OSForensics Reporting Issues

[CopGravy]

I have recently began using OSF, and have yet to be sent to formal training.(Class later this summer) However, I'm tasked with generating viewable reports from disk images that have pertinent files, photos, videos, etc. The in software reports, as I have been doing them, are viewable on my PC, and mine only. Going to another computer, say, a prosecutor's for court none of the files selected and in the OSF Report can be viewed. Is there a fix, or a third-party viewer that can be used to make the File Report generated in OSF viewable on other devices?

[Simon (PassMark)]

In the export report window, you need to select 'copy files to report location' so the files in the case are copied to the report folder rather than just linking to the case folder.

[CopGravy]

In the export report window, you need to select 'copy files to report location' so the files in the case are copied to the report folder rather than just linking to the case folder.

That..helps. However, there is still not way in which to view, or preview the files I have generated into the report. The files show as their file name, when its specifically the actual "photo" or video that I need to be able to view. If I were to save the report with the files copied to a thumb drive, and go open the report on a completely foreign device, should I be able to view the files in the report, if they are images or videos?

[David (PassMark)]

OPTION 1 - Saved checked files

If you just want the files and nothing else. You can just check the files in questions, then the right click to Save them to any drive.

See the example below.

[David (PassMark)]

OPTION 2 - Add files to case and run a report.

If you want the files of interest and would like to also have any of the following,

• Some added notes about the files from the investigator
• Some added notes about the case in general from the investigator
• Some metadata about the files (create dates, hashes, original file location, etc..)

Then you can add the files to the case, then create a report.

Adding files to the case
See example below.
You can also use CTRL-S keyboard shortcut for this.


Once the files are in the case you can create a report using the "Generate report" button from the "Manage case" module.


Then (as Richard suggested above) make sure you click on "Copy files to report location".
This creates and HTML report (and maybe a PDF). The HTML report looks like this.


The images that you added to the case will be included into the report. Plus you get some meta data. There is an option to include a lot of extra meta data as well (not show here).
Clicking on the 'Title' hyperlink displays the full size image.



If you want to send this HTML report to someone (along with the files you added to the case), you can either copy the entire "Case report" folder to a USB drive / Cloud drive / Network drive. Or you can Zip up the folder and EMail it.

The receiver doesn't need to have the source disk image nor OSF installed to view the report. They just need a browser to open the "report.html" file.

[David (PassMark)]

Option 3 - Export and Send the OSF Case file

If the person you are sending the case to has the source disk image and they have OSF installed, e.g. another investigator. Then maybe you don't need to create a report.
Instead you can send the OSF case file.

You can do this using the Export Case function.

This either exports a folder of data about the case, or a single Zip file you can Email.
It also contains the files you have added to the case.

[CopGravy]

Thats it! Thank you. CTRL+S.