Reports

Report Types

DFIRe supports two types of reports to serve different documentation needs:

CAN Report (Conditions, Actions, Needs)

A situational awareness report designed for quick status updates and shift handovers. The CAN format provides a structured way to communicate:

• Conditions: Current situation and context of the investigation
• Actions: Ongoing response activities and work in progress
• Needs: Outstanding requirements, blockers, and resource needs

CAN reports are versioned - each update creates a new version while preserving the complete history. This allows teams to track how the situation evolved over time and provides an audit trail of communications.

Investigation Report

A comprehensive, section-based report for detailed investigation documentation. This is the primary deliverable for completed investigations. Features include:

• Configurable section structure
• Rich text editing with Markdown support
• Dynamic content with evidence and image references
• Auto-generated sections (timeline, evidence inventory)
• QA review workflow
• Print-optimized output

Report Sections

Investigation reports use a configurable section structure. Administrators can customize which sections appear in reports via System Settings.

Section Types

Sections fall into two categories:

• Editable sections: User-written content with Markdown support
• Generated sections: Auto-populated content from case data

Generated Sections

These sections are automatically populated based on case data:

• Title Page: Case details, dates, and team members
• Table of Contents: Auto-generated navigation
• Timeline: All timeline entries from the case
• Evidence Inventory: Complete list of evidence items
• Detailed Item Reports: Expanded evidence item details

Section Visibility

Sections can be configured to appear in:

• Incident cases only
• Investigation cases only
• Both incident and investigation cases

Individual sections can also be excluded from the final report on a per-case basis without deleting their content.

Writing Reports

Rich Text Editor

The report editor supports Markdown formatting:

• Bold, Italic, and other text formatting
• Headings (H1-H4)
• Bullet and numbered lists
• Block quotes
• Code blocks
• Tables
• Links

Auto-Save

Changes are automatically saved as you type. After you stop typing, your changes are saved within one second. A save indicator shows when changes are being saved and when the save is complete.

Concurrent Editing Protection

DFIRe prevents conflicting edits when multiple users work on the same report:

• When you open a section for editing, it's locked to other users
• Other users see who is currently editing
• Locks are released automatically when you stop typing
• A 15-minute failsafe ensures locks are released if an error occurs

Dynamic Content

Insert references to evidence items and images that automatically expand when the report is viewed or exported.

Evidence References

Reference evidence items using the syntax:

{{evidence.<uuid>}}

When rendered, this displays the evidence item's identifier and description. Use the reference picker in the editor toolbar to insert references without memorizing UUIDs.

Image References

Embed images from evidence attachments:

{{image.<size>.<id>}}

Available sizes:

• small - Thumbnail size
• medium - Half-width image
• large - Full-width image

Attachment References

Link to file attachments:

{{attachment.<id>}}

QA Workflow

DFIRe includes a quality assurance workflow to ensure report accuracy before delivery.

Section States

State	Description	Actions Available
Draft	Section is being written or revised	Edit content, submit for QA
Ready for QA	Author has submitted for review	Review, approve, or return to draft
QA Completed	Section has been reviewed and approved	Return to draft for revisions

Report Versioning

Reports use a version number to track progress:

• 0.x (Draft): Report is work in progress. Minor version increments when sections are submitted for QA.
• 1.x (Finalized): Report has been finalized and is ready for delivery. Subsequent revisions increment the minor version.

Workflow Process

1. Author writes section content
2. Author clicks "Ready for QA" to submit for review
3. Reviewer examines the section content
4. Reviewer either approves (QA Complete) or returns to draft with feedback
5. Once all sections are approved, the report can be finalized

Configuring Report Sections

Administrators can customize the report structure in System Settings:

1. Navigate to System Settings

   Go to Settings and select the Report Sections tab.

2. Add or Edit Sections

   Create new sections or modify existing ones:

   • Title: Section heading displayed in the report
   • Order: Position in the report structure
   • Type: Editable (user-written) or Generated (auto-populated)
   • Visibility: Include in incidents, investigations, or both
   • Page break: Whether to start a new page before this section
   • Default excluded: Whether to hide this section by default
3. Add Writing Guidance

   Provide instructions for authors on what to include in each section. This guidance appears in the editor to help maintain consistency.

4. Set Template Content

   Pre-populate sections with boilerplate text that authors can customize.

Printing Reports

Reports are optimized for printing and can be saved as PDF using your browser's print function.

Print-Optimized Layout

• Professional formatting optimized for print
• Table of contents for navigation
• All images and tables included
• Evidence references expanded inline
• Page breaks between sections as configured
• Excluded sections hidden automatically

Saving as PDF

To create a PDF:

1. Open the report in print preview mode
2. Use your browser's print function (Ctrl+P / Cmd+P)
3. Select "Save as PDF" as the destination
4. Adjust page settings if needed and save

Best Practices

Writing Effective Reports

• Be factual: Stick to observed facts and evidence
• Be clear: Write for your audience (technical vs. executive)
• Be complete: Document all findings, including negative results
• Use references: Link to evidence items rather than copying data

Evidence References

When referencing evidence in your report:

• Use the reference picker to insert evidence links
• Include relevant images at appropriate sizes
• Let generated sections handle inventory lists automatically

CAN Reports for Handovers

• Update CAN reports at shift changes or significant milestones
• Keep conditions focused on current state, not history
• Be specific about blockers in the needs section
• Review previous versions to understand investigation progression