Actions85
- Alert Actions
- Asset Actions
- Case Actions
- Comment Actions
- Datastore File Actions
- Datastore Folder Actions
- Evidence Actions
- IOC Actions
- Manage Metadata Actions
- Module Actions
- Note Actions
- Note Group Actions
- Task Actions
- Timeline Actions
Evidence → Delete Evidence
AI-generatedOverview
This node operation deletes a specific piece of evidence from a case in the DFIR IRIS system. It is useful in digital forensic and incident response workflows where evidence management is required, such as removing outdated or incorrect evidence entries from a case.
Use Case Examples
- Deleting an evidence item by its ID from a case to maintain accurate case records.
- Automating cleanup of evidence entries after case closure or resolution.
Properties
| Name | Meaning |
|---|---|
| Case ID | The unique identifier of the case from which the evidence will be deleted. This is a required numeric input. |
| Evidence Name or ID | The identifier or name of the evidence to delete. This can be selected from a list or specified via an expression. It is required and depends on the Case ID to load options. |
| Return Raw | A boolean option to specify whether to return the raw response from the API call instead of a processed output. |
Output
JSON
success- Indicates whether the evidence deletion was successful.message- Additional information or status message about the deletion operation.
Dependencies
- Requires API authentication to the DFIR IRIS system to perform evidence deletion.
Troubleshooting
- Ensure the Case ID and Evidence ID are valid and exist in the system; invalid IDs will cause errors.
- If the API authentication fails, the node will not be able to delete evidence; verify credentials and permissions.
- If the 'Return Raw' option is enabled, the output may be less user-friendly and require additional parsing.