Configuration
Evidence types
Evidence types define what an evidence item is and which details are recorded about it. Configure them at Settings → Evidence Types.
What an Evidence Type Defines
An evidence type carries three things:
- A name, shown wherever the item appears.
- An icon, which identifies the type visually in evidence lists and on the item itself.
- Its fields, the type-specific details an investigator fills in when adding an item of this type. A field has a label, a data type, and a required flag. See Playbooks → Custom Fields for the available data types, which are the same here.
Optionally it also carries a list of default runbooks, described below.
Default Evidence Types
DFIRe ships with evidence types covering common physical devices, digital artifacts, and account identities. The full list, with the key fields on each, is in Evidence Tracking → Default Evidence Types. Administrators can edit any of them, or add their own.
Three examples of how the shipped fields are shaped:
Hard Drive Internal
- Serial Number (required)
- Manufacturer
- Capacity
- Interface (SATA, SAS, USB)
- Acquisition Hash (MD5)
Mobile Phone
- IMEI Number (required)
- Make, Model, Type
- Unlock Passcode
- SIM Card Present?
- Secured in Faraday Bag?
Disk Image
- Format (E01, RAW, VHD)
- Segment Size
- Acquisition Hash
- Source Drive Serial
- Verification Status
Creating an Evidence Type
- Go to Settings → Evidence Types
-
Add a new type
Give it a name and pick an icon.
-
Define its fields
Add the details investigators should record for this type, such as a serial number for hardware or a capture duration for a network capture. Mark a field required when an item of this type is not meaningful without it.
-
Attach default runbooks (optional)
Attach one or more runbooks to the evidence type. Whenever an investigator creates a new evidence item of this type, DFIRe automatically attaches copies of the selected runbooks to the item, so standard procedures such as chain-of-custody steps for a hard drive are always present without anyone having to remember them.
Runbooks already attached to items are independent copies. Editing the default-runbook list on an evidence type only affects items created afterwards.