Acquisitions
Record and manage forensic acquisitions, including source Evidence, collection method, software, storage, hashes, size, and other acquisition details.
Acquisitions record forensic collections, extractions, exports, and other acquired data associated with a Monolith Case.
An Acquisition can be linked to an Evidence Item when the collected data originated from a specific device, account, media item, or other Evidence source. Acquisitions can also be created without an Evidence Item when the work does not need to be associated with a specific Evidence record.
Acquisition information can capture how the data was collected, the software used, its size, hashes, storage location, examiner, duration, and other details needed to document the forensic process.
View Acquisitions
Open a Case and select the Acquisitions tab to view Acquisition records associated with that Case.
The Acquisitions table supports standard Monolith table functionality such as searching, filtering, sorting, column selection, and export.
Available columns include:
Acquisition Name
Case Number
Status
Format
Type
Size
Size (GB)
Created On
Acquire Date
Acquired By
Forensic Software
Software Version
Storage
Hash 1
Hash 1 Algorithm
Hash 2
Hash 2 Algorithm
Duration
Evidence Number
Evidence UUID
Evidence Type
Evidence Provider
Evidence Name
Evidence Model Number
Evidence Unique ID
Evidence Size
Linked Contact
Description
Location Path
Acquisition Custom Fields
Use the column selector to display the information that is most useful for your workflow.
Create an Acquisition
Select New Acquisition from the Case Acquisitions tab.
Only the Acquisition Name is required to create an Acquisition. Additional fields can be used to document the source, method, output, storage, and other details of the acquisition.
Available information includes:
Evidence
Acquisition Name
Format
Type
Software
Software Version
Size and Unit
Storage Items
Hash values and algorithms
Acquire Date
Duration
Acquired By
Linked Contact
Notes
Acquisition Custom Fields
Link an Acquisition to Evidence
An Acquisition can optionally be associated with an Evidence Item from the Case.
This creates a relationship between the original Evidence source and the data acquired from it.
For example:
An Acquisition can be associated with one Evidence Item.
Evidence is not required. This allows users to document acquisitions that do not originate from a specific Evidence Item or where creating an Evidence relationship is not appropriate for the workflow.
After an Acquisition is associated with Evidence, information from the Evidence Item can also be displayed in the Acquisitions table, including its Evidence Number, UUID, Type, provider or manufacturer, name, model, unique identifier, and size.
See Evidence Items for more information about managing Evidence.
Acquisition Type
Type describes the method or nature of the acquisition.
Examples may include:
Advanced Logical
After First Unlock
Before First Unlock
Chip-off
Cloud
File System
Full File System
JTAG
Logical
Manual
Memory
Network
Other
Physical
The available list can be extended when another Acquisition Type is needed.
Type can help distinguish different collection methods while keeping Acquisition records structured for searching, reporting, and analysis.
Acquisition Format
Format identifies the format of the acquired data.
Available formats may include common forensic and general data formats such as:
AD1
AFF4
BIN
DD
DMG
E01
ISO
L01
RAW
TAR
UFD
VHDX
VMDK
XRY
ZIP
Additional formats can be added when needed.
Format and Type describe different parts of the Acquisition. For example, a physical acquisition may produce an E01 or RAW image, while a logical acquisition may result in another supported format.
Forensic Software
Use Software and Software Version to record the tool used to perform the acquisition.
The Software selector uses software recorded under Lab Management > Forensic Software, helping teams consistently identify tools used during forensic work.
A software value can also be added when the required tool is not already available in the configured list.
Recording the software and version can provide useful context for reporting, review, quality assurance, and future examination of the Case.
Acquisition Size
Use Size and Unit to record the amount of data produced by the acquisition.
Acquisition size contributes to Monolith's Acquisition data totals and can be used in Analytics and reporting to understand collected data volume.
The Acquisitions table can display both the entered Size and a normalized Size (GB) value.
See Reports for additional information about Acquisition reporting and analytics.
