{ "techniques": { "DFT-1001": { "id": "DFT-1001", "name": "Triage devices or media", "description": "Digital forensic triage is a partial forensic examination conducted under (significant) time and resource constraints [DFCite-1115].", "synonyms": [], "details": "Involves the ranking of apprehended digital items in terms of their importance to a case and likelihood that they contain the data required [DFCite-1131]. It can involve multiple techniques to identify devices of most interest such as keyword searching, hash matching, media review etc.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1001", "DFW-1002", "DFW-1003" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/DeviceSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/PrioritizedDeviceSet" ], "references": [ { "DFCite_id": "DFCite-1115", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1131", "relevance_summary_280": "" } ] }, "DFT-1002": { "id": "DFT-1002", "name": "Copy sectors from storage media", "description": "Copying of sectors from a storage media, typically LBA~0~ to LBA~max~ to a bitstream that can be stored in a image format (DFT-1025).", "synonyms": [ "disk imaging" ], "details": "The process could be applied to a traditional hard disk, SSD, USB stick, or data from an eMMC chip that has been desoldered and placed in a reader. This data needs to be stored as a container file (DFT-1025). Logs would also usually be created recording the details of the imaging process and any errors that occured.", "subtechniques": [], "examples": [ "dcfldd", "FTK Imager", "Magnet ACQUIRE" ], "weaknesses": [ "DFW-1004", "DFW-1006", "DFW-1007", "DFW-1013", "DFW-1014", "DFW-1015", "DFW-1016", "DFW-1136", "DFW-1143", "DFW-1278" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface", "https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/Bitstream" ], "references": [ { "DFCite_id": "DFCite-1107", "relevance_summary_280": "" } ] }, "DFT-1003": { "id": "DFT-1003", "name": "Copy pages from physical memory", "description": "Involves creating a copy of the live memory data of a running system", "synonyms": [ "Memory imaging", "RAM dump", "RAM imaging", "memory dump" ], "details": "Collection of Pagefile may also be useful (Kornblum 2007).", "subtechniques": [], "examples": [ "FTK Imager" ], "weaknesses": [ "DFW-1029", "DFW-1030", "DFW-1031", "DFW-1032", "DFW-1033" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Memory" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/Bitstream" ], "references": [ { "DFCite_id": "DFCite-1025", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1085", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1084", "relevance_summary_280": "" } ] }, "DFT-1004": { "id": "DFT-1004", "name": "Collect logical files selectively", "description": "Views a set of files (typically via direct access from previewing) and acquires a subset of them.", "synonyms": [ "Logical imaging", "Logical acquisition" ], "details": "This selection of files would subsequently be stored into a container such as a tar/zip file or a forensic image format.", "subtechniques": [ "DFT-1015" ], "examples": [ "FTK Imager - allows an AD1 logical container to be created of a selected subset of files within a previewed data source." ], "weaknesses": [ "DFW-1017", "DFW-1018", "DFW-1019", "DFW-1020", "DFW-1021", "DFW-1022", "DFW-1023", "DFW-1024" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FilteredFileSet" ], "references": [] }, "DFT-1005": { "id": "DFT-1005", "name": "Search a crime scene for relevant physical evidence", "description": "The process of 'carefully documenting the conditions at a crime scene and identifying all relevant physical evidence.' (Birzer 2018).", "synonyms": [ "Crime scene investigation", "Crime scene examination", "Crime scene processing", "Incident scene examination", "Scene search" ], "details": "The UK's Forensic Science Regulator (FSR) guidance refers to \"Incident scene examination\" which takes a holistic approach and considers an incident scene in conjunction with the requirements of an investigation and the criminal justice system. The aim of incident scene examination is to identify and locate, or note the absence of, physical material which has relevance and significance to inform the investigation including, where relevant, the reconstruction of past events.\nThe techqniue does not restrict to searching for digital devices as other physical objects may be relevant e.g. contain passwords.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1114" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/DeviceSet", "https://ontology.unifiedcyberontology.org/uco/observable/Device", "https://ontology.unifiedcyberontology.org/uco/observable/location" ], "references": [ { "DFCite_id": "DFCite-1018", "relevance_summary_280": "Provides the definition used in the description of the crime scene search technique." }, { "DFCite_id": "DFCite-1044", "relevance_summary_280": "Provides an expanded definition considering the holistic approach of crime scene examination." } ] }, "DFT-1006": { "id": "DFT-1006", "name": "Search a crime scene using digital sniffer dogs", "description": "The use of canines to locate obscured digital storage devices.", "synonyms": [ "Digital Storage Device Dogs", "Electronic Storage Detection (ESD) sniffing dog", "Storage Detection Police Dogs", "Digital detection dogs", "Digi-dogs" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1005" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/location", "https://ontology.unifiedcyberontology.org/uco/observable/Device" ], "references": [ { "DFCite_id": "DFCite-1114", "relevance_summary_280": "" } ] }, "DFT-1007": { "id": "DFT-1007", "name": "Detect the potential existence of digital devices using a SyncTriage-based approach", "description": "A technique developed in Hargreaves & Marshall (2018) whereby synchronization artifacts on a device are examined and used to identify the existence of a related device. Also sometimes used to infer activity that occurred on an inaccessible or unavailable device. ", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "SyncTriage - https://bitbucket.org/chrishargreaves/synctriage" ], "weaknesses": [ "DFW-1008", "DFW-1009", "DFW-1010", "DFW-1011", "DFW-1012" ], "CASE_input_classes": [], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1057", "relevance_summary_280": "This paper covers the development and first publication of the SyncTriage approach. It provides the architecture, example artifacts, and a tool demonstration." } ] }, "DFT-1008": { "id": "DFT-1008", "name": "Detect the potential existence of digital devices by profiling network traffic", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1009": { "id": "DFT-1009", "name": "Locate potential digital evidence sources via cloud account identifiers", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1010": { "id": "DFT-1010", "name": "Place device in a faraday environment", "description": "Place a device in an environment designed to shield a mobile phone or small digital device from radio waves entering the environment and reaching the device, and to stop radio waves escaping from the environment (adapted from Lennox-Steele & Nisbet (2016))", "synonyms": [], "details": "Environment should block: mobile network, Wi-Fi, and Bluetooth and all other RF.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1115", "DFW-1116", "DFW-1117" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Device" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Device" ], "references": [ { "DFCite_id": "DFCite-1086", "relevance_summary_280": "" } ] }, "DFT-1011": { "id": "DFT-1011", "name": "Store seized devices or media in evidence bags", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Device" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Device", "https://ontology.caseontology.org/case/investigation/exhibitNumber" ], "references": [] }, "DFT-1012": { "id": "DFT-1012", "name": "Write protect storage media using a hardware write blocker", "description": "A hardware write blocking device [should] prevent any change to data in the user area of a hard drive while allowing access to all data on a hard drive. (Lyle 2006)", "synonyms": [], "details": "Note that \"Sometimes it may be desirable to change a drive configuration to obtain access to otherwise hidden sectors, for example, such as within an HPA (host protected area).\" (Lyle 2006) ", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1118", "DFW-1119", "DFW-1120" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/StorageMedium" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface" ], "references": [ { "DFCite_id": "DFCite-1089", "relevance_summary_280": "" } ] }, "DFT-1013": { "id": "DFT-1013", "name": "Write protect storage media using a software write blocker", "description": "Use of a software-based tool that prevents a computer from writing to computer storage media connected to it (NIST 2006)", "synonyms": [], "details": "Note that both read/write and write protected interfaces are specified as input since a software write blocker could be applied to a hardware write protected interface.