DFIR IRIS icon

DFIR IRIS

works with DFIR IRIS IRP

Actions85

Evidence → Update Evidence

AI-generated

Overview

This node updates an existing piece of evidence within a case in the DFIR IRIS system. It is useful for digital forensic investigators or incident responders who need to modify evidence metadata or replace evidence files during an investigation. For example, users can update the file name, size, hash, description, type, or add custom attributes to an evidence item associated with a specific case.

Use Case Examples

  1. Updating the metadata of an evidence file to correct its description or type.
  2. Replacing an evidence file by uploading new binary data and automatically calculating its hash.
  3. Adding custom attributes to an evidence item to include additional context or notes.

Properties

Name Meaning
Case ID The unique identifier of the case to which the evidence belongs. This is required to specify the context of the evidence being updated.
Evidence Name or ID The identifier or name of the evidence to update. Users can select from a list or specify an ID using an expression. This is required to identify the specific evidence item.
Get Data From Binary File A boolean flag indicating whether to read the evidence file data from a binary property. If enabled, the node automatically fills in the file size, file name, and calculates the file hash (SHA256 or SHA1).
Binary Property Name The name of the binary property from which to parse the file data when 'Get Data From Binary File' is enabled.
Sha256 Hash A boolean flag to choose whether to calculate the SHA256 hash (true) or SHA1 hash (false) of the binary data when parsing from a binary file.
Evidence File Name The name of the evidence file. This is used when not parsing from binary data.
Evidence File Size The size of the evidence file in bytes. This is used when not parsing from binary data.
Evidence File Hash The hash of the evidence file. This is used when not parsing from binary data.
Additional Fields A collection of optional fields to provide extra information about the evidence, such as file description, evidence type, and custom attributes.
Options Additional options to control the output, such as returning the raw response, specifying which fields to include or exclude in the output.

Output

JSON

  • id - Unique identifier of the updated evidence.
  • case_id - Identifier of the case to which the evidence belongs.
  • filename - Name of the evidence file.
  • file_size - Size of the evidence file in bytes.
  • file_hash - Hash of the evidence file (SHA256 or SHA1).
  • file_description - Description of the evidence file.
  • type_id - Identifier of the evidence type.
  • custom_attributes - Custom attributes associated with the evidence.
  • acquisition_date - Date when the evidence was acquired.
  • start_date - Start date related to the evidence.
  • end_date - End date related to the evidence.
  • chain_of_custody - Chain of custody information for the evidence.
  • modification_history - History of modifications made to the evidence.
  • user_id - Identifier of the user who last modified the evidence.

Dependencies

  • An API key credential for authenticating with the DFIR IRIS system.

Troubleshooting

  • Ensure the Case ID and Evidence ID are correct and exist in the system to avoid 'not found' errors.
  • If using binary data parsing, verify the binary property name matches the input data and that the data is properly formatted.
  • Check that the hash calculation method (SHA256 or SHA1) matches the expected format for the system.
  • If the API returns errors, enable the 'Return Raw' option to inspect the full response for debugging.

Discussion