Register Evidence
register_evidenceAdd a new evidence file to a forensic case, compute its SHA-256 hash, and store metadata while leaving the original file unchanged.
Instructions
Register a new piece of evidence in a forensic case.
Computes SHA-256 hash of the file and stores metadata. The original file is never modified or copied.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute path to the evidence file. | |
| case_id | Yes | Case number (e.g. "CASE-2026-001") or UUID. | |
| evidence_type | No | Type of evidence — one of: disk_image, memory_dump, logs, triage_archive, pcap, other. | other |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||