> For the complete documentation index, see [llms.txt](https://docs.monolithforensics.com/monolith/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.monolithforensics.com/monolith/using-monolith/evidence-management/evidence-items.md). # Evidence Items Create, track, and manage the devices, data sources, accounts, media, and other evidence associated with Monolith cases. Evidence Items represent the devices, data sources, accounts, media, and other items associated with forensic work in Monolith. An Evidence Item might represent a mobile phone, computer, hard drive, email account, cloud account, removable media, or another physical or logical source of data. Every Evidence Item belongs to a Case. Once created, the Evidence Item becomes the central record for tracking information about that source and the work performed against it. Evidence can connect to: * Structured item metadata * Contacts * Intake information * Chain of custody * Physical location * Assigned users * Progress and status * Acquisitions * Storage items * Child evidence * Photos * Notes * Audits * Reporting Keeping this information together provides a consistent historical record of the item throughout its lifecycle. ### Evidence in the Monolith Workflow Evidence is often one of the first records created after a Case. A common workflow looks like: ``` Case ↓ Evidence Item ↓ Intake / Chain of Custody ↓ Acquisition ↓ Analysis / Forensic Work ↓ Reporting ``` An individual Case may contain many Evidence Items, and each item can move through its own workflow independently. For example, one device may be awaiting legal authority while another device in the same Case is being acquired and a third is already in analysis. Monolith tracks those Evidence Items individually while keeping all of them associated with the same Case. ### Global Evidence Items and Case Evidence There are two common ways to work with Evidence Items in Monolith.
#### Evidence Management > Evidence Items The **Evidence Items** page provides an organization-wide view of evidence across Monolith. Use this view to: * Search for evidence across Cases * Filter and sort Evidence Items * Review evidence across the organization * View Evidence Items associated with your Cases * Add an Evidence Item when you already know which Case it belongs to Because this view is not scoped to a single Case, Monolith requires you to select the appropriate Case when creating an Evidence Item here. The **My Cases** option can be used to focus the list on Evidence Items belonging to Cases associated with the current user. #### Case > Evidence When you are already working inside a Case, use the Case's **Evidence** tab to work with the Evidence Items associated with that Case. Creating evidence from within a Case keeps the workflow focused on the Case you are already working in. Both views work with the same underlying Evidence Items. The difference is simply your frame of reference. ### Ways Evidence Can Enter Monolith Evidence does not always need to be entered manually from scratch. Depending on your workflow, Evidence Items can originate from several places. #### Manual Entry Create an Evidence Item directly from: * **Case > Evidence** * **Evidence Management > Evidence Items** #### Relay Requests Evidence information submitted through **Relay** can flow into a Monolith Inquiry. When the Inquiry is used to create a new Case or merged into an existing Case, selected evidence information can carry forward into Evidence Items without requiring your team to re-enter the requestor's information. See [**Managing Relay Requests in Monolith**](/monolith/relay-request-portal/relay-overview/managing-relay-requests-in-monolith.md) for more information. #### Monolith Mobile Monolith Mobile can be used during intake or field work to create Evidence Items, capture evidence information, and photograph items directly from a phone or tablet. This creates the same underlying Evidence Item used throughout Monolith. See [**Monolith Mobile**](/monolith/start-here/welcome-to-monolith/monolith-mobile.md) for additional mobile workflows. #### Smart Paste If evidence information already exists in text that you can copy to your clipboard, **Smart Paste** can help populate the Evidence form. Copy the available item information, open the Evidence creation form, and use **Smart Paste** to populate supported evidence details. Review the populated information before creating the Evidence Item. Smart Paste focuses on Evidence details and does not populate chain of custody information or the Linked Contact. ### Create an Evidence Item
To create an Evidence Item from the organization-wide Evidence Items page: 1. Navigate to [**Evidence Management**](/monolith/using-monolith/evidence-management.md) **> Evidence Items**. 2. Click **Add Evidence**. 3. Select the **Case** the Evidence Item belongs to. 4. Enter or review the Evidence Number. 5. Select an **Evidence Type**. 6. Enter the available information about the item. 7. Complete any applicable Custom Fields. 8. Enter Intake Details now, or complete intake later. 