DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Datastore File → Update File Info

AI-generated

Overview

This node operation updates information about a file stored in a datastore within the DFIR IRIS system. It allows users to modify file metadata such as description, tags, evidence status, IOC status, file name, password, and even replace the file content with new binary data. This is useful in digital forensic investigations where file attributes need to be updated or corrected after initial ingestion.

Use Case Examples

  1. Updating the description and tags of a file to reflect new findings in a case.
  2. Marking a file as evidence or IOC (Indicator of Compromise) to categorize it appropriately.
  3. Replacing the file content with a new version while preserving its metadata.

Properties

Name Meaning
Case ID The identifier of the case to which the file belongs. Required to specify the context of the file.
File ID The unique identifier of the file to be updated in the datastore. Required to specify which file to update.
Additional Fields Optional fields to update various file attributes such as evidence status, IOC status, description, binary content, original file name, password, and tags.
Options Additional options controlling the output such as whether to return the raw response, which fields to include or exclude in the output.

Output

JSON

  • file_id - The unique identifier of the updated file.
  • file_case_id - The case ID associated with the file.
  • file_description - The updated description of the file.
  • file_is_evidence - Boolean flag indicating if the file is marked as evidence.
  • file_is_ioc - Boolean flag indicating if the file is marked as an Indicator of Compromise.
  • file_original_name - The updated original name of the file.
  • file_password - The password set for the file, if any.
  • file_tags - Tags associated with the file.
  • file_sha256 - SHA256 hash of the file content.
  • file_size - Size of the file in bytes.
  • file_uuid - UUID of the file.
  • added_by_user_id - User ID of the person who added or updated the file.
  • file_date_added - Timestamp when the file was added or updated.
  • file_parent_id - Parent file ID if the file is derived from another file.
  • modification_history - History of modifications made to the file.

Dependencies

  • DFIR IRIS API authentication token or credentials

Troubleshooting

  • Ensure that the Case ID and File ID are correctly specified and exist in the system to avoid 'file not found' errors.
  • If updating binary content, verify that the binary property name matches the input data property containing the file content.
  • Check API authentication credentials if the node fails to connect or update the file.
  • If the response is empty or missing expected fields, verify the 'Return Fields' option and whether 'Exclude' is set correctly.

Discussion