# Export a case file
URL: /investigate/export
Hand an incident to someone outside the deployment as a marked PDF case file. The export is hashed, listed with its manifest, written to the delivery ledger and recorded in the audit log, and it asks for approval whenever the rules require it.
A case file is the report on marked pages: the finding, the sequence and every excerpt with the file, location and SHA-256 it came from. The limitations and open questions travel with it under your program's marking. Coordinates come out by default.
The export dialog on the incident page covers the case file and every other export format. "Every export is hashed, written to the delivery ledger and recorded in the audit log."
## Before you start [#before-you-start]
* Admins, investigators, reviewers and auditors can export case files. Viewers cannot. See [Roles and permissions](/security/roles).
* Run the **Before you export** checklist on the **Report** tab and settle each warning. See [Write and review a report](/investigate/write-a-report).
* For a case file with the reviewer's sign-off, the reviewer has approved the report. Without it, the case file is stamped DRAFT on every page.
* Confirm the marking. Admins set it in **Settings**, under **Marking**. See [CUI marking](/security/cui-marking).
## Export the case file [#export-the-case-file]
Select **Export** in the incident header. On the **Report** tab, **Export case file** at the foot of the **Review and history** drawer opens the same dialog. On the **Exports** tab of **Integrations**, **New export** asks for the incident, then opens it too. It is titled **Export** *incident*, such as **Export INC-0142**.
Under **Formats**, **PDF case file with CUI markings** is ticked, with its class, L1. It holds "The report, with CUI in the banner and footer of every page and the designation indicator on the first." Ticking any other format adds evidence and makes the export L2, which needs a named approver; see [Export formats and evidence bundles](/integrate/exports).
| **Destination** | What the dialog says |
| -------------------------------------------------- | ------------------------------------------------------------------------------------- |
| **Download** | "Saved by your browser on this workstation." |
| **Exports bucket**, selected when the dialog opens | Your exports bucket, "in this account. Kept for the retention period in Settings." |
| **On-premises share** | Your share, "on your network." |
| **Removable media** | "An encrypted drive written at the media station, for hand carry out of the enclave." |
The first three read **Inside the enclave**. **Removable media** reads **Leaves the enclave**.
**Approval** shows the class, "L1, a summary with values. Treat it as CUI." Inside the enclave it reads "No approval needed. L1 stays inside the enclave."
It then states the sign-off. An approved report reads "The report is approved, so the case file carries the reviewer's sign-off." Otherwise it names the reviewer: "The report has no sign-off from" the reviewer "yet, so the case file is stamped DRAFT on every page."
| **Options** | Default | What the dialog says |
| ---------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------- |
| **Remove coordinates** | On while the redaction policy is on | "From derived files and the case file. Originals stay byte-identical, so they keep theirs." |
| **Portion marks** | Off | "Mark each paragraph (CUI) or (U) in the case file. Optional under 32 CFR 2002.20." |
**Marking** shows the marking chip, such as CUI, and the designation, such as "Category EXPT, FEDCON, controlled by" your organization. Under an UNCLASSIFIED banner it reads **No CUI designation**.
The hint says: "L1 and L2 files carry the banner string. The case file prints it at the top and bottom of every page, with the designation indicator on the first."
The footer reads "1 file and a SHA-256 manifest". Select **Export**, and the toast names the export and its manifest hash, for example **Exported PDF case file with CUI markings as EXP-0035**.
## What the export records [#what-the-export-records]
| Where | What it shows |
| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| Incident **Activity** tab | Your name and "exported PDF case file with CUI markings", with ", stamped DRAFT" when it applies and the export ID |
| Audit log | **Exported case file** on the incident, with the export ID, the format, ", stamped DRAFT" and ", coordinates removed" when they apply |
| **Integrations**, **Exports** tab | The export, its destination, **Completed** and "No approval needed", or "No approval needed. Stamped DRAFT" |
| **Integrations**, **Delivery ledger** tab | The delivery, class L1, with the manifest as its payload and its SHA-256 |
The file is named for the incident: `inc-0142-case-file.pdf`, or `inc-0142-case-file-draft.pdf` when it is stamped DRAFT. In the example dataset, EXP-0033 is the draft case file for INC-0137, downloaded with coordinates removed.
