Cases & dossiers
The full case workflow — filing findings, severity triage, auto-harvested identifiers, secret redaction — and the Markdown, JSON, and PDF dossier export formats, with what each contains.
Sur cette page
A long investigation produces a lot of results, and the useful ones scroll away fast. Cases are how ZeroTrace OSINT keeps them. A case is a working file for one investigation: as you run tools, you file the results that matter into it, and the workbench builds them into a dossier — a running index of every domain, IP, email, username, and other identifier the case has touched — that you can read, share, and hand off.
Building a case
Create a case
Start a case for the investigation you're working on. It becomes the target of every "file to case" you make from here on.
Add findings as you go
When a tool returns something worth keeping, send it into the case. It's filed as a finding — the tool that produced it, the input you gave, the full result value, any warnings, how long it took, and its sources — with its context intact, instead of disappearing up the results view.
Triage as you go
Mark a finding's severity — info, low, medium, high, or critical — so the case reflects what actually matters as it grows, not just the order things were found in.
Let it harvest identifiers
As findings come in, the workbench reads the identifiers out of them — domains, IPs, emails, usernames, URLs, hashes, phone numbers, ASNs, CIDRs, onion addresses, MAC addresses, CVEs, IBANs, VINs, and tracker IDs — and gathers them into their own columns in the dossier, so the connections between findings become visible without you transcribing anything by hand.
Export the dossier
When you're ready, export the case as a finished dossier in the format that fits what comes next.
Auto-harvesting, and what it skips
You don't have to catalog a case by hand. When you file a result, OSINT classifies every value inside it and drops the pivotable ones into the matching dossier column. Two things it deliberately does not harvest: values that describe the answer rather than the subject (a reputation lookup's feed name or malware-family label looks like a domain but isn't your target), and secrets. Anything a finding contains that looks like a credential is redacted before it's stored, so a case never becomes a second place your own secrets end up sitting in plain text.
Export formats
A clean text report you can paste into notes, a ticket, or another document. Findings are laid out as readable sections with their fields summarized (large tables and deep structures are trimmed to a readable depth rather than dumped raw), each with its severity, source, and timing. Best when the report is headed into another document or a plain-text workflow.
A structured file carrying the case's findings and dossier fields as data, for feeding into another tool, a script, or your own pipeline. Best when the case's findings need to be machine-read rather than human-read next.
A printed, self-contained report — a masthead, dense field lists, and findings laid out as numbered records — built for handover and archiving. It includes the same severity triage and per-finding provenance as the other formats, formatted for reading start to finish rather than querying. Best for the record: it looks the same everywhere and doesn't depend on any other tool to open.
What every format contains
Whatever the format, a dossier reflects the case behind it: every finding you chose to keep, with its input, its result, its severity, its sources, and when it was saved; and the identifiers the workbench harvested from those findings, gathered into the dossier's fields so the shape of the investigation — not just its raw output — comes through.