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface", "https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface" ], "references": [ { "DFCite_id": "DFCite-1102", "relevance_summary_280": "" } ] }, "DFT-1014": { "id": "DFT-1014", "name": "Document the chain of custody", "description": "A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer [DFCite-1147].", "synonyms": [ "CoC", "Continuity of evidence" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.caseontology.org/case/investigation/ProvenanceRecord" ], "CASE_output_classes": [ "https://ontology.caseontology.org/case/investigation/ProvenanceRecord" ], "references": [ { "DFCite_id": "DFCite-1147", "relevance_summary_280": "Contains a definition of 'chain of custody'" } ] }, "DFT-1015": { "id": "DFT-1015", "name": "Collect logical files selectively based on privacy preserving criteria", "description": "Previewing a data source and selecting a subset of the data for collection into a container such as a tar/zip file or a forensic image format for the purposes of protecting the privacy of the complainant or witness.", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "Odyssey - Allows selective storing of data from mobile devices - https://www.bluelightsdigital.com/odyssey", "Cellebrite - Allows filtering by app, data category, and/or by timestamp as to what data is collected.", "XRY - Allows filtering by app, data category, and/or by timestamp as to what data is collected." ], "weaknesses": [ "DFW-1025", "DFW-1026", "DFW-1027", "DFW-1028" ], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1016": { "id": "DFT-1016", "name": "Collect specific pieces of information from a live running device", "description": "Running commands on a live system to collect specific pieces of information e.g. running processes or open ports", "synonyms": [ "Live response data collection", "Volatile data collection" ], "details": "Prior to collecting data from the system, pre-stages are described in (Waits et al 2008) as:\n- Establish trusted command shell\n- Establish method for transmitting and storing the information\n", "subtechniques": [], "examples": [ "pslist", "procdump", "psloggedon", "ipconfig", "netstat" ], "weaknesses": [ "DFW-1034", "DFW-1035", "DFW-1036" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Device" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Process", "https://ontology.unifiedcyberontology.org/uco/observable/NetworkConnection", "https://ontology.unifiedcyberontology.org/uco/observable/IPAddress", "https://ontology.unifiedcyberontology.org/uco/observable/MACAddress", "https://ontology.unifiedcyberontology.org/uco/observable/UserAccount" ], "references": [ { "DFCite_id": "DFCite-1129", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1080", "relevance_summary_280": "" } ] }, "DFT-1017": { "id": "DFT-1017", "name": "Capture network packets", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/NetworkInterface" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/NetworkPacketCapture" ], "references": [] }, "DFT-1018": { "id": "DFT-1018", "name": "Collect data from a remote networked device", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/NetworkConnection" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/ForensicImageContainer", "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "references": [] }, "DFT-1019": { "id": "DFT-1019", "name": "Extract a backup from a mobile device", "description": "Using the in-built backup capability of a device to extract a subset of its contents", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "Use of ADB to generate an Android backup", "Extraction of an iOS backup" ], "weaknesses": [ "DFW-1037", "DFW-1038", "DFW-1039", "DFW-1040", "DFW-1041", "DFW-1270" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/DeviceGeneratedBackup" ], "references": [] }, "DFT-1020": { "id": "DFT-1020", "name": "Extract the file system from a mobile device", "description": "Accessing the file system(s) of the device and extracting a set of files (full or partial depending on level of access)", "synonyms": [ "file system extraction" ], "details": "Note that Fukami et al (2021) states \"In order to conduct effective file system extraction, rooting the device is required.\" See T1040. Usually results in a zip/tar file. Rooting may provide access to the file system, but files may still be encrypted. Attacking the user pin, usually on device, using T1034, or T1035 may be necessary, unless the PIN can be obtained from the device user (T1037)", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1159", "DFW-1160", "DFW-1161", "DFW-1162", "DFW-1163", "DFW-1164" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSystemExtraction" ], "references": [ { "DFCite_id": "DFCite-1031", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1045", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1091", "relevance_summary_280": "" } ] }, "DFT-1021": { "id": "DFT-1021", "name": "Extract artifacts from a configuration file", "description": "Examination of a file that was designed for storing configuration information for a piece of software (e.g. an application or operating system feature)", "synonyms": [ "configuration file examination" ], "details": "", "subtechniques": [], "examples": [ "prefs.js from Firefox" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/configuration/Configuration", "https://ontology.unifiedcyberontology.org/uco/configuration/ConfigurationEntry" ], "references": [] }, "DFT-1022": { "id": "DFT-1022", "name": "Capture mobile device screenshots (manually)", "description": "An examiner directly manipulates the target mobile device using the device's input interface (i.e., keypads and buttons), and records the content shown on the display of the device. (Fukami et al 2021)", "synonyms": [], "details": "This is the manual version of DFT-1163. The device is controlled manually, and screenshots are captured manually.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/DeviceScreenshotCapture" ], "references": [ { "DFCite_id": "DFCite-1045", "relevance_summary_280": "" } ] }, "DFT-1023": { "id": "DFT-1023", "name": "Collect data from cloud service via a live web page using credentials", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Credential", "https://ontology.unifiedcyberontology.org/uco/observable/OnlineService" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile" ], "references": [] }, "DFT-1024": { "id": "DFT-1024", "name": "Collect data from cloud service via submission of request to service provider", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/OnlineService", "https://ontology.unifiedcyberontology.org/uco/observable/accountIdentifier" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile" ], "references": [] }, "DFT-1025": { "id": "DFT-1025", "name": "Store bitstream data in a forensic image format", "description": "Storage of bitstream data recovered from a digital device", "synonyms": [ "store disk image container", "store image file", "write data to a forensic image format", "write data to a disk image container" ], "details": "The storage of bitstream data resulting from disk imaging, in formats such as: EWF, AFF4. The imaged data may be split into several linked container formats. e.g. e01, e02 e03 etc. This technique represents storage of data in container formats, whereas DFT-1178 represents data stored in raw files. ", "subtechniques": [], "examples": [ "2009 M57-Jean - Data is supplied as a ‘multi-volume Expert Witness file’ - i.e. split EnCase E01 & E02 image files (https://digitalcorpora.org/corpora/scenarios/m57-jean/)", "FTK Imager: This tool can be used to acquire data from block devices in various image formats including RAW, EWF, and AFF", "Magnet Acquire: This tool can be used to acquire data from block devices in various image formats including RAW and EWF.", "libewf: This open source library allows access to the EWF format. The accompanying ewftools proves tools to verify, inspect and create EWF images. " ], "weaknesses": [ "DFW-1043" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/Bitstream" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer" ], "references": [] }, "DFT-1026": { "id": "DFT-1026", "name": "Store data in standard archive format", "description": "Storing acquired data in a standard archive format such as rar, tar or zip", "synonyms": [], "details": "This is commonly used with mobile file system extractions, but mobile backups can also sometimes be compressed into an archive.", "subtechniques": [], "examples": [ "ZIP", "RAR", "TAR" ], "weaknesses": [ "DFW-1165", "DFW-1275" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSystemExtraction", "https://ontology.solveit-df.org/solveit/observable/DeviceGeneratedBackup" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile" ], "references": [] }, "DFT-1027": { "id": "DFT-1027", "name": "Read