Two of the favorite file formats for distributing case reports are HTML and PDF because of the readily available “reader” programs. Many times, a report can be a combination of the two formats. In this article, we take a closer look at the PDF file format and the application PDFPen Pro from Smile Software for it ability to assist in creating great looking reports.
Report Generation
Initially, I have created a sample report using the application Pages from Apple. The sample report was generated by using the Print to PDF feature that is available system-wide. Pages does have the ability to “Export” to PDF, but this would have created a different PDF with different embedded metadata as well. I wanted to highlight the data that a user should expect when using the built-in function of Print to PDF. The report itself is seen here as an image:
Sample Original PDF Report generated from Pages application
After generating this report, I immediately opened this PDF file in PDFPen Pro. I went to the Inspector to look at the owner data embedded into the file. Here is what I found:
PDFPen Pro Inspector Document Information
Most interesting about this window is the title and author. Some of the readers of this site might notice that the look of this Sample Report has the look and feel of the ReadMe file I place in the applications distributed from this site. I utilized my template ReadMe file to create this Sample Report. Because I did not change the PDF information for Title and Author, this information was embedded into the document. Of course this is very harmless information but imagine what could happen is you re-use case templates and unique case data goes out accidentally. The title of a PDF report could be that of another defendant or target. It is also important to note, I told you upfront that I used Pages to create this report. Here is an example of how this is important to note. When you generate your report upon conclusion of analysis with BlackLight, you will generate a Microsoft DOCX formatted file. This file is easily opened in Microsoft Word on the Mac or even Page ’11. In order to go from DOCX to PDF, I had to use a secondary program. So when asked what I used to generate my report I answer, out of habit, “BlackLight”, when clearly the data says, “Pages”. You could be playing semantic games in the courtroom all because of embedded data. This small exercise is to note the embedded data so you can best understand what you distribute, as well correct errors when appropriate. Let’s take a look at how PDFPen Pro is able to help you review reports, as well as generate even cleaner reports for presentation.
PDFPen Pro Features
PDFPen Pro offers numerous features that that can help anyone work with the PDF file format. I encourage anyone to read all of the features of the software and obtain a demo copy at their website. Once I had installed the software, I also registered my email address. As promised, they did not use the address for any third party spam. What I did get emails that gave me insight into features of the application. I would encourage use of that feature to anyone.
Embedded Data
With the SampleReport.PDF file opened in PDFPen Pro, I first wanted to change the Title to reflect that it was a case report. This was a simple change in the Title box. Likewise, other embedded information can be changed or added here for future convenience. Notice the Subject and Keywords boxes were each blank. Spotlight will index documents based upon content in each of these fields. Including case data keywords could prove useful here as well. In comparison, the application Preview that is included on each Mac will view this embedded data, but does not allow for changing. (PDFPen Pro is NOT the only means of changing embedded data. It is simply one means we are showing here.)
Redaction
Next, I want to simulate that a version of my report was being requested that needed a section redacted. PDFPen Pro makes this easy.
PDFPen Pro Redact Feature
In the above screen capture, I am simulating redacting the image as a block. This feature is excellent when you need to distribute a report that contains contraband. Rather than generate a second report, you are able to simply redact from the original the portion that isn’t meant to be outside of the evidentiary chain. Not all analysis programs have a Redacted Image feature like BlackLight so this can assist in creating reports quickly based on the original.
HTML to PDF
Another feature that I thought was useful in two ways is PDFPen Pro’s ability to take a website and create PDF files with a table of contents from it. This feature could be used to make a website on the internet into a PDF file report and add it to your case data, or this feature could also be used to convert your own HTML report to PDF when necessary.
PDFPen Pro New From HTML Feature
This feature will be dependent upon your internet connection speed and also the HTML coding used in the site itself. Printing websites is not always as easy as “Print”. PDFPen Pro is essentially doing a Print to PDF to each applicable webpage. AppleExaminer.com is an example of a website that does not print well, but does view on the screen.
Page Numbering
One important feature to our eDiscovery readers will be the ability to add page numbering, specifically Bates Page Numbers. With PDFPen Pro, you are able to simply add the Bates page numbering to a PDF file from the Edit menu. This means that you are able to use any application on the Mac and Print to PDF to create your report and then add the Bates Page Numbers afterwards using the Edit menu feature.
Miscellaneous Extras
Two other features worthy of mentioning in the scope of digital forensics and making our life easier is PDFPen Pro’s ability to interface with your scanner to scan documents direct to PDF, as well as perform OCR (optical character recognition) to create formal documents from our hand written notes. When working on Macs, we easily wind up with hand written notes as we do our work. With PDFPen Pro and a scanner, it is easy to scan notes directly to a PDF file as well as perform OCR to add notes we have taken into other reports.
Report Completion
Once you have your PDF files completed with PDFPen Pro and saved, it is time to distribute. Sometimes, you may choose to distribute as separate PDF files because it makes sense to keep “Search & Seizure, Imaging, and Analysis” as their own reports for example. Other times, you may have several PDF files that simply make more sense combined together for reading as one report. This type of editing can be done with Apple’s Preview or with PDFPen Pro. I will describe to you the Preview application for this exercise. To combine 2 PDF files into 1 is a very easy process:
- Open the first PDF file in Preview.
- Perform a Save As or Duplicate (depending on OS X version) and create a new report name for the merged report
- While in Preview, choose View - Thumbnails (you can also choose Contact Sheet)
- From the Finder, drag the second PDF file onto the first PDF at the point you want to insert (beginning or end, middle likely doesn’t make sense)
- Save your new report
Sometimes separate PDF files can work out very well though. FTK v3 allows an analyst to attach supplementary documents to the case. This feature works great when analyzing data directly on the Mac and then attaching subsequent PDF reports to the FTK data for your later final report.
Thank you to Smile Software for supplying a copy of PDFPen Pro for this article. AppleExaminer.com welcomes all of your comments on reporting, including software and techniques you use to create great reports to present to case agents.