter further information for the block added.

System blocks can be added to the REPORT pane to set up the layout of the report:

• Cover page – Add the cover page block to design a report cover page with text, images, and dynamically updated information like time and date, case details, and organization information.
• Audit log – Add the case audit log to the report. Select which time period and what type of information to include. If no time period is selected, the full audit log is included.
• Case – Add information on the data sources, categories, and apps that are relevant to the case.
• Chapter – Add the chapter block to create a chapter in the report. You can drop INPUT blocks on the chapter block to create content.
• Data sources – Add summary information about the included devices and the extracted data from those devices.
• Document - Add the document block to include a PDF or .txt file to the report. Browse to the specific file you want to include and click OK. For PDF files, you can configure which pages to include into the report, change Style settings to embed the document into the report layout or include the document's original style settings, and apply Save settings.
• Notes – Add the notes block to include customized text to the report.
• Page break – Add the page break block to create a page break in the generated report.
• Picture – Add the picture block by browsing, and select the picture size (Small, Medium, Large and Max size) required, and any additional text.
• Placeholder – Add a placeholder block to include in your template.

Note: You can modify the options, see Edit blocks in the Report pane.

Tag blocks

Tag blocks are automatically added and updated in the INPUT pane whenever you tag any artifact(s) in your case.

You can drag and drop the blocks into the REPORT pane multiple times, when you want to use the same artifact(s) in multiple places in the report.

Note: Artifacts tagged with the same tag are grouped together.

When you drag and drop Tag blocks, an options dialog will appear where you can select the layout for the block.

Data blocks

Data blocks can only be dragged and dropped into the REPORT pane once per block when building the report.

Add Data blocks from Persons

1. In the Case tab, click Persons.
2. In the ribbon bar, click Report Builder – Add selected data.
3. In the dialog Add data block, select one of the options.
4. Optional: Enter a data block name and click OK.
5. In the confirmation dialog, click OK to add the content.

Add Data blocks from Screenshots

1. Go to Capture in the ribbon bar and select Screenshot.
2. Select Drag area or Fullscreen to take the screenshot.
3. Select the Add to Report Builder icon to add the screenshot.

Add Data blocks from Artifacts

You can add artifact(s) from the Artifacts pane.

1. Select, or filter to show, the relevant artifacts.
2. In the ribbon bar, click Report Builder – Add selected data.
3. In the dialog Add data block, select one of the options. The artifact option varies depending on the selected filter.
4. Optional: Enter a data block name and click OK.
5. In the confirmation dialog, click OK to add the content.

Include or exclude properties

When you select the Standard layout for artifacts within a Data block, you can select to include or exclude specific properties in the report. Technical details properties are excluded by default. To include or exclude properties, do the following:

1. Select one or more properties under Exclude or Include. Press and hold the Ctrl key to select multiple properties. To select all properties, press Ctrl + A.
2. Click the arrows to move the selected properties to Exclude or Include.
3. Click OK.

Build a report by dragging and dropping blocks from the INPUT pane into the REPORT pane, to set up the layout and content for the report.

In the Report pane, the More options menu contains the following actions:

• Edit header/footer – Select the information to include in the header and footer of the report.
• Open template – Open an existing template, see Open a report template.
• Save template – Save the template, see Create a report template.
• Open case report – Open the default report connected to the case in Report Builder.
• Delete all blocks - Remove all the blocks currently added to the report.

Build a report

1. In the ribbon bar, click Report Builder – Add selected data, and add blocks, see Add Data blocks from Persons. Adding blocks to the report can be done at any time while working with the report.
2. In the ribbon bar, click Report Builder – View report.
3. Drag and drop blocks from the INPUT pane into the REPORT pane.
4. Edit the blocks if needed, see Edit blocks in the Report pane.
5. Click Preview report to view the entire report or Preview to view the selected block.

Add blocks to the report

Blocks are added from the INPUT pane to the REPORT pane. Select the block you want to add to the report and drag and drop it into position in the REPORT pane.

