Reports

11.1 Evidence Reports

Evidence reports describe a single evidence item. They are created during evidence finalization and usually include:

• Evidence ID.
• Acquisition ID.
• Case ID.
• Evidence type.
• Capture URL or device/mail context.
• Investigator identity.
• File information.
• Hash information.
• Archive details.
• Report details.
• Timestamp or blockchain references where available.

Evidence reports are useful for exhibit-level review. They allow a reviewer to understand one item without reading the entire acquisition package.

11.2 Acquisition Reports

Acquisition reports describe a full acquisition session. They include session metadata, acquisition options, evidence lists, archive information, and relevant technical context. Acquisition reports are useful when explaining the entire collection event. They connect individual evidence items to the session in which they were captured.

11.3 Case Reports

Case reports summarize the entire case. They may include case metadata, acquisition list, closure information, package information, and integrity metadata. Case reports are useful for handoff to legal teams, compliance teams, supervisors, or external reviewers.

11.4 PDF Reports

PDF reports are intended for human reading, printing, and disclosure. They are suitable for:

• Investigator review.
• Attorney review.
• Court exhibits.
• Compliance documentation.
• Executive summaries.

PDF reports should be preserved with their hashes and summary JSON.

11.5 JSON Reports

JSON reports are structured machine-readable reports. They are suitable for:

• Automated validation.
• Ingestion into review platforms.
• Technical analysis.
• Audit workflows.
• Long-term archival with metadata.

Do not discard JSON reports simply because a PDF exists. The JSON report may contain structure that is easier to validate programmatically.

11.6 Executive Summaries

An executive summary should explain the acquisition in plain language:

• What matter the evidence relates to.
• When collection occurred.
• Who performed collection.
• What was collected.
• Which major settings were used.
• Whether acquisition completed successfully.
• Where the final package is stored.

Eviquire reports provide technical data. Investigators may still need to prepare a separate case narrative for legal or management audiences.

11.7 Technical Appendices

Technical appendices should preserve details that may be too detailed for an executive summary:

• Hash lists.
• Network capture metadata.
• Browser profile notes.
• TShark version and hash.
• TLS key log references.
• Timestamp validation results.
• Blockchain anchoring results.
• Known errors or limitations.

11.8 Local Evidence Reports and Branding (Version 6)

Version 6 creates local PDF and JSON evidence reports that capture available evidence context, investigator identity, comments, filenames, file hashes, and supported visual previews. This is independent of the optional Save each Evidence Report Online selection, which governs online availability for eligible reports.

Configure local evidence report branding separately from acquisition report branding where supported. You can preview reports inside Eviquire, save a preview, or open it in an external PDF viewer. The local evidence report footer includes page counts and evidence/acquisition identifiers; redacted report versions omit those identifiers.

Preserve original PDF and JSON report files, the associated summary, and their hashes. A locally created PDF report is explanatory documentation; it should be reviewed together with the raw evidence rather than treated as a replacement for source artifacts.