data from a device using JTAG", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1028": { "id": "DFT-1028", "name": "Physically remove a storage chip from a device (chip-off)", "description": "", "synonyms": [ "chip-off" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1029": { "id": "DFT-1029", "name": "Read data from a desoldered eMMC via a chip reader", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/Bitstream" ], "references": [] }, "DFT-1030": { "id": "DFT-1030", "name": "Read data from unmanaged NAND", "description": "", "synonyms": [], "details": "Data read in this way will need decoding to be made accessible, e.g. via DFT-1029", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1031": { "id": "DFT-1031", "name": "Recover encryption/decryption key from memory", "description": "This describes the technique whereby an attempt is made to extract key material from memory, or a memory acquisition of a running system to fascinate the decryption of some data ", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "Bulk Extractor - of the many scanners within bulk extractor, one of which attempts to locate AES keys.", "Volatility - the plug in ‘trucryptmaster’ attempts to recover Truecrypt 7.1a master keys." ], "weaknesses": [ "DFW-1044", "DFW-1045" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/DecryptionKey" ], "references": [ { "DFCite_id": "DFCite-1056", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1054", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1053", "relevance_summary_280": "" } ] }, "DFT-1032": { "id": "DFT-1032", "name": "Recover encryption/decryption key information using side channel attacks", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1033": { "id": "DFT-1033", "name": "Extract credential(s) from an accessible device to attempt access to a more secure device or service", "description": "Accessing a device with limited or no security to obtain a credential (e.g. password, PIN, token) that can be used to access another device or service.", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Credential" ], "references": [] }, "DFT-1034": { "id": "DFT-1034", "name": "Attack a stored credential or device using a brute force approach", "description": "A brute force attack, or exhaustive search is a password cracking approach where every combination of characters is tested until the correct one is found. This method is \"guaranteed to work\" given infinite time and resources which in a real-life scenario is not feasible.", "synonyms": [ "brute force attack", "exhaustive password search" ], "details": "Brute force attack involves trying every possible combination in a defined search space to find the correct value. The search space could be limited to just numbers, for example in the case of a 4-digit PIN number, or alphanumerical values or even the full ASCII character set. The larger the search space, the longer it takes to complete a brute force attack.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1140", "DFW-1141", "DFW-1142" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/password" ], "references": [ { "DFCite_id": "DFCite-1077", "relevance_summary_280": "" } ] }, "DFT-1035": { "id": "DFT-1035", "name": "Attack a stored credential or device using a dictionary-based approach", "description": "A dictionary attack is a password cracking technique where an attacker uses a list of passwords, called a dictionary, to attempt to guess a password.", "synonyms": [ "dictionary attack" ], "details": "Dictionary attacks use list compiled common passwords that are likely to be used by people, such as dictionary words, names, common patterns or existing lists of popular or leaked passwords. Therefore, success depends on the quality and of dictionary list.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1137", "DFW-1138", "DFW-1139" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/password" ], "references": [ { "DFCite_id": "DFCite-1075", "relevance_summary_280": "" } ] }, "DFT-1036": { "id": "DFT-1036", "name": "Recover information about a potential device PIN or pattern lock using a smudge attack", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/UnlockPattern" ], "references": [] }, "DFT-1037": { "id": "DFT-1037", "name": "Obtain password from the device's owner", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/password" ], "references": [] }, "DFT-1038": { "id": "DFT-1038", "name": "Attack a stored credential or device using a rainbow table-based approach", "description": "", "synonyms": [ "rainbow table attack" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/password" ], "references": [] }, "DFT-1039": { "id": "DFT-1039", "name": "Downgrade apps to facilitate data extraction", "description": "Downgrading an app to a version in which data is available e.g. via a backup method", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1139", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1142", "relevance_summary_280": "" } ] }, "DFT-1040": { "id": "DFT-1040", "name": "Exploit a mobile device to facilitate privileged access for data extraction", "description": "A process that typically exploits a security flaw in a specific device or operating system to enable users to perform higher privileged functions on a device (derived from Grover 2013)", "synonyms": [ "mobile device exploit", "rooting", "jailbreaking" ], "details": "", "subtechniques": [], "examples": [ "Checkra1n, https://checkra.in", "" ], "weaknesses": [ "DFW-1157", "DFW-1158" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/isPrivileged" ], "references": [ { "DFCite_id": "DFCite-1049", "relevance_summary_280": "" } ] }, "DFT-1041": { "id": "DFT-1041", "name": "Gain access to a device via a Pin2Pwn approach", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1042": { "id": "DFT-1042", "name": "Verify hash of copied data matches the hash of the data read from source device", "description": "Compares a hash of data read from a source device with a hash computed by reading back the copy of that data stored in a raw image or a forensic image container. \n\nThe source hash may be computed as the data is read during imaging, or by reading the source device again at a later point. \n\nWhat distinguishes this technique is that the reference hash comes from reading the source device, rather than from a stored record of that hash. Comparison against a stored hash, whether inside the image file, in a separate file, or held externally, is covered by DFT-1204.", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1124", "DFW-1125", "DFW-1126" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/hash" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/HashVerificationResult" ], "references": [ { "DFCite_id": "DFCite-1083", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1081", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1088", "relevance_summary_280": "" } ] }, "DFT-1043": { "id": "DFT-1043", "name": "Read bitstream from forensic image container file(s)", "description": "The decoding of a forensic format such as EWF such that the raw sectors can be accessed by a forensic tool (typically performed on-the-fly internally in a tool.)", "synonyms": [ "Read forensic format", "Read forensic image", "Access forensic image", "Access forensic image content", "Decode forensic image bitstream" ], "details": "For example a EWF (Expert Witness Format) needs to be processed to expose the equivalent RAW image sectors.", "subtechniques": [], "examples": [ "Expert Witness Format (EWF)", "Advanced Forensic Format (AFF)" ], "weaknesses": [ "DFW-1121", "DFW-1122", "DFW-1259" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed" ], "references": [] }, "DFT-1044": { "id": "DFT-1044", "name": "Decode data stored in a mobile backup format", "description": "Processing an extracted mobile device backup to access the files contained within.", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "adb backup decoding", "iOS backup decoding" ], "weaknesses": [ "DFW-1046", "DFW-1047", "DFW-1048", "DFW-1049", "DFW-1050", "DFW-1051" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/DeviceGeneratedBackup" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "references": [] }, "DFT-1045": { "id": "DFT-1045", "name": "Read contents from standard archive file(s)", "description": "Extract files from a common archive format e.g. TAR, RAR, ZIP", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1185" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "references": [] }, "DFT-1046": { "id": "DFT-1046", "name": "Redact digital forensic tool results to protect privileged material", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet", "https://ontology.solveit-df.org/solveit/observable/ArtifactSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/RedactedFileSet", "https://ontology.solveit-df.org/solveit/observable/RedactedArtifactSet" ], "references": [] }, "DFT-1047": { "id": "DFT-1047", "name": "Filter files using a hashset to reduce files examined", "description": "After hashing a set of files, compare the hashes against a known hashset to identify and remove known files from further examination.", "synonyms": [ "hash matching (reduce)" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1132" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet", "https://ontology.solveit-df.org/solveit/observable/HashSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/RedactedFileSet" ], "references": [] }, "DFT-1048": { "id": "DFT-1048", "name": "Protect privacy by only partially processing data from a source", "description": "Limiting the scope of file processing based on type, date or other criteria to protect privacy.", "synonyms": [], "details": "The files may still be present in the data set or removed, or made inaccessible, but the core of the technique is to provide a limited set of artifacts, compared with full processing.