9. Click **Create Evidence**. When creating Evidence from within a Case, the Evidence Item is created in the context of that Case. ### Capture Useful Evidence Information The Evidence form is designed to capture structured information that helps identify, track, search, report on, and work with the item throughout its lifecycle. Depending on the item, useful information may include: * Evidence Type * Item Brand or Provider * Item Name * Model Number or Service * Unique Identifier * Size * Priority * Description * Linked Contact * Custom Fields Capture the information that is available and relevant to your workflow. More complete records improve the usefulness of Monolith for searching, filtering, reporting, historical review, and operational visibility. #### Linked Contacts Evidence can be associated with a [Contact](/monolith/using-monolith/people/contacts.md). This is useful when a device, account, or other item has a meaningful relationship to a person involved in the Case, such as a device owner, custodian, employee, suspect, or other relevant contact. Linking the Contact preserves that relationship as part of the Evidence record. ### Evidence Types Evidence Types classify the kinds of devices, data sources, and other items handled by your organization. Examples might include: * Mobile Phone * Computer * Hard Drive * Removable Media * Email Account * Cloud Account Configure [Evidence Types](/monolith/using-monolith/settings/evidence-types.md) that reflect the work your organization actually performs. Consistent Evidence Types make it easier to understand and report on your workload over time. For example, an organization can distinguish between the number of mobile phones, hard drives, cloud accounts, email accounts, or other sources processed during a given period. #### Intake and Chain of Custody Creating an Evidence Item and formally intaking it do not have to happen at the same time. The **Intake Details** section allows you to begin Chain of Custody tracking when the item is received. Intake information can include: * Received By * Received From * Signatures * Intake Timestamp * Location Received * Notes **Received By** identifies the structured destination receiving the item. This can be either: * A Monolith user * A configured physical Location The selector is searchable, so you can search for a person such as `Matt Danner` or a physical destination such as `Shelf A` or `Locker B`. The selected **Received By** destination establishes the item's Current Location and Location Path when intake begins. **Received From** is free text and can identify the person, organization, agency, shipment, tracking number, or other source from which the Evidence was received. **Location Received** is also free text. Use it to capture contextual information about where the item physically arrived, such as: ``` Mail Room Front Office Shipping Department ``` Location Received is separate from the structured Item Locations system. For example, an intake record might contain: ``` Received By: Locker B Received From: FED EX TRACKING NUMBER 1421342 Location Received: Mail Room ``` In this example: * `Locker B` is the structured destination used for Current Location. * `FED EX TRACKING NUMBER 1421342` records the source of the Evidence. * `Mail Room` provides additional context about where the item physically arrived. Once Chain of Custody begins, Monolith can track the item's Current Location as it moves between users and configured physical Locations. {% hint style="info" %} **Location Received** does not determine the item's Current Location. The structured user or Location selected in **Received By** establishes the initial Current Location and Location Path. {% endhint %} Intake does not need to be completed during initial Evidence creation. For workflows involving multiple Evidence Items, your team may choose to create the records first and then use bulk Chain of Custody actions to intake or move multiple items together. See [**Item Locations**](/monolith/using-monolith/evidence-management/item-locations.md) for information about configuring users and physical Locations used during these workflows. ### Status, Progress, and Assignment Monolith provides several independent ways to describe what is happening with an Evidence Item. These fields answer different questions. #### Status **Status** represents the current state or condition of the Evidence Item. Evidence Status uses a standardized set of options in Monolith rather than a customer-defined workflow. #### Progress **Progress** represents where the Evidence Item currently sits in your organization's workflow or pipeline. Evidence Progress is configurable so organizations can define stages that reflect how their lab operates. A pipeline might include stages such as: ``` Pending Authority → Intake → Acquisition → Analysis → Complete ``` The exact pipeline depends on your organization's process. Evidence Progress is intentionally independent from Case Progress. A Case may contain several Evidence Items at completely different stages of work. #### Assigned User An Evidence Item can be assigned to one user associated with the Case. Assignment answers a different question from Status or Progress: * **Status:** What state is the item in? * **Progress:** Where is it in the workflow? * **Assigned User:** Who is responsible for it? Keeping these concepts separate provides more useful operational visibility than trying to represent all three with a single field. ### Understanding the Evidence Record Open an Evidence Item to view its complete record.
