Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Datastore Folder → Get Datastore Tree
AI-generatedOverview
This node operation retrieves the datastore folder tree structure for a specified case ID. It is useful for digital forensics and incident response (DFIR) scenarios where users need to explore and analyze the hierarchical organization of files and folders within a datastore related to a particular case. For example, investigators can use this node to get a full tree view of all files and folders or a simplified flat list of files or folders to streamline their analysis.
Use Case Examples
- Retrieve the full datastore folder tree for case ID 12345 to visualize the entire file structure.
- Get a simplified list of only files from the datastore tree for case ID 67890 to focus on file-level data.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case for which the datastore folder tree is to be retrieved. This is a required numeric input. |
| Options | Additional options to customize the output of the datastore tree retrieval. |
Output
JSON
tree- The hierarchical or simplified structure of the datastore folders and files retrieved for the specified case ID.
Dependencies
- Requires connection to the DFIR IRIS IRP system, typically authenticated via an API key or token.
Troubleshooting
- Ensure the Case ID is valid and exists in the DFIR IRIS system; invalid or missing Case ID will cause errors.
- If 'Return Raw' is false and the output is empty or malformed, check API response and network connectivity.
- When using 'Simplify' option, verify the 'Simplify Type' is correctly set to avoid unexpected empty results.