DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Evidence → Create Evidence

AI-generated

Overview

This node creates evidence records in the DFIR IRIS system. It is useful for digital forensic and incident response workflows where evidence files need to be uploaded and tracked within a case management system. For example, users can upload files as evidence, specify metadata like file description and type, and link the evidence to a specific case ID.

Use Case Examples

  1. Uploading a binary file as evidence to a case, automatically calculating its hash and file size.
  2. Creating an evidence record by manually specifying file details such as filename, size, and hash.
  3. Adding custom attributes and selecting specific fields to be returned in the response.

Properties

Name Meaning
Case ID The ID of the case to which the evidence belongs. This is a required numeric field.
Get Data From Binary File Whether to read the file data from a binary property. If enabled, the node automatically fills filesize, filename, and calculates the hash (sha256 or sha1).
Binary Property Name The name of the binary property to parse data from when 'Get Data From Binary File' is enabled.
Sha256 Hash Whether to calculate the sha256 hash of the binary data (true) or sha1 hash (false).
Evidence File Name The name of the evidence file. Used when not parsing from binary data.
Evidence File Size The size of the evidence file in bytes. Used when not parsing from binary data.
Evidence File Hash The hash of the evidence file. Used when not parsing from binary data.
Additional Fields Optional additional metadata fields for the evidence such as file description, evidence type, and custom attributes.
Options Additional options for the request such as whether to return the raw response, which fields to include or exclude in the response.

Output

JSON

  • id - Unique identifier of the created evidence.
  • case_id - ID of the case the evidence is linked to.
  • filename - Name of the evidence file.
  • file_size - Size of the evidence file in bytes.
  • file_hash - Hash of the evidence file (sha256 or sha1).
  • file_description - Description of the evidence file.
  • type_id - Type identifier or name of the evidence.
  • custom_attributes - Custom attributes associated with the evidence.
  • date_added - Date when the evidence was added.
  • user_id - ID of the user who added the evidence.

Dependencies

  • An API key credential for authenticating with the DFIR IRIS system.

Troubleshooting

  • Ensure the Case ID is valid and exists in the system to avoid errors related to missing or invalid case references.
  • If parsing binary data, verify the binary property name matches the actual binary data property in the input.
  • Hash calculation errors may occur if the binary data is corrupted or incomplete; verify the integrity of the input data.
  • API errors may occur if required fields are missing or if authentication credentials are invalid or expired.

Discussion