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/RedactedArtifactSet", "https://ontology.solveit-df.org/solveit/observable/RedactedFileSet" ], "references": [ { "DFCite_id": "DFCite-1037", "relevance_summary_280": "" } ] }, "DFT-1049": { "id": "DFT-1049", "name": "Keyword search", "description": "This technique involves searching data in the case for specific strings", "synonyms": [ "string search" ], "details": "This search may be conducted live, directly over the data, or from a generated index of strings extracted from the data. The words searched for may be either case-specific, or sometimes case-type specific.", "subtechniques": [ "DFT-1125", "DFT-1126", "DFT-1127", "DFT-1124", "DFT-1122", "DFT-1123", "DFT-1151" ], "examples": [], "weaknesses": [ "DFW-1053", "DFW-1058", "DFW-1059", "DFW-1196" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet" ], "references": [ { "DFCite_id": "DFCite-1014", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1013", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1103", "relevance_summary_280": "" } ] }, "DFT-1050": { "id": "DFT-1050", "name": "Locate relevant files using a hashset to identify files of interest", "description": "", "synonyms": [ "Hash matching (locate)" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1132" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet", "https://ontology.solveit-df.org/solveit/observable/HashSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FilteredFileSet" ], "references": [] }, "DFT-1051": { "id": "DFT-1051", "name": "Locate potentially relevant files using fuzzy hash matching", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FilteredFileSet" ], "references": [] }, "DFT-1052": { "id": "DFT-1052", "name": "Generate timeline", "description": "The extraction and normalisation of timestamps from a data source into a set of timeline entries", "synonyms": [ "timelining", "timeline generation" ], "details": "", "subtechniques": [ "DFT-1153" ], "examples": [ "plaso" ], "weaknesses": [ "DFW-1144", "DFW-1145", "DFW-1146", "DFW-1147", "DFW-1151", "DFW-1269" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet", "https://ontology.solveit-df.org/solveit/observable/ArtifactSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/Timeline" ], "references": [ { "DFCite_id": "DFCite-1058", "relevance_summary_280": "Provides a demo of timeline generation in python and shows what fields can be stored in a timeline entry. Shows provenance back to source file (offset/line number etc). Goes on to programaticallly extract 'high-level events' from the timeline." }, { "DFCite_id": "DFCite-1039", "relevance_summary_280": "" } ] }, "DFT-1053": { "id": "DFT-1053", "name": "Extract 'entities' from a data source", "description": "Extracting common types of entity in a data source e.g. email addresses, IP addresses, domain names, URLs, credit card numbers, etc.", "synonyms": [ "entity extraction" ], "details": "", "subtechniques": [], "examples": [ "bulk extractor" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed", "https://ontology.solveit-df.org/solveit/observable/FileSet", "https://ontology.solveit-df.org/solveit/observable/ArtifactSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/ArtifactSet" ], "references": [] }, "DFT-1054": { "id": "DFT-1054", "name": "Review artifacts or content manually for relevant material", "description": "Manual examination of files or artifacts to determine their relevance to the investigation.", "synonyms": [], "details": "The result of this process is a classification, which may be 'relevant', or could be more specific, e.g. 'contains reference to x'. This technique is likely paired with T1091 (Bookmark artifacts) but they could be recorded in other ways. \n\nThis manual review could be for:\n- images (DFT-1081) \n- video (DFT-1080)\n- audio (DFT-1079)\n- the general content of files (DFT-1058)\n- artefacts in general.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1060", "DFW-1061", "DFW-1062" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/ArtifactSet", "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification", "https://ontology.solveit-df.org/solveit/observable/ArtifactSet", "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "references": [] }, "DFT-1055": { "id": "DFT-1055", "name": "Examine file and folder structure", "description": "The process of examining the directory hierarchy, file and folder names (rather than file contents) to identify potentially relevant material.", "synonyms": [ "Directory structure review" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1056": { "id": "DFT-1056", "name": "Enumerate connections between artifacts", "description": "Finds references between artifacts, such as operating system artifacts that refer to a specific file", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "AXIOM Connections feature" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ObservableObject" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/ArtifactSet", "https://ontology.unifiedcyberontology.org/uco/observable/ObservableRelationship" ], "references": [] }, "DFT-1057": { "id": "DFT-1057", "name": "Search for indicators of steganography", "description": "Searching for the presence of current or historical steganography software on a system", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/AcquiredData" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/ArtifactSet" ], "references": [ { "DFCite_id": "DFCite-1082", "relevance_summary_280": "" } ] }, "DFT-1058": { "id": "DFT-1058", "name": "Search for mismatched file extensions", "description": "Checking the content of a file against its file extension to identify mismatches.", "synonyms": [], "details": "This results in a file path of an identified file, but also highlights the extension that the file has, and the file extension(s) that are expected", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FilteredFileSet" ], "references": [ { "DFCite_id": "DFCite-1007", "relevance_summary_280": "" } ] }, "DFT-1059": { "id": "DFT-1059", "name": "Identify partitions", "description": "Partitions are defined as ‘allocated contiguous sets of sectors from storage media’. This involves recovering the list of partitions that exist on a storage media.", "synonyms": [ "media management analysis" ], "details": "Partitions schemes include: MBR, GPT, APM. Some schemes such as GPT have records of the partitions in a single area (plus a backup partition table), others such as MBR make use of Extended Partition Tables (EPTs) that are scattered throughout the disk.\n\nPartitions can also be deleted but may be recoverable if the start sectors of the volumes contained within them can be identified. ", "subtechniques": [], "examples": [ "Hargreaves, Nelson and Casey (2024) provides a dataset with a deleted but recoverable partition that can be used for tool evaluation." ], "weaknesses": [ "DFW-1063", "DFW-1064", "DFW-1065", "DFW-1066", "DFW-1067" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/DiskPartition" ], "references": [ { "DFCite_id": "DFCite-1106", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1024", "relevance_summary_280": "" } ] }, "DFT-1060": { "id": "DFT-1060", "name": "Enumerate allocated files and folders", "description": "This involves parsing the allocated file system data structures and reconstructing the file system of the target media or device.", "synonyms": [ "file system parsing" ], "details": "", "subtechniques": [], "examples": [ "The Sleuth Kit - allows parsing of file system structures", "X-Ways Forensics - allows parsing of file system structures" ], "weaknesses": [ "DFW-1068", "DFW-1069", "DFW-1070", "DFW-1071", "DFW-1072", "DFW-1073", "DFW-1074", "DFW-1075", "DFW-1076", "DFW-1077", "DFW-1078", "DFW-1079", "DFW-1080", "DFW-1081", "DFW-1082", "DFW-1083", "DFW-1084" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/FileSystem" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "references": [ { "DFCite_id": "DFCite-1030", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1024", "relevance_summary_280": "Provides one of, if not the main text for file system forensics and covers the theory and implementation details of several file systems." } ] }, "DFT-1061": { "id": "DFT-1061", "name": "Recover non-allocated files", "description": "The recovery of files from non-allocated space", "synonyms": [ "Deleted file recovery", "Deleted data recovery" ], "details": "An attempt to recover non-allocated files from either a current file system or non-allocated space from within a file system, partition, or storage media.", "subtechniques": [ "DFT-1150", "DFT-1064" ], "examples": [], "weaknesses": [ "DFW-1133" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ContentData", "https://ontology.unifiedcyberontology.org/uco/observable/FileSystem" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/core/confidence", "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.unifiedcyberontology.org/uco/observable/Directory" ], "references": [ { "DFCite_id": "DFCite-1030", "relevance_summary_280": "Defines a standardised vocabulary for classifying, authenticating and evaluating non-allocated file recovery results." } ] }, "DFT-1062": { "id": "DFT-1062", "name": "Decrypt encrypted file systems/volumes", "description": "The process of decrypting an encrypted file system/volume to make its contents accessible for analysis.", "synonyms": [], "details": "The output of this process will vary depending on the encryption implementation in place. If encryption is at the sector level then it would result in a decrypted forensic image, but if it uses file-based encryption then the process would result in an equivalent volume but with the file content/metadata decrypted.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Volume", "https://ontology.unifiedcyberontology.org/uco/observable/Image" ], "references": [] }, "DFT-1063": { "id": "DFT-1063", "name": "Identify file types", "description": "Applying a process that identifies the types of files.", "synonyms": [], "details": "This could be via extension, although files may have been renamed, and so this is unreliable, so other means such as examining a file signature or other techniques are used (Dubettier et al 2023)", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1129", "DFW-1130", "DFW-1131" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification", "https://ontology.unifiedcyberontology.org/uco/observable/mimeType" ], "references": [ { "DFCite_id": "DFCite-1040", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1060", "relevance_summary_280": "Specifies 'File Type Identification' as a fairly central part of the abstract tool model in Fig 1. That stage is described in detail in 4.7 and mentions both identification by extension and content." } ] }, "DFT-1064": { "id": "DFT-1064", "name": "Carve non-allocated files", "description": "The process of recovering files from non-allocated space using only the structural properties of files.", "synonyms": [ "file carving" ], "details": "File carving should result in not just the file content, but the offset in which it was found and the offset base (i.e. the disk, volume, or offset within another file). This approach uses internal files structural information only - if residual file system metadata is used then the complementary technique T1150 is more applicable.", "subtechniques": [], "examples": [ "Photorec (Grenier 2023)", "scalpel", "foremost" ], "weaknesses": [ "DFW-1103", "DFW-1104", "DFW-1105", "DFW-1106", "DFW-1107" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/core/confidence", "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.unifiedcyberontology.org/uco/observable/rangeOffset", "https://ontology.unifiedcyberontology.org/uco/observable/rangeOffsetType" ], "references": [ { "DFCite_id": "DFCite-1011", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1048", "relevance_summary_280": "" } ] }, "DFT-1065": { "id": "DFT-1065", "name": "Extract artifacts from operating system-level content indexer(s)", "description": "Examine information from operating system artifacts relating to content indexing and search capabilities e.g. Windows Desktop Search", "synonyms": [ "OS search database examination", "operating system search database examination" ], "details": "For example the Windows Search database '...contains vast amount of values about various of artifacts found on a Windows system, e.g. files and directories, emails, appointments, attachments, images, audio and video' (Metz 2011)", "subtechniques": [], "examples": [ "Windows Search", "Spotlight", "Zeitgeist" ], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/fileName", "https://ontology.unifiedcyberontology.org/uco/observable/filePath" ], "references": [ { "DFCite_id": "DFCite-1100", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1122", "relevance_summary_280": "" } ] }, "DFT-1066": { "id": "DFT-1066", "name": "Extract artifacts from operating system log files", "description": "", "synonyms": [ "event log examination" ], "details": "", "subtechniques": [], "examples": [ "Windows Event Logs" ], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/EventLog" ], "references": [] }, "DFT-1067": { "id": "DFT-1067", "name": "Extract artifacts from operating system cloud synchronization features", "description": "Focuses on operating system level cloud syncronization features, such as iCloud Drive and OneDrive, which may be used to synchronize files between a local system and a cloud service.", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "iCloud Drive", "OneDrive" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [], "references": [] }, "DFT-1068": { "id": "DFT-1068", "name": "Extract operating system artifacts indicating recently used files", "description": "The process of examining operating system files to extract artifacts that may indicate file accesses.", "synonyms": [], "details": "While this technique may result in file paths and timestamps, to evaluate a hypothesis that a file was accessed requires use of T1155 to evaluate if this access occurred, and optionally T1117 if the time of access is relevant.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/filePath", "https://ontology.unifiedcyberontology.org/uco/observable/accessedTime" ], "references": [] }, "DFT-1069": { "id": "DFT-1069", "name": "Extract artifacts from a web browser", "description": "Recovery of information left from web browsing activity (derived from Oh et al (2011))", "synonyms": [], "details": "This may involve: history, cached items, bookmarks, cookies, saved passwords, form data.", "subtechniques": [ "DFT-1137", "DFT-1138", "DFT-1139", "DFT-1140", "DFT-1141", "DFT-1142", "DFT-1143", "DFT-1144", "DFT-1145", "DFT-1146", "DFT-1147", "DFT-1148" ], "examples": [], "weaknesses": [ "DFW-1113", "DFW-1250", "DFW-1251" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/BrowserAppFiles" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/URLHistory", "https://ontology.unifiedcyberontology.org/uco/observable/CookieHistory", "https://ontology.unifiedcyberontology.org/uco/observable/BrowserBookmark", "https://ontology.unifiedcyberontology.org/uco/observable/BrowserCookie", "https://ontology.unifiedcyberontology.org/uco/observable/URLVisit", "https://ontology.unifiedcyberontology.org/uco/observable/URLHistoryEntry" ], "references": [ { "DFCite_id": "DFCite-1038", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1108", "relevance_summary_280": "" } ] }, "DFT-1070": { "id": "DFT-1070", "name": "Extract artifacts from email client(s) or webmail access", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/EmailAppFiles" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/EmailAccount", "https://ontology.unifiedcyberontology.org/uco/observable/EmailMessage", "https://ontology.unifiedcyberontology.org/uco/observable/Contact" ], "references": [] }, "DFT-1071": { "id": "DFT-1071", "name": "Extract data from SQLite database(s)", "description": "Examination of a SQLite database file(s) to extract information from within.", "synonyms": [ "database forensics" ], "details": "", "subtechniques": [], "examples": [ "sqlite-forensic-corpus (2018), https://faui1-files.cs.fau.de/public/sqlite-forensic-corpus/" ], "weaknesses": [ "DFW-1166", "DFW-1167", "DFW-1168", "DFW-1169", "DFW-1170", "DFW-1171" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/SQLiteDatabase" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/SQLiteTable" ], "references": [ { "DFCite_id": "DFCite-1104", "relevance_summary_280": "" } ] }, "DFT-1072": { "id": "DFT-1072", "name": "Extract artifacts from chat app(s)", "description": "Analysis of the files that provide the backing store for a chat or messenger application", "synonyms": [ "Messenger app analysis" ], "details": "Messenger apps include:\n\niOS Messenger \nWhatApp\nTelegram\nSignal\nFacebook