## When the case file leaves the enclave [#when-the-case-file-leaves-the-enclave]
A case file for **Removable media** leaves the enclave, so the two-person rule applies: "both named approvers sign off, and neither can be you." The dialog lists both approvers and asks for a **Reason**, "Who needs it, and why". The button reads **Request approval**.
The request writes nothing yet. Its toast reads, for example, "EXP-0035 is waiting for" both approvers, then "Nothing is written until both approve."
The audit log records **Requested export**, and the activity reads "requested an export". The **Exports** tab shows **Waiting for approval** until both have signed the manifest.
## What the recipient receives [#what-the-recipient-receives]
The case file follows the report, part by part:
| Part | What it holds |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Marking | The marking at the top and bottom of every page, with the designation indicator on the first: **Controlled by**, the office, **CUI category**, **Dissemination** and **POC** |
| Header | **Incident report**, the ID and title, then **Vehicle**, **Run**, **Location**, **Sources**, **Clock**, **Investigator**, **Reviewer** and **Generated** |
| Sources | Each original file by name, with its SHA-256 |
| **1 Finding** | The engineer's paragraph and its level, with who wrote it and when |
| **2 Sequence** | The events in time order, each with its bound, level and evidence reference |
| **3 Evidence** | For each reference: file, location, SHA-256, parser, event ID and the excerpt |
| **4 Limitations** | Missing data, clock uncertainty, latency, scope and manual assumptions |
| **5 Open questions** | Every question still open |
| **6 Next check** | The test or measurement that would confirm or refute the finding |
| Footer | "Generated by Foxborne 1.4.2. Every excerpt can be checked against its SHA-256." |
Without the reviewer's sign-off, every page carries the DRAFT stamp. With coordinates removed, positions are stripped from the case file, and the **Location** line loses the position the console marks **Removed on export**. With copies of the originals, the recipient can check every excerpt: see [Verify a report against the originals](/investigate/verify).
## Coordinates and the redaction policy [#coordinates-and-the-redaction-policy]
Flight logs carry positions, and the **Import files** page says so: "Flight logs contain positions. Exported reports remove coordinates unless the exporter turns them back on."
| Control | Where | What it does |
| -------------------------------- | --------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Remove coordinates on export** | **Settings**, under **Redaction** | The policy: "Positions are removed from exported reports unless the exporter turns them back on." An admin switches it |
| **Remove coordinates** | The export dialog | Starts from the policy. The exporter can turn it off for one export |
| **Before you export** | **Review and history**, on the **Report** tab | Reads "Coordinates are removed on export", or warns "Coordinates will be included on export" |
Switching the policy confirms with **Coordinates will be removed on export** or **Coordinates will be kept on export**. The audit log records **Changed redaction**, with "Coordinates on export: removed" or "Coordinates on export: kept".
Two more redaction settings act earlier, on the vehicle. **Patterns removed from logs** is "Applied on the vehicle before upload", and **Process arguments and environment** reads **Never collected**. See [Retention, holds and redaction](/security/retention).
## Check the result [#check-the-result]
* The toast names the export ID and the manifest SHA-256.
* The incident's **Activity** tab lists the export with your name.
* The **Exports** tab lists it as **Completed**; its drawer shows the manifest, and **Ledger entry** opens the delivery.
* The audit log shows **Exported case file** with the export ID and, under the policy, ", coordinates removed".
## Troubleshoot [#troubleshoot]
**The case file is stamped DRAFT.** The reviewer has not approved the report yet. Export again once the report is approved; see [Write and review a report](/investigate/write-a-report#review-and-approve).
**The button reads Request approval.** You ticked a format other than the PDF, or chose **Removable media**. Untick the extra formats and choose a destination inside the enclave, or fill in the **Reason** and request approval.
**The marking reads No CUI designation.** The banner is set to UNCLASSIFIED in **Settings**. If the incident carries CUI, an admin changes it under **Marking**.
**Before you export warns Coordinates will be included on export.** The redaction policy is off. Tick **Remove coordinates** in the dialog, or ask an admin about the policy.
**You cannot export.** The viewer role has no export permission. Ask an admin for a role with **Export case files**.
## Next [#next]
What the recipient does with the case file.
MCAP, Parquet, BagIt and the other formats, and their approvals.
What a case file claims and what it never does.
The banner and the designation indicator.