Entities

Entity Types

DFIRe supports five entity types, each representing a different kind of legal entity that may be involved in an investigation or incident:

Type	Icon	Purpose
Person	User icon	Individual people such as suspects, witnesses, employees, and custodians
Organization	Building icon	Companies, businesses, and private organizations
Government	Landmark icon	Government agencies, regulatory bodies, and law enforcement
Team	Users icon	Teams, departments, or other organizational units
Other	Generic icon	Anything that doesn't fit the above categories — vendors, unknown parties, placeholders

Entities are defined globally in Settings > Entities and can be linked to evidence items across multiple cases.

Managing Entities

The Entities page, accessible from the header bar, shows all entities in a searchable directory. Each entity displays the following information:

• Type icon - A visual indicator of the entity type (Person, Organization, Government, Team, or Other)
• Name - The display name of the entity
• Internal notes - Private notes visible only to your team
• Contact info - Contact details associated with the entity
• Linked evidence item count - The number of evidence items linked to this entity across all cases. The count combines both Legal Owner and Primary User relationships (see below).

Use the type dropdown filter to narrow the directory to a specific entity type. Click "+ New Entity" to create a new entity. When creating or editing an entity, the following fields are available:

• Name - The full name of the person, organization, or group
• Type - The entity type (Person, Organization, Government, Team, or Other)
• Internal Notes - Free-text notes for internal reference
• Contact Info - Contact details such as email, phone, or address

Linking Entities to Evidence

An evidence item can reference entities through two distinct roles:

• Legal Owner — the person or organization that legally owns the item (e.g., the company that issued a corporate laptop).
• Primary User — the individual who actually uses the item (e.g., the employee assigned that laptop). Often different from the legal owner.

Both roles appear on the evidence item detail view. The Entities directory's "linked items" count combines both relationships so you can see the total footprint of an entity at a glance.

A single entity can be linked to evidence items across multiple cases, making it easy to track all evidence associated with a particular person or organization.

Custody Transfers

Entities also appear in chain-of-custody transfers on evidence items. When recording a custody transfer (intake, transfer, released, correction), you can identify the from and to parties by picking entities from the directory. This gives you a persistent, audit-log-grade trail of who held each item and when, reusing entity records across cases.

Configuring Entities

Administrators can manage the entity list in Settings > Entities. From the settings page, entities can be created, edited, and deleted.