Messenger\n…", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1085", "DFW-1086", "DFW-1087", "DFW-1088", "DFW-1089", "DFW-1090", "DFW-1091", "DFW-1092", "DFW-1093", "DFW-1094", "DFW-1095", "DFW-1096", "DFW-1097", "DFW-1098", "DFW-1099", "DFW-1100", "DFW-1101", "DFW-1102" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/ChatAppFiles" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Message", "https://ontology.unifiedcyberontology.org/uco/observable/SMSMessage", "https://ontology.unifiedcyberontology.org/uco/observable/Contact" ], "references": [] }, "DFT-1073": { "id": "DFT-1073", "name": "Extract artifacts from calendar app(s)", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/CalendarAppFiles" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Calendar", "https://ontology.unifiedcyberontology.org/uco/observable/CalendarEntry" ], "references": [] }, "DFT-1074": { "id": "DFT-1074", "name": "Extract artifacts from social network app(s)", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/SocialMediaAppFiles" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Message", "https://ontology.unifiedcyberontology.org/uco/observable/Post", "https://ontology.unifiedcyberontology.org/uco/observable/Contact" ], "references": [] }, "DFT-1075": { "id": "DFT-1075", "name": "Extract artifacts from maps/travel app(s)", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/MapsAppFiles", "https://ontology.solveit-df.org/solveit/observable/NavigationAppFiles" ], "CASE_output_classes": [], "references": [] }, "DFT-1076": { "id": "DFT-1076", "name": "Extract artifacts from log files", "description": "Examination of a file that was designed for incremental logging from a piece of software (e.g. an application or operating system feature)", "synonyms": [], "details": "These could be in a variety of formats e.g. plain text, JSON, XML, binary, etc.", "subtechniques": [], "examples": [ "Examination of setupapi.dev.log", "Examination of syslog" ], "weaknesses": [ "DFW-1228", "DFW-1229", "DFW-1230", "DFW-1231", "DFW-1232", "DFW-1233", "DFW-1234", "DFW-1235", "DFW-1236" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/EventLog", "https://ontology.unifiedcyberontology.org/uco/core/eventType" ], "references": [] }, "DFT-1077": { "id": "DFT-1077", "name": "Extract artifacts from photo management app(s)", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "Windows Photos app", "Apple Photos app", "Lightroom", "digiKam", "XnView MP", "Darktable" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/PhotosAppFiles" ], "CASE_output_classes": [], "references": [] }, "DFT-1078": { "id": "DFT-1078", "name": "Extract artifacts from cloud synchronization app(s)", "description": "Involves examination of cloud synchronization artifacts from apps rather than those built into the operating system.", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "Dropbox", "Google Drive" ], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1079": { "id": "DFT-1079", "name": "Examine audio content", "description": "", "synonyms": [], "details": "", "subtechniques": [ "DFT-1194" ], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1080": { "id": "DFT-1080", "name": "Examine video content", "description": "", "synonyms": [], "details": "", "subtechniques": [ "DFT-1106" ], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1081": { "id": "DFT-1081", "name": "Examine image/picture content", "description": "", "synonyms": [], "details": "", "subtechniques": [ "DFT-1176" ], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1082": { "id": "DFT-1082", "name": "Examine document content", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "Microsoft Word", "Pages" ], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1083": { "id": "DFT-1083", "name": "Extract artifacts from operating system memory structures", "description": "Examination of the operating system structures that allows individual processes to be listed and pages used by specific processes to be enumerated.", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "EPROCESS blocks", "VAD trees" ], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1084": { "id": "DFT-1084", "name": "Extract potentially user-identifying content from account information", "description": "Analysis of user account information to extract content that may help identify the person associated with an account, such as usernames, real names, password hints, security questions, recovery email addresses, and profile details.", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/UserAccount" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/identity/Person", "https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship" ], "references": [] }, "DFT-1085": { "id": "DFT-1085", "name": "Conflate specific account identifiers to a single user identity", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Account" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship" ], "references": [] }, "DFT-1086": { "id": "DFT-1086", "name": "Analyze timeline", "description": "The process of searching, filtering, sorting, highlighting, or aggregating timeline entries to determine which are relevant for event reconstruction, or to identify times of interest (adapted from Breitinger et al. 2025)", "synonyms": [ "Timeline analysis", "Temporal analysis" ], "details": "This can involve refinement approaches such as: filtering irrelevant entries, highlighting key entries, or aggregating entries into more meaningful events. This may result in a filtered timeline, or a set of highlighted timeline entries", "subtechniques": [ "DFT-1134", "DFT-1182", "DFT-1184" ], "examples": [ "TimeSketch (Berggren et al. 2014)", "PyDFT (Hargreaves & Patterson 2012)" ], "weaknesses": [ "DFW-1148", "DFW-1266" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/Timeline", "https://ontology.solveit-df.org/solveit/observable/TimelineEntry" ], "references": [ { "DFCite_id": "DFCite-1017", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1019", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1028", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1058", "relevance_summary_280": "" } ] }, "DFT-1087": { "id": "DFT-1087", "name": "Reconstruct the location-based properties of an event", "description": "The process of assigning location properties to a reconstructed event", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/core/confidence", "https://ontology.solveit-df.org/solveit/analysis/HypothesisedEvent", "https://ontology.unifiedcyberontology.org/uco/location/Location" ], "references": [ { "DFCite_id": "DFCite-1146", "relevance_summary_280": "Provides Bayesian framework to evaluate location-related information" } ] }, "DFT-1088": { "id": "DFT-1088", "name": "Reconstruct relations between events or properties of events", "description": "The process of determining the existence and nature of relationships between entities during event reconstruction", "synonyms": [ "Relational analysis", "Connection-based event reconstruction", "Relation-based event reconstruction" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Message", "https://ontology.unifiedcyberontology.org/uco/observable/Contact" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship", "https://ontology.solveit-df.org/solveit/analysis/HypothesisedCommunication" ], "references": [ { "DFCite_id": "DFCite-1029", "relevance_summary_280": "" } ] }, "DFT-1089": { "id": "DFT-1089", "name": "Review source code of software", "description": "Typically to understand it's capabilities, the artifacts it produces, or what user actions could be potentially reconstructed", "synonyms": [], "details": "The equivalent of `static analysis` of malware, but applied to software in general.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Code" ], "CASE_output_classes": [], "references": [] }, "DFT-1090": { "id": "DFT-1090", "name": "Experiment with software to ascertain forensic artifacts", "description": "The process of running software in a controlled environment to observe its behavior and identify potential forensic artifacts.", "synonyms": [], "details": "The equivalent of `dynamic analysis` of malware, but applied to software in general. This can involve running the software in a controlled environment and observing its behavior, inputs, and outputs to gain insights into its functionality and potential for event reconstruction.