Reading an analysis report

Opening a file from the dashboard takes you to its case, where the analysis sits alongside a preview of the document. If the file is still being analysed, you'll see a live progress view first; once it finishes, the full report appears.

While it's analysing

For a file that's still processing, the case shows its progress: the current stage, a percentage, and a status of In progress until it reads Completed. You can leave the page and come back; the analysis keeps running in the background.

The report

The analysis is laid out in sections, from a quick overview down to the detail:

• Analysis highlights: the headline points, so you can size up the file at a glance.
• Summary of risk factors: why the file was given its risk level.
• Comprehensive analysis: the full set of findings. Each finding has a heading, a category, a description, a severity, and the supporting evidence behind it. Findings are collapsible, so you can expand the ones you care about.
• Observations: additional notes that aren't risk factors in themselves.
• Suggested actions: recommended next steps.
• Audit trail: a record of what happened, including any manual changes to the risk level.

At the top you'll also see the file's name, upload date, case label, and risk badge, plus a Confirm/Update Risk button (see Adjusting a risk score).

The document alongside

To the side, tabs let you look at the document itself:

• Preview: the document as uploaded.
• Metadata: the file's embedded details, when present.
• Internet: results of a reverse image search, with match scores, when the document is an image found elsewhere online.
• ELA: an Error Level Analysis overlay that highlights areas of an image that may have been edited, when available.

Tabs only appear when there's something to show, so you won't see ELA or Internet for every file.

File actions

The file's actions menu gives you the following. Some of them depend on your role's permissions (see Roles and permissions).

• Case Details: open the case's details.
• Download: download the Analysis Report(s) or the Log Output.
• Move: move the file to a different case.
• Archive file: hide the file from the case and from search. Nothing is deleted: its analysis, reports, and any conversations that used it are kept. This needs Archive files, which by default Organisation Owners and Organisation Admins hold.
• Delete permanently: erase the file, its analysis and reports, and every conversation that uses it. This can't be undone; only an audit record of who deleted it, and when, is kept. You'll see it only if permanent deletion is enabled for your organisation and your role has Permanently delete files, which by default only Organisation Owners hold.