Storage Items
An Acquisition can be associated with Storage Items to identify where the acquired data is stored.
Multiple Storage Items can be selected during Acquisition creation.
This can be useful when the same acquired data is maintained on multiple storage destinations.
See the Storage documentation for information about managing Storage Items and their relationship to Casework.
Acquire Date and Duration
Use Acquire Date to record when the acquisition occurred.
The Acquisition form also supports Duration Hours and Duration Minutes for recording how long the acquisition took.
These fields provide additional context about when the work was performed and the time required to complete it.
Acquired By
Use Acquired By to identify the Monolith user who performed or is responsible for the acquisition.
Recording the examiner or user responsible for an Acquisition helps preserve attribution as part of the Case record.
Linked Contact
An Acquisition can optionally be associated with a Contact.
This can be useful when the acquired data relates to a particular person, custodian, account holder, device owner, or other Contact associated with the Case.
See Contacts for more information.
Hashes
Acquisitions can record up to two hash values and their corresponding algorithms.
Available fields include:
Hash 1
Hash 1 Algorithm
Hash 2
Hash 2 Algorithm
Use these fields when hash values are available and should be retained with the Acquisition record.
Notes
Use the Acquisition Notes field to record additional information about the collection that does not fit into the structured Acquisition fields.
This may include relevant collection context, processing information, exceptions, or other details useful for future review.
Acquisition Custom Fields
Organizations can configure Custom Acquisition Fields to capture additional structured information required by their workflow.
Custom Fields appear in the Acquisition form alongside the standard Acquisition information.
This can be useful when an organization needs to collect information beyond Monolith's standard Acquisition fields while maintaining consistent structured records.
See Custom Fields for configuration guidance.
Review and Edit an Acquisition
Select an Acquisition from the table to open its details.
The Acquisition Details panel provides a consolidated view of the Acquisition and related information, including:
Acquisition details
Case information
Acquisition Status
Format and Type
Size
Acquisition date
Acquired By
Forensic Software and version
Storage
Hashes
Duration
Related Evidence information
Linked Contact
Location Path
Custom Fields
From the Acquisition Details panel, users can also Copy, Edit, or Delete the Acquisition when appropriate.
Import Acquisitions From CSV
Acquisitions can also be added in bulk using the Import from CSV option available from the Actions menu on the Acquisitions tab.
This can be useful when Acquisition records already exist in another system or when a larger set of Acquisition information needs to be added to a Case.
Review imported records after the import to confirm that Acquisition information and relationships were created as expected.
Acquisitions in Analytics
Acquisition records contribute to Monolith's operational reporting and Analytics.
Acquisition reporting can be used to review information such as:
Number of Acquisitions
Total acquired data
Acquisition Types
Acquisition Formats
Software used
Acquired By
Acquisition activity over time
Because Acquisition size contributes to collected-data metrics, consistently recording Acquisition size can improve the usefulness of these reports.
See Reports for additional reporting guidance.
Acquisitions API
Organizations can also work with Acquisition information programmatically through the Monolith API.
The Acquisitions API can support integrations, automation, data synchronization, or external workflows that need to interact with Monolith Acquisition records.
See Acquisitions API for supported endpoints and implementation details.
Recommended Practices
Create an Acquisition for forensic collections, extractions, exports, or other acquired data that should remain part of the Case record.
Link the Acquisition to an Evidence Item when the collected data originated from a specific Evidence source.
Use Type and Format consistently to keep Acquisition records easy to search and report on.
Record the forensic software and version used when applicable.
Record Acquisition size when known so collected-data metrics remain useful.
Associate Storage Items when Monolith should track where the acquired data is maintained.
Record hashes when they are available and useful to the forensic workflow.
Identify the user who performed the Acquisition when examiner attribution is important.
Use Custom Fields for additional structured Acquisition information specific to your organization.
Acquisitions Extended Walkthrough
A recorded Monolith Mondays session covering the full acquisitions workflow, including the topics described above.
Related Documentation
Last updated
Was this helpful?