DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Evidence → Get Evidence

AI-generated

Overview

This node retrieves detailed information about a specific piece of evidence within a digital forensics and incident response (DFIR) system. It is useful in scenarios where users need to access metadata and attributes of evidence items related to a case, such as acquisition dates, file details, chain of custody, and user information. For example, investigators can use this node to fetch evidence details by specifying the case ID and evidence ID to support case analysis or reporting.

Use Case Examples

  1. Retrieve evidence details by specifying the case ID and evidence ID to review file metadata and chain of custody information.
  2. Fetch specific fields of an evidence item to integrate with other incident response workflows or reporting tools.

Properties

Name Meaning
Case ID The unique identifier of the case to which the evidence belongs. This is required to scope the evidence retrieval to a specific case.
Evidence Name or ID The identifier or name of the evidence to retrieve. This can be selected from a list or specified using an expression. It is required to specify which evidence item to fetch.
Options Additional options to customize the response, including whether to return the raw response, which fields to include or exclude in the output.

Output

JSON

  • acquisition_date - The date when the evidence was acquired.
  • case - Details of the case associated with the evidence.
  • case_id - The unique identifier of the case.
  • chain_of_custody - Information about the chain of custody for the evidence.
  • custom_attributes - Any custom attributes associated with the evidence.
  • date_added - The date when the evidence was added to the system.
  • end_date - The end date related to the evidence timeline.
  • file_description - Description of the evidence file.
  • file_hash - Hash value of the evidence file for integrity verification.
  • file_size - Size of the evidence file.
  • file_uuid - Unique identifier for the evidence file.
  • filename - Name of the evidence file.
  • id - Unique identifier of the evidence item.
  • modification_history - History of modifications made to the evidence record.
  • start_date - The start date related to the evidence timeline.
  • type - Type of the evidence.
  • type_id - Identifier for the type of evidence.
  • user - User associated with the evidence.
  • user_id - Identifier of the user associated with the evidence.

Troubleshooting

  • Ensure that the Case ID and Evidence ID are correctly specified and exist in the system to avoid errors related to missing or invalid identifiers.
  • If the node returns an unexpected response, try enabling the 'Return Raw' option to inspect the raw API response for debugging.
  • Verify that the fields specified in the 'Return Fields' option are valid and correctly formatted to prevent errors in the output.

Discussion