Entities
Entities represent the people, organizations, and government bodies involved in your cases. They serve as the legal owners and custodians of evidence items, enabling proper chain-of-custody tracking.
Entity Types
DFIRe supports four entity types, each representing a different kind of legal entity that may be involved in an investigation or incident:
| Type | Icon | Purpose |
|---|---|---|
| Person | User icon | Individual people such as suspects, witnesses, employees, and custodians |
| Organization | Building icon | Companies, businesses, and private organizations |
| Government | Landmark icon | Government agencies, regulatory bodies, and law enforcement |
| Group | Users icon | Teams, departments, or other organizational units |
Entities are defined globally in Settings > Entities and can be linked to evidence items across multiple cases.
Managing Entities
The Entities page, accessible from the header bar, shows all entities in a searchable directory. Each entity displays the following information:
- Type icon - A visual indicator of the entity type (Person, Organization, Government, or Group)
- Name - The display name of the entity
- Internal notes - Private notes visible only to your team
- Contact info - Contact details associated with the entity
- Linked evidence item count - The number of evidence items linked to this entity across all cases
Use the type dropdown filter to narrow the directory to a specific entity type. Click "+ New Entity" to create a new entity. When creating or editing an entity, the following fields are available:
- Name - The full name of the person, organization, or group
- Type - The entity type (Person, Organization, Government, or Group)
- Internal Notes - Free-text notes for internal reference
- Contact Info - Contact details such as email, phone, or address
Linking Entities to Evidence
When editing an evidence item, you can assign a Legal Owner entity. This establishes a custody relationship between the entity and the evidence item, and the assignment appears in the evidence item detail view.
A single entity can be linked to evidence items across multiple cases, making it easy to track all evidence associated with a particular person or organization. The entity directory shows the total count of items linked to each entity, giving you a quick overview of custody relationships.
Entities are managed system-wide. Changes to an entity's details are reflected everywhere that entity is referenced.
Configuring Entities
Administrators can manage the entity list in Settings > Entities. From the settings page, entities can be created, edited, and deleted.
Deleting an entity will remove it from all linked evidence items. Consider renaming or archiving instead.