Entities

Entity Types

DFIRe supports five entity types, each representing a different kind of legal entity that may be involved in an investigation or incident:

Type	Icon	Purpose
Person	User icon	Individual people such as suspects, witnesses, employees, and custodians
Organization	Building icon	Companies, businesses, and private organizations
Government	Globe icon	Government agencies, regulatory bodies, and law enforcement
Team	Users icon	Teams, departments, or other organizational units
Other	Generic icon	Anything that doesn't fit the above categories. Vendors, unknown parties, placeholders

Entities are defined once and can be linked to evidence items across multiple cases.

Managing Entities

The Entities page, accessible from the header bar, lists every entity in a table. By default the table shows Name, Type, Notes, Items and Updated. Items is the number of times evidence names the entity as Legal Owner or Primary User (see below). Use Columns above the table to show Contact, Address and Created, or to hide a column. Your browser remembers the columns you choose. Long notes, contact details and addresses are cut to fit. Point at one to read all of it.

Click a column header to sort by that column, and click it again to reverse the order. The table opens sorted by name. The count above the table shows how many entities there are. While you search or filter, it shows how many of them match, for example 2 of 12 entities.

Search entities finds an entity by its name, notes or contact details. Filter narrows the directory by Name, Type, Notes, Contact, Address, Created or Updated, for example Type equals Person. Each filter shows under the toolbar. Click a filter to change it, or Clear filters to remove them all. A reload or a shared link keeps the search and the filters.

Click an entity's name or row to open it. To open an entity in a new tab, middle-click its name. New Entity and the delete button appear only if your role allows you to add or delete entities. If the list cannot load, the page shows an error.

Click New Entity to create a new entity. When creating or editing an entity, the following fields are available:

• Name - The full name of the person, organization, or group
• Type - The entity type (Person, Organization, Government, Team, or Other)
• Internal Notes - Free-text notes for internal reference
• Contact Info - Contact details such as email or phone
• Physical Address - A postal or site address

Linking Entities to Evidence

An evidence item can reference entities through two distinct roles:

• Legal Owner. The person or organization that legally owns the item (e.g., the company that issued a corporate laptop).
• Primary User. The individual who actually uses the item (e.g., the employee assigned that laptop). Often different from the legal owner.

Both roles appear on the evidence item detail view. The Items count in the Entities directory combines both relationships so you can see the total footprint of an entity at a glance.

A single entity can be linked to evidence items across multiple cases, making it easy to track all evidence associated with a particular person or organization.

Custody Transfers

Entities also appear in chain-of-custody transfers on evidence items. When recording a custody transfer (intake, transfer, released, correction), you can identify the from and to parties by picking entities from the directory. This gives you a persistent, audit-log-grade trail of who held each item and when, reusing entity records across cases.

Configuring Entities

The entity list is managed from the Entities page in the header bar, where entities can be created, edited, and deleted. It is not part of Settings.