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Software" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship" ], "references": [] }, "DFT-1091": { "id": "DFT-1091", "name": "Tag artifacts", "description": "Make a record of selected files or pieces of data so they can be accessed easily, or used for generating automated reports.", "synonyms": [ "Bookmark artifacts", "Bookmarking", "Tagging" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1155", "DFW-1156" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ObservableObject" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification", "https://ontology.unifiedcyberontology.org/uco/core/Annotation" ], "references": [] }, "DFT-1092": { "id": "DFT-1092", "name": "Generate tag-based automated report", "description": "Generate a report in PDF, HTML or other format that compiles tagged (or bookmarked) items from a case into a package that can be reviewed.", "synonyms": [ "Produce bookmark-based automated report" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1152", "DFW-1153", "DFW-1154" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/analysis/ForensicToolTagBasedReport" ], "references": [ { "DFCite_id": "DFCite-1009", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1008", "relevance_summary_280": "" } ] }, "DFT-1093": { "id": "DFT-1093", "name": "Write expert report", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://cacontology.projectvic.org/case-management#ExpertReport" ], "references": [] }, "DFT-1094": { "id": "DFT-1094", "name": "Disclose investigation material to an authorized legal authority", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1154", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1155", "relevance_summary_280": "Page 6 outlines type of material in a case (in England and Wales) and then how it can be treated with regard to disclosure." } ] }, "DFT-1095": { "id": "DFT-1095", "name": "Instrument a piece of running software", "description": "This can be done during experiments to help ascertain functionality, or potential forensic artifacts", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "IDA Pro", "Frida", "Fiddler" ], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1156", "relevance_summary_280": "The GitHub pages for Frida (Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.)" } ] }, "DFT-1096": { "id": "DFT-1096", "name": "Extract operating system artifacts indicating program execution", "description": "The process of examining operating system files to extract artifacts that may indicate a program has been run.", "synonyms": [ "Programs run identification (OS)" ], "details": "While this technique may result in paths to executables/scripts and timestamps, to evaluate a hypothesis that a program was run requires use of T1155 to evaluate if this occurred, and optionally T1117 if the time of access is relevant.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/ArtifactSet" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/execProgramPath", "https://ontology.unifiedcyberontology.org/uco/observable/timesExecuted", "https://ontology.unifiedcyberontology.org/uco/observable/execProgramHashes" ], "references": [] }, "DFT-1097": { "id": "DFT-1097", "name": "Extract operating system artifacts indicating installed software", "description": "Extraction and analysis of information that allows programs installed on an OS to be identified.", "synonyms": [ "Installed software identification (OS)" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/ArtifactSet" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Application", "https://ontology.unifiedcyberontology.org/uco/observable/ApplicationVersion" ], "references": [] }, "DFT-1098": { "id": "DFT-1098", "name": "Enumerate operating system user accounts", "description": "Examination of operating system artifacts to determine user accounts", "synonyms": [ "User account analysis (OS)" ], "details": "This might include which accounts exist on the system, when they were created, etc.", "subtechniques": [], "examples": [ "Windows SAM file" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/UserAccount", "https://ontology.unifiedcyberontology.org/uco/observable/accountType" ], "references": [] }, "DFT-1099": { "id": "DFT-1099", "name": "Repair a damaged or incomplete file using `grafting`", "description": "Repair file by grafting different reference data onto fragment(s)", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ContentData" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/File" ], "references": [] }, "DFT-1100": { "id": "DFT-1100", "name": "Extract metadata from within images", "description": "The extraction of metadata from within images (pictures). e.g. EXIF, XMP. IPTC, iTXt etc.", "synonyms": [ "EXIF extraction" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/RasterPicture" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/exifData" ], "references": [] }, "DFT-1101": { "id": "DFT-1101", "name": "Conduct cell site survey", "description": "Taking measurements to assess which cells actually provide service at a specific location (adapted from Tart et al 2012).", "synonyms": [], "details": "Can involve: spot sample, location survey, area survey, cell survey (Tart et al 2012)", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/location/Location" ], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1121", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1067", "relevance_summary_280": "" } ] }, "DFT-1102": { "id": "DFT-1102", "name": "Decode data extracted from unmanaged NAND", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ContentData" ], "CASE_output_classes": [], "references": [] }, "DFT-1103": { "id": "DFT-1103", "name": "Virtualize suspect system for previewing", "description": "A suspect disk image can be configured to boot as a virtual machine, which allows screenshots to be taken showing how the user's desktop looked for example.", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer", "https://ontology.solveit-df.org/solveit/observable/RawImage" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/VirtualizedComputer" ], "references": [] }, "DFT-1104": { "id": "DFT-1104", "name": "Collect data using open source intelligence", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1105": { "id": "DFT-1105", "name": "Examine memory dump from an application", "description": "Examination of the specific structures from the memory of a specific application", "synonyms": [], "details": "These could be extracted from a physical memory dump through analysis of operating system memory structures to extract specific process memory, or obtained directly on a live system.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1106": { "id": "DFT-1106", "name": "Classify if a video is potentially synthetically generated", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/VideoFile" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification", "https://ontology.unifiedcyberontology.org/uco/analysis/classificationConfidence" ], "references": [] }, "DFT-1107": { "id": "DFT-1107", "name": "Extract artifacts from health/fitness app(s)", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/HealthAppFiles" ], "CASE_output_classes": [], "references": [] }, "DFT-1108": { "id": "DFT-1108", "name": "Extract artifacts from reminders app(s)", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/RemindersAppFiles" ], "CASE_output_classes": [], "references": [] }, "DFT-1109": { "id": "DFT-1109", "name": "Extract artifacts from payment app(s)", "description": "", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/PaymentAppFiles" ], "CASE_output_classes": [], "references": [] }, "DFT-1110": { "id": "DFT-1110", "name": "Preserve reference data", "description": "", "synonyms": [], "details": "Reference data may be needed for later trace interpretation, but may change (especially server side software), so relevant data should be preserved close to the time of the event of interest", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1172" ], "CASE_input_classes": [], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1118", "relevance_summary_280": "" } ] }, "DFT-1111": { "id": "DFT-1111", "name": "Record system clock offset", "description": "Recording a system clock compared with trusted time source", "synonyms": [], "details": "Collection of the time of a device clock compared with the correct time, allowing an offset to be calculated *for the point in time when the clock was observed*.