Overview

This node operation lists evidences related to a specific case in the DFIR IRIS system. It is useful for digital forensic and incident response workflows where users need to retrieve and review evidence data associated with a case. For example, a security analyst can use this node to fetch all evidences linked to a case ID to analyze file hashes, acquisition dates, and other metadata.

Use Case Examples

1. Retrieve all evidences for a given case ID to review file hashes and acquisition dates.
2. Fetch specific fields of evidence data for reporting or further automated processing.

Properties

Output

JSON

• id - Unique identifier of the evidence.
• case_id - Identifier of the case the evidence belongs to.
• acquisition_date - Date when the evidence was acquired.
• chain_of_custody - Chain of custody details for the evidence.
• custom_attributes - Custom attributes associated with the evidence.
• date_added - Date when the evidence was added to the system.
• end_date - End date related to the evidence, if applicable.
• file_description - Description of the evidence file.
• file_hash - Hash value of the evidence file for integrity verification.
• file_size - Size of the evidence file.
• file_uuid - UUID of the evidence file.
• filename - Name of the evidence file.
• modification_history - History of modifications made to the evidence.
• start_date - Start date related to the evidence, if applicable.
• type - Type of the evidence.
• type_id - Identifier for the type of evidence.
• user - User associated with the evidence.
• user_id - Identifier of the user associated with the evidence.

Dependencies

• DFIR IRIS API authentication

Troubleshooting

• Ensure the Case ID is provided and is a valid number; missing or invalid Case ID will cause errors.
• If the API returns an error, check the API authentication credentials and network connectivity.
• If no evidences are returned, verify that the case ID exists and has associated evidences.