Examiners need reporting options that allow them to quickly and easily provide critical information to others; whether they are giving an overview of the device to an investigator or providing another team only the most relevant findings. We've updated BlackLight to make it easier than ever to report on devices, including options that don't require the user to tag items. In addition, when exporting large reports we automatically break up the report into smaller more manageable sections. Here are some tips and examples of how to use these new enhancements.
Comprehensive Device Level Reporting
Starting in BlackLight 2018 R3, the report sidebar now includes the 'Case Data' option which, when selected, will include a comprehensive report of all the data from the device(s) in the case without having to tag any items.
Choosing Which Devices and Categories to Report On
Examiners can report on all devices in a case or selected devices by accessing the gear level options. If 'All Evidence Items' is chosen, the Case Data section will display Case Data (All items). If they choose to report Case Data on selected evidence items, the menu option will show which devices are currently selected and the root will show Case Data (for selected items).
Next, they can check the Case Data root item to report across all the categories or choose only those categories they would like to report on. If a category is selected where the device does not have that type of data, that section will not be included in the report. In order to make selection easier to select all or none hold the <SHIFT> key down while clicking on the report element header.
In the preview view, before generating the report, users will be able to see the first 50 items in a given category, below you can see the message category with over 800,000 messages. This allows the Report Preview to still be responsive as examiners adjust the report.
How to Customize Reporting for Mobile Device Summary
For examiners who want to quickly provide a summary of what is contained on a mobile device, or GrayKey image, they can now click on the 'Add' button or drag and drop the image into a BlackLight Case and then skip directly to the report tab. Examiners can then choose to provide investigators just the most relevant categories, like all contacts, all messages, and all calls. Examiners can also control the order they'd like these categories to appear in the report by dragging and dropping each category into the order they'd like from top to bottom, skipping unchecked categories.
Producing the Report
When a user clicks on Generate Report, a report will export to the selected format and include only those areas of the report the investigator has checked. The HTML report generation has been updated to break up sections with large amounts of data, for instance, all the pictures or messages on a device, into segments within the category.
Opening the HTML report provides a new streamlined navigation menu to jump to relevant sections. For the document format reports, the properly hyperlinked table of content allows users to locate important sections.
YOUR FEEDBACK FUELS THE DESIGN
We hope you find these reporting enhancements useful as they come directly from examiners like you! BlackBag strives to keep up with the ever-changing needs of our users, and to provide them with the solutions they need to overcome the challenges they face every day. As we continue to grow and perfect new features and functionality within BlackLight, we need you to continue to provide the insightful feedback that has allowed us to develop the tool we are proud to offer today. If you would like to submit feedback or suggestions please contact us through our product feedback form.