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1173" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Device" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/systemTime", "https://ontology.solveit-df.org/solveit/observable/ClockOffsetCapture" ], "references": [] }, "DFT-1112": { "id": "DFT-1112", "name": "Locate and remove physical disks from a device", "description": "Locate physical storage media within devices and removing them", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1174", "DFW-1175", "DFW-1176" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Computer" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/StorageMedium" ], "references": [] }, "DFT-1113": { "id": "DFT-1113", "name": "Access internal storage via bootable environment", "description": "Booting the suspected computer device into an alternative operating system in order to image the attached disks.", "synonyms": [], "details": "These operating systems are usually modified to contain forensic imaging tools and to avoid writing to the attached storage through the use of software write blocking (DFT-1013)", "subtechniques": [], "examples": [ "WinFE - Windows Forensic Environment, is forensically sound, bootable Windows operation system that can be burned into USB and plug the USB into suspected device. Then, after changing boot order, booting to the USB to create forensic images from the tested Windows, MacOS and Linux systems.", "PALADIN Forensic - is a modified “live” Linux distribution based on Ubuntu that simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox." ], "weaknesses": [ "DFW-1177", "DFW-1178", "DFW-1179", "DFW-1180", "DFW-1182" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Computer" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface" ], "references": [ { "DFCite_id": "DFCite-1071", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1112", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1132", "relevance_summary_280": "" } ] }, "DFT-1114": { "id": "DFT-1114", "name": "Preserve memory contents via Cold Boot Attack", "description": "A precursor to extracting volatile memory (RAM) from a powered-off system by quickly rebooting or transferring the memory module to another system before residual data fades. Cooling the memory modules can significantly slow down data decay, preserving critical data such as encryption keys or passwords.", "synonyms": [ "Cold Boot Attack", "Extracting RAM data using Cold Boot Attack" ], "details": "An examiner freezes a computer’s RAM by spraying it with liquid nitrogen or even using inverted canned air, then powering off the live system without proper shutdown, and then booting into an external plugged USB, and try capturing the residual RAM content (DFT-1003) with encryption keys that might still be stored there", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1032" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Memory" ], "references": [ { "DFCite_id": "DFCite-1053", "relevance_summary_280": "" } ] }, "DFT-1115": { "id": "DFT-1115", "name": "Visualize geolocation information", "description": "Presenting points or paths visually using extracted data, typically on a map", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "Autopsy Geolocation view (Basis Technology 2020)", "Magnet Axiom 'World map view' (Magnet 2020)" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/location/Location" ], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1092", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1093", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1010", "relevance_summary_280": "" } ] }, "DFT-1116": { "id": "DFT-1116", "name": "Extract references to connected devices", "description": "Examine artifacts and extract indicators of devices that have been connected to the target device.", "synonyms": [], "details": "This technique extracts references to other devices that have potentially been connected to the device being examined. The subsequent interpretation of these artifacts (using T1088: Relational-based event reconstruction), could result in HypothesisedDevices. The separate process for inferring the connected device(s) captures the uncertainty in such an interpretation.", "subtechniques": [], "examples": [ "USB connected devices", "ADB connected hosts", "iOS backups from a computer", "Paired bluetooth devices", "Synronization artifacts referencing another device" ], "weaknesses": [ "DFW-1183", "DFW-1184", "DFW-1011" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1057", "relevance_summary_280": "Demonstrates extraction of synchronization artifacts referencing connected devices across cloud services, mobile devices and computers. Directly supports DFT-1116 by showing how sync records serve as indicators of associated devices warranting further acquisition." }, { "DFCite_id": "DFCite-1001", "relevance_summary_280": "ALEAPP plugin implementing DFT-1116 for Android devices. Parses /misc/adb/adb_hosts to extract identifiers of computers previously connected via ADB, providing direct indicators of associated host devices for further investigation." } ] }, "DFT-1117": { "id": "DFT-1117", "name": "Reconstruct the time that an event may have occurred", "description": "The process of assigning a time component to a reconstructed event", "synonyms": [ "Temporal-based event reconstruction" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1148", "DFW-1149", "DFW-1266" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/analysis/hypothesisedDateTime" ], "references": [] }, "DFT-1118": { "id": "DFT-1118", "name": "Locate relevant files by path", "description": "Use the path of file name to determine potential relevance of the file.", "synonyms": [ "Filename matching" ], "details": "There are multiple applications of this, for example: within a tool to determine what processing should occur to a file, or flagging files with particular extensions.", "subtechniques": [], "examples": [ "Autopsy Interesting Files module", "Pattern matching in ALEAPP/iLEAPP to trigger specific plugins" ], "weaknesses": [ "DFW-1186", "DFW-1187", "DFW-1188" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.solveit-df.org/solveit/observable/FilteredFileSet" ], "references": [ { "DFCite_id": "DFCite-1006", "relevance_summary_280": "" } ] }, "DFT-1119": { "id": "DFT-1119", "name": "Automatically scan for artifact changes caused by app updates", "description": "Monitor every version change of an application to determine if there are changes to the way the app stores data", "synonyms": [ "App update monitoring" ], "details": "", "subtechniques": [], "examples": [ "Discussed in 'Puma: Automatically generating digital forensic reference data triggered by mobile application updates' (Claij-Swart et al. 2025)" ], "weaknesses": [ "DFW-1191" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/hasChanged", "https://ontology.unifiedcyberontology.org/uco/observable/filePath", "https://ontology.unifiedcyberontology.org/uco/observable/tableSchema", "https://ontology.unifiedcyberontology.org/uco/observable/TableField" ], "references": [ { "DFCite_id": "DFCite-1034", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1033", "relevance_summary_280": "" } ] }, "DFT-1120": { "id": "DFT-1120", "name": "Extract artifacts from app data automatically", "description": "The use of automation to extract pieces of data that are potentially useful for a digital forensic investigation from app data.", "synonyms": [ "Automated trace extraction" ], "details": "Artifacts extracted may be a direct mapping to lower levels of abstraction e.g. a database field 'message content' may map to an artifact 'message content', but in many cases, automated interpretation is applied where a field such as 'flag' containing numeric values, may be mapped to more meaningful text strings in the extracted artifact.", "subtechniques": [], "examples": [ "iLEAPP", "aLEAPP", "Axiom", "Hansken" ], "weaknesses": [ "DFW-1189", "DFW-1190", "DFW-1258" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/ApplicationFiles" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/ArtifactSet" ], "references": [] }, "DFT-1121": { "id": "DFT-1121", "name": "Index a data source for keyword searching", "description": "Extracting strings from a data source and adding them to an index for subsequent searching.", "synonyms": [ "keyword indexing" ], "details": "An index can be constructed over a set of files (including non-allocated space represented as files), a set of extracted artifacts, or both.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1054", "DFW-1055", "DFW-1056", "DFW-1197", "DFW-1198" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet", "https://ontology.solveit-df.org/solveit/observable/ArtifactSet", "https://ontology.solveit-df.org/solveit/observable/KeywordIndexingConfiguration" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/KeywordIndex" ], "references": [] }, "DFT-1122": { "id": "DFT-1122", "name": "Keyword search (case-type wordlists)", "description": "Searching for case-type specific keywords", "synonyms": [], "details": "This complements case-specific wordlists (T1123) created for the individual case.", "subtechniques": [], "examples": [ "Example word lists https://www.dfir.training/downloads/search-terms" ], "weaknesses": [ "DFW-1057", "DFW-1059" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet" ], "references": [ { "DFCite_id": "DFCite-1074", "relevance_summary_280": "" } ] }, "DFT-1123": { "id": "DFT-1123", "name": "Keyword search (case-specific wordlists)", "description": "Searching for case-specific keywords, e.g. people's names, places etc.", "synonyms": [], "details": "This complements case-type wordlists (T1122) using words typical to specific offenses.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1199", "DFW-1192" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet" ], "references": [] }, "DFT-1124": { "id": "DFT-1124", "name": "Keyword search (indexed)", "description": "Searching for keywords within a generated