The Evidence Overview brings together identifying information, workflow information, location information, and related activity. Depending on the Evidence Item and your configuration, information may include: * Evidence Number * Case * Evidence Type * Item Name * Brand or Provider * Model Number * Unique Identifier * Assigned User * Priority * Status * Progress * Intake information * Current Location * Location Path * Linked Contact * Size * Custom Fields * Acquisition information * Parent or Child relationships * Photo information * Audit information The Evidence record also provides access to several related workflows. #### Chain of Custody The **Chain of Custody** area maintains custody and location history for the Evidence Item. As Evidence moves between Monolith users and configured physical Locations, Chain of Custody preserves the historical movement while Monolith updates the item's current structured location. Two fields summarize where the Evidence is now: * **Current Location** identifies the current user or physical Location. * **Location Path** provides the full structured path to that destination. For example: ``` Current Location: Locker B2 Location Path: Kentucky Lab / Evidence Cage / Locker B2 ``` If the item later moves to a user: ``` Current Location: Matt Danner Location Path: Kentucky Lab / Exam Table / Matt Danner ``` The Current Location changes, while the Chain of Custody record continues to preserve the previous movement history. This provides both an immediate answer to **where the item is now** and a historical record of **how it got there**. See [**Item Locations**](/monolith/using-monolith/evidence-management/item-locations.md) for more information about configuring physical Locations and user destinations. ### Acquisitions An Evidence Item represents the original source or item being examined. An **Acquisition** represents a forensic collection, extraction, image, or other acquisition performed against that source. One Evidence Item can have multiple Acquisitions. For example: ``` Mobile Phone ├── Initial Logical Acquisition ├── Full File System Acquisition └── Supplemental Acquisition ``` Keeping the source Evidence Item separate from its Acquisitions allows Monolith to preserve both the original evidence record and the individual forensic collections performed against it. ### Storage Items Acquired forensic data often needs to be stored somewhere. Monolith uses **Storage Items** to track the physical or digital storage used to preserve forensic acquisitions. A common relationship is: ``` Evidence Item ↓ Acquisition ↓ Storage Item ``` These are separate records because they represent different parts of the forensic workflow. The Evidence Item represents the source. The Acquisition represents the forensic collection. The Storage Item represents where that collected data is preserved. See [**Storage Items**](/monolith/using-monolith/evidence-management/storage-items.md) for additional information. ### Child Items Evidence can contain other evidence. Use **Child Items** when something associated with or contained within the original evidence needs to become independently tracked evidence. For example, removable media or another component removed from a source item may need its own Evidence record so its location and chain of custody can be tracked separately. The parent and child relationship preserves the connection between those Evidence Items. ### Evidence Photos Photos can be associated directly with an Evidence Item. Use Evidence Photos to document the physical item, identifying information, condition, labels, packaging, or other useful visual information. The Evidence Item's **Photos** tab shows only the item's photos. Other files, like reports or forms, are on the item's **Files** tab. Photos can be uploaded from the **Photos** tab, from the **Files** tab, or captured as part of a mobile workflow using Monolith Mobile. Wherever a photo is added, it shows up on the **Photos** tab. Each photo is also kept in the item's folder under **Evidence Files** in **Case > Files**. Rename, describe, or delete a photo in any of these places, and the change shows up in the others. See [**Evidence Files**](#evidence-files) for how an item's files and photos are organized. {% hint style="info" %} Uploading photos from Monolith Mobile needs the latest version of the app. Older versions show a message asking you to update. {% endhint %} ### Evidence Files Each Evidence Item has its own folder of files, kept by Monolith inside the Case's files. Use Evidence Files to keep everything about an item together: photos, extraction reports, forms, exports, or any other file related to that item. In the Case's **Files** tab, Monolith keeps a folder named **Evidence Files**. It holds one folder per Evidence Item, named by the item's Evidence Number. For example: ``` Files ├── Evidence Files │ ├── 001 │ │ ├── Front of device.jpg │ │ └── Extraction report.pdf │ └── 002 │ └── Back label.jpg └── Your other Case folders and files ``` #### **Working with an Item's Files** The