Saving a result and exporting a report
Where saved investigations live, what is checked when one is opened or imported, and what the Markdown report contains.
#Plain languageIn plain terms
An investigation is only useful if you can come back to it and hand it to someone else. Forensia lets you save results in your browser, add your own notes, and export a written report.
Saved work stays on your device. Nothing is uploaded. Every time a saved investigation is opened, it is checked to confirm it has not been altered since it was sealed.
#How it worksHow it works
- Saving seals the result with a digest of its contents.
- You can attach notes, hypotheses and contradictions, each pointing at specific records.
- Earlier entries can never be edited. A correction is a new entry that supersedes an old one.
- Opening or importing recomputes every digest and rejects a file that fails.
- The report is generated from the saved result, the same way every time.
#Technical detailThe exact rules
| Limit | Value |
|---|---|
| Saved investigations | 5 |
| Snapshots per investigation | 2 |
| Size per investigation | 8 MiB |
| Total size | 10 MiB; browser storage may impose a lower quota |
| Review entries | 50 |
| Text per entry | 2,000 characters |
| Records cited per entry | 16 |
Storage is the browser's IndexedDB. The format is versioned as forensia.investigation.v2, or forensia.investigation.v3 once any entry carries a role. Review entries come in three kinds: note, hypothesis and contradiction, shown as "Note", "Possible explanation" and "Conflicting evidence".
An entry may carry one optional role that you assign: Setup, Authorization, Execution, Onward movement or Cleanup. A role is accepted only when the entry explicitly links at least one activity record and every linked activity record sits on a recorded transaction. It is your label, not a detected event. A role-labelled investigation cannot be saved back to v2, and older releases cannot import it.
"Your review links" lists each entry with the exact records it cites. Only an explicitly cited activity record is placed against a transaction. Shared addresses, nearby times, source records and findings never create a link.
Checks on open and import
- Size and nesting are within limits, and only known fields are present. Raw response data is refused.
- Each snapshot's digest recomputes to the stored value.
- Each snapshot's evidence fingerprint recomputes too.
- Every request's recorded size and fingerprint match the request text.
- Identifiers are unique, and every reference from a finding or a note resolves to exactly one record.
- The network details match the product's own definitions, and explorer links point at the expected host.
Writes are guarded against two tabs overwriting each other: a save must advance the revision by exactly one from the revision it started with.
The Markdown report
The report is one text file, schema chainproof.report.md.v1. It contains, in order: a case summary, the sources and their coverage, every finding with its class, confidence, method and limitation, any trace, timeline and execution detail, the activity records, every source record with its fingerprints, the warnings, and a closing statement of what was not assessed.
Text taken from the chain, such as token names, is written literally. Characters that would turn into formatting or links are neutralised, and hidden characters are shown as escaped code points.
Export is blocked when a re-check of the result against saved responses reports a conflict. Saving the result is blocked too. The "Report (.md)" button is disabled, and a banner titled "Interpretation conflicts with saved evidence" says why.
#How it worksAttaching a document
A saved investigation can hold outside material beside its captured results: a report, a post, a statement. Open the saved investigation, choose Documents, and add a text file. You see a preview before anything is saved.
| Limit | Value |
|---|---|
| File type | Plain text or Markdown (.txt or .md), read as UTF-8 |
| Size of one document | 128 KiB |
| Documents per investigation | 4, and 512 KiB combined |
| Where it is kept | This browser only, unencrypted. Nothing is uploaded |
- You can record the publisher, a source address and a publication date as stated by the document. The address is stored as text and is never opened.
- To keep a passage, select the exact words in the original text and save the excerpt. Its position in the original is kept with it.
- Addresses, transaction hashes and dates found in the text are listed as mentions. A mention is only text: it is not resolved to a network, not looked up, and not turned into a finding.
- A JSON backup includes the full original text of every attached document. A Markdown report includes only the excerpts you saved, with their attribution.
- Removing a document removes its excerpts too. Files you already downloaded are not changed.
#LimitsWhat it does not tell you
- The report holds source records and findings, not the raw responses. Those live in the local evidence vault, where available.
- Saved investigations are tied to one browser. Clearing site data removes them. Export anything you need to keep.
- Reopening a saved result does not refresh it. It shows what was captured then.
- The report states threat status as unassessed. It is an analytical record, not a legal finding.