Overview

This node operation retrieves detailed information about a specific file stored in a datastore, identified by its Case ID and File ID. It is useful in digital forensics and incident response scenarios where users need to access metadata and attributes of files related to cases for investigation or analysis purposes. For example, a user can fetch file details such as file size, SHA256 hash, original name, tags, and modification history to verify file integrity or gather evidence.

Use Case Examples

1. Fetching metadata of a file linked to a particular case to verify its authenticity.
2. Retrieving file attributes to analyze evidence in a digital forensic investigation.

Properties

Output

JSON

• added_by_user_id - ID of the user who added the file.
• file_case_id - ID of the case associated with the file.
• file_date_added - Date when the file was added to the datastore.
• file_description - Description of the file.
• file_id - Unique identifier of the file.
• file_is_evidence - Boolean indicating if the file is marked as evidence.
• file_is_ioc - Boolean indicating if the file is an Indicator of Compromise (IOC).
• file_original_name - Original name of the file.
• file_parent_id - ID of the parent file if this file is derived from another.
• file_password - Password associated with the file, if any.
• file_sha256 - SHA256 hash of the file for integrity verification.
• file_size - Size of the file in bytes.
• file_tags - Tags associated with the file for categorization.
• file_uuid - UUID of the file.
• modification_history - History of modifications made to the file.

Troubleshooting

• Ensure that both Case ID and File ID are provided and valid; missing or incorrect IDs will cause the node to fail to retrieve file information.
• If the API returns an error, check the API credentials and network connectivity.
• If the 'Return Fields' option is used, ensure the field names are correctly spelled and valid; invalid fields may cause incomplete or failed responses.