same files show up in three places: * **Case > Files**, inside the item's folder under **Evidence Files** * The Evidence Item's **Files** tab, which shows every file in its folder, including photos * The Evidence Item's **Photos** tab, which shows only the photos Making a change in one place will also make that change in the others. For example, if you rename a photo in Case Files, it'll have the new name on the item's Photos tab too. Files and photos can be renamed, described, downloaded, shared, and deleted from any of these places. {% hint style="warning" %} Deleting a file or photo removes it everywhere it shows up, and it can't be undone. {% endhint %} #### **Adding Files** Add files to an Evidence Item in any of these ways: * Upload any file from the item's **Files** tab * Upload photos from the item's **Photos** tab * Upload into the item's folder under **Evidence Files** in **Case > Files** An Evidence Item's folder appears under **Case -> Files -> Evidence Files** once the item has its first file. #### **What Monolith Manages** Monolith keeps the **Evidence Files** folder and each item's folder in line with the Case's Evidence Items, so some actions are limited there: * The **Evidence Files** folder and the item folders can't be renamed, deleted, or moved. * New folders can't be created inside **Evidence Files**. * Files inside an item's folder can't be moved out of it. Managed folders and files are marked with a small badge on their icon. Hover the badge to see what it means. To remove an item's folder, delete the Evidence Item itself. Deleting an Evidence Item also deletes all of its files. {% hint style="info" %} Don't see an Evidence Item under **Evidence Files**? Its folder appears once the item has a file. Add its first file from the item's **Files** tab. {% endhint %} ### Audit Logs The **Audit Logs** area shows audit activity involving the Evidence Item when the item has been included in a Monolith Audit. This provides a record of the item's participation in inventory and verification workflows. See [**Audits**](/monolith/using-monolith/evidence-management/audits.md) for information about conducting evidence and storage audits. ### Notes Evidence Notes allow information to be documented directly against the Evidence Item rather than only at the Case level. This helps keep item-specific observations, work details, and other information associated with the source they relate to. ### If Evidence Is Created in the Wrong Case Because every Evidence Item belongs to a Case, confirm that the correct Case is selected before creating the item from the global Evidence Items page. Monolith includes an Evidence migration workflow for situations where an Evidence Item has been created in the wrong Case. Review the migration option before deleting and recreating an Evidence Item solely to correct its Case association. {% hint style="warning" %} Deleting Evidence can remove an important part of the Case and its historical record. Confirm that deletion is appropriate before removing an Evidence Item. {% endhint %} ### Recommended Practices For a strong and consistent Evidence workflow: * Create Evidence Items as early as practical once the relevant sources are known. * Use structured Evidence Types that reflect the work your organization performs. * Capture useful identifying information rather than relying only on a description. * Link Contacts when an Evidence Item has a meaningful relationship to a person. * Use your organization's configured Evidence Number format when possible. * Keep Evidence Numbers globally identifiable when your operating procedures allow it. * Use Evidence Progress to represent the item's position in your workflow. * Use Status, Progress, and Assignment for their separate purposes. * Use Chain of Custody when location and custody history are important to the record. * Select the appropriate structured user or Location during intake and movement so Current Location and Location Path remain accurate. * Use **Location Received** for contextual arrival information rather than as a substitute for a structured Item Location. * Track where forensic acquisitions are stored by associating them with the appropriate Storage Item. * Use Child Items when something removed from or associated with Evidence needs its own independent tracking. The goal is to create a record that remains useful not only during the current examination, but also for future searching, reporting, review, and historical reference. ### Related Documentation * [**Evidence Management**](/monolith/using-monolith/evidence-management.md) * [**Item Locations**](/monolith/using-monolith/evidence-management/item-locations.md) * [**Storage Items**](/monolith/using-monolith/evidence-management/storage-items.md) * [**Audits**](/monolith/using-monolith/evidence-management/audits.md) * [**Monolith Mobile**](/monolith/start-here/welcome-to-monolith/monolith-mobile.md) * [**Managing Relay Requests in Monolith**](/monolith/relay-request-portal/relay-overview/managing-relay-requests-in-monolith.md)