Case management for digital forensics and incident response
DFIRe keeps cases, evidence with chain of custody, indicators, regulatory deadlines and reports in one place. It runs on your own infrastructure, with no seat limits and no vendor access.
Exhibit 01dashboard-light.webp
Unlimited
users and cases on one licence
15
default playbooks to start from, and no limit on your own
12
enrichment providers, called with your own API keys
90
day trial with every feature included
01How a case runs
Follow one ransomware incident through DFIRe. Most of the team's time goes into three places: the actions, the timeline and the report. All three work from the same case record.
CriticalDeclare
A responder opens the case, or an integration opens it through the API. The playbook for the case type adds its fields and the actions for each phase, and the incident clock starts.
Incident response
ActionsRespond
The playbook fills the Actions tab with the response steps for each phase. Start from one of the fifteen default playbooks, edit it, or build your own.
Ransomware Attack - LockBit 3.0 Encrypts Finance File Shares
EvidenceCollect
Add each item with its type, location and attributes, in a hierarchy that shows what came from where. DFIRe encrypts files with AES-256 under keys per case and per item, and hashes every custody handover into a chain.
Evidence Try the custody chain
IntelEnrich
Indicators go into a registry shared across cases, so a second sighting shows at once. Enrichment runs with your own keys for VirusTotal, AbuseIPDB, GreyNoise, Shodan and eight more providers.
Indicators of compromise
TimelineRecord
DFIRe records evidence, indicators, phase changes and completed actions on the timeline as they happen. Add entries for what happened outside DFIRe, and hide the ones that do not belong in the report.
TimelineDeadlineNotify
Start a timer for each notification you owe, such as the 72 hours GDPR gives you to notify the data protection authority. The case shows the time left, and a reminder goes out while it still matters.
Compliance timers
ReportClose
DFIRe generates the title page, the timeline, the indicators and the evidence inventory from the case. Each written section goes through QA on its own, and an LLM you choose can draft a section if you switch it on.
ReportsRansomware Attack - LockBit 3.0 Encrypts Finance File Shares
Executive summaryMarkdown
On 20 August 2026 at 16:36 UTC the finance department reported encrypted file shares and a LockBit 3.0 ransom note. The response team isolated the affected network segments within the hour and preserved the patient zero workstation for imaging.
02Chain of custody
DFIRe hashes every custody entry together with the one before it. Change one field and every hash after it changes, so an alteration shows instead of passing silently.
CASE-2026-5897 · Custody · demo data
Waiting for the chain to load.
03Capabilities
All features are included in one licence. Click the parts below to see their documentation.
Keep indicators on the case and in a registry across cases, so a second sighting is obvious. Enrich them with your own keys, then publish to your threat intelligence platform over TAXII 2.1 or as a MISP feed.
Indicators of compromiseSet timers for GDPR, NIS2, DORA, HIPAA, SEC and your own rules, and get a reminder before time runs out.
Compliance timersDFIRe encrypts attachments up to 4 GB with AES-256-GCM, under separate tenant, case and item keys.
StorageYou define the sections. DFIRe generates the inventories and timelines, and QA keeps a second reader in the loop.
ReportsDFIRe writes every action to the audit log before the action completes. If that write fails, the action does not happen.
Audit logCoordinate in Slack and sync with Jira Cloud both ways. The REST API is open to your integrations, so external systems can create cases, indicators, evidence items and other records in DFIRe.
IntegrationsSign in over OIDC, build roles capability by capability, and scope access to each case team.
Users and roles04Security
Your security team will review DFIRe before it reaches production. The answers are in the documentation, and every release carries its own evidence.
DFIRe runs on Docker Compose on your hosts, with your PostgreSQL and your storage. The vendor has no access to your instance.
DeploymentThe standard licence checks in with the DFIRe licence server. Convert it to an offline licence to run DFIRe in an air-gapped network.
Air-gapped installsAES-256-GCM protects attachments and backups. Stored credentials use a key separate from the file keys.
Application securityAn action without an audit record does not happen. Forward the log to your SIEM and keep it under your own retention.
Audit logSign in over OIDC, use TOTP for password accounts, and compare roles side by side.
Single sign-onDFIRe pins its dependencies and adopts no version younger than 14 days. Each release ships an SBOM and build provenance for both images.
Supply chain$ curl -fsSL https://dfire.fi/release/x.x.x/SHA256SUMS Loading the checksums of the current release.
Each release publishes checksums, SBOMs and build provenance next to its Compose bundle. The installer verifies the bundle against these checksums.
05Install
The installer downloads a release-pinned, verified Compose bundle, generates the secrets and the configuration, and starts the services.
curl -fsSL https://dfire.fi/install.sh -o install.shchmod +x install.sh && ./install.shThe script walks through the configuration and starts DFIRe. Production binds to localhost, behind your own HTTPS reverse proxy. Plain HTTP on port 8080 is an explicit choice for evaluation.
The quick start covers first sign-in and your first case. Air-gapped and custom deployments start from the deployment guide.
06Pricing
The price does not change with seat count, company size or the features you use.
Free
Granted case by case
9,900EUR / year
VAT 0%, added per EU rules
Let's talk
Smaller team or tighter budget
Questions
Anything else, ask us. We answer by email, usually within two working days.
One production installation of DFIRe, with unlimited users, unlimited cases and every feature.
Every installation starts with a 90-day trial. Install DFIRe, run real cases with your team, and buy a licence by invoice or by card when you decide to keep it.
Yes, with an offline licence. By default, DFIRe checks its licence online and needs to reach the DFIRe licence server. An offline licence removes that connection. The deployment guide covers installing without internet access.
On your own infrastructure. DFIRe is self-hosted only, you choose the database and the storage backends, and the vendor has no access to your instance.
Individuals, students, educators, small charities and volunteer efforts doing non-commercial work can ask. We grant them case by case. Read the details.
Yes. A four-hour live online workshop for analysts, and a shorter one for administrators. See the curriculum and prices.
Install it on your own hardware and run a real case this week. There are no seat counts to declare, and no case data leaves your network.