> For the complete documentation index, see [llms.txt](https://docs.monolithforensics.com/monolith/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.monolithforensics.com/monolith/using-monolith/settings/evidence-types.md).

# Evidence Types

Evidence Types provide a consistent way to categorize the different kinds of Evidence Items your organization handles in Monolith.

An Evidence Item may represent a physical device, cloud account, email account, storage media, or another source of data. Evidence Types help organize those records into meaningful categories.

Consistent Evidence Types make it easier to filter, report on, and understand the volume and makeup of Evidence across your organization.

### View Evidence Types

The **Evidence Types** settings page displays the Evidence Types currently configured for your organization.

Each Evidence Type also shows the number of Evidence Items currently associated with it.

Use this list to review the categories available when creating or updating Evidence Items.

<figure><img src="/files/gg2df7Ceq4TI5vEnWkKv" alt=""><figcaption><p>View Evidence Types</p></figcaption></figure>

### Create an Evidence Type

To create a new Evidence Type:

1. Select **Create Evidence Type**.
2. Enter the name of the new Evidence Type.
3. Select **Create Evidence Type** to save it.

The new type becomes available when creating or updating Evidence Items throughout Monolith.

Choose names that are clear, recognizable, and meaningful to the people entering and reviewing Evidence.

<figure><img src="/files/ggl6r9cpge11rYMVKHqs" alt=""><figcaption><p>Create Evidence Type</p></figcaption></figure>

### Choosing Evidence Types

Evidence Types should reflect the kinds of sources your organization commonly receives or examines.

Examples might include:

* Smartphone
* Tablet
* Desktop
* Laptop
* Hard Drive
* Removable Media
* Email Account
* Cloud Account
* Virtual Machine
* Network or Cloud Service
* Other organization-specific Evidence categories

The appropriate list will vary by organization.

A law enforcement lab may focus heavily on physical devices, while a corporate, legal, or incident response team may also work with email accounts, cloud environments, SaaS platforms, or other non-physical sources.

### Evidence Types and Reporting

Evidence Type is an important reporting and filtering field.

For example, consistent Evidence Types can help answer questions such as:

* How many mobile devices did we receive this year?
* How many email or cloud accounts are currently being worked?
* What types of Evidence make up most of our workload?
* Which Evidence Types are associated with the largest amount of recorded data?

Keeping Evidence Types clean and consistent makes organization-wide Evidence views and reporting more useful.

See [**Evidence Items**](/monolith/using-monolith/evidence-management/evidence-items.md) for more information about the global Evidence table and Evidence metadata.

### Delete an Evidence Type

Evidence Types can be deleted when they are no longer needed.

<figure><img src="/files/RgHRVjiRJOFBJn8NBfJ5" alt=""><figcaption><p>Delete Evidence Type</p></figcaption></figure>

If Evidence Items are currently associated with the Evidence Type being deleted, those items must be reassigned to another existing Evidence Type before deletion can be completed.

{% hint style="warning" %}
Review the Evidence Items associated with an Evidence Type before deleting it. Existing Evidence Items must be reassigned so their categorization is preserved.
{% endhint %}

### Recommended Practices

* Create Evidence Types that represent meaningful categories of devices, accounts, or data sources.
* Keep naming consistent across the organization.
* Avoid duplicate or nearly identical types.
* Use broad enough categories to support useful long-term reporting.
* Add new Evidence Types when your organization begins handling a genuinely different class of Evidence.
* Review unused or outdated Evidence Types periodically.
* Consider how Evidence Types will appear in filters, exports, dashboards, and reports.

### Related Documentation

* [**Evidence Items**](/monolith/using-monolith/evidence-management/evidence-items.md)
* [**Evidence Progress**](/monolith/using-monolith/settings/evidence-progress.md)
* [**Query Filter**](/monolith/using-monolith/monolith-ui-features/query-filter.md)
* [**Cases**](/monolith/using-monolith/case-management/cases.md)