Order blocks in the report

Drag and drop the blocks from the INPUT pane to the REPORT pane. You can rearrange the order of the blocks in the REPORT pane. When you drop a block on a Chapter block, the added block is the first block inside that chapter. When you drop a block below the last block in the report, the block is added last in the report.

Edit blocks in the Report pane

In the More Options menu, you find:

• Edit - Edit the content or the layout to display for the block:
  • System blocks: Editable fields, see System blocks.
  • Tag blocks: Choose the layout to use for the included artifacts.
  • Data blocks: The layout options depend on the selected data block and adapt to the content within a data block.
• Delete this block - Delete the selected block. Only deleted Data blocks are restored back to the data blocks section of the INPUT pane.
• Preview – Preview the content in each block.

Design a Cover page or Notes block

1. Add a Cover page or Notes block to the Report pane, or click the More options button for a previously added Cover page or Notes block and select Edit.

   Note: If you edit an older report or a report based on an older template, the Notes block might be of an older version without the configuration capabilities. In that case, drag a new Notes block into your report.

2. Add content to the page.
   • Write any text content, like a report title or paragraphs of text. Select the text and use the buttons at the top of the window to adjust the styling of the text.
   • Select the Header and footer check box to include the defined header and footer on the cover page. This option is only available for the Cover page block.

   • Select a Dynamic content option and click Insert to add dates, time, organization information, or case information. Using dynamic content reduces the need of maintenance as it's either updated automatically or loaded from a central location so that you only need to update it in one place.

     Note:

     • The case information is loaded from the Case info details on the Case tab.
     • The organization information is loaded from the My organization tab in Options.
   • Click Browse... to select an image to add to the Cover page or Notes block. Select the image and use the Image size slider to adjust the size of the image.
3. Click Preview to show a preview of the page.
4. When you are happy with the design, click OK.

Minimize and expand chapter

Select the arrow next to the chapter, to minimize or expand the blocks.

Edit header and footer

Select what information to include in the header and footer of the reports.

1. Click the More options menu in the Report pane and select Edit header/footer.
2. Select the information to show in each position.

Some information, like the logo, take up more space and therefore cannot be combined with other information in the same position.

Note: If you choose to include any organization or department information, ensure that the required information is entered on the My organization page in Options.

Generate the report

1. In the REPORT pane menu bar, click Generate.
2. In the Save As dialog, save the generated PDF file report.

You must install Adobe Acrobat Reader to preview the report.

The PREVIEW pane displays a preview of selected block, chapter or entire report.

• In the REPORT pane menu bar, click Preview to view the report in the PREVIEW pane.
• Click Close to remove preview content displayed.

You can save the report layout built for the case. When closing XAMN, you will be prompted to save the report along with any other case related work done in XAMN, when not saved.

• In the ribbon bar, click Save. The report file (.rbr) will be saved in a folder (Reports) of the case directory. The report will be connected to the specific case.

Create a template to use and save for future reports.

A report template is not connected to a specific case. The template does not contain any data which is connected to the case, for example artifacts. When saving the template, all blocks which contain artifacts or specific data from the case will be replaced with Placeholder blocks.

The Placeholder block acts as a placeholder for case specific data, which can be added to the report template.

• In the Placeholder options dialog, enter an instruction of the data that the placeholder block should contain.

Create a report template

1. In the ribbon bar, click Report Builder – View report.
2. Drag and drop System blocks from the INPUT pane to the Report pane, to create a report template.
   • Place the blocks in the order to be displayed in the report, see Order blocks in the report.
   • When placing the blocks, add the option content for each block, see System blocks.
   • Edit the blocks if needed, see Edit blocks in the Report pane.
3. In the REPORT pane, go to the More Options menu and select Save Template.
4. In the Save As dialog, save the template. The template will be saved as a .rbt file.

Open a report template

1. In the REPORT pane, go to the More Options menu and select Open Template.
2. Select the .rbt template to use. The template will open in the REPORT pane.

Note: Placeholder blocks in templates are replaced with the dropped block when you drop a Tag or Data block onto it.

You can work with Report Builder in a separate window.

• Select the Report Builder tab and drag it away from its position, to undock.
• Click Dock, to revert it back as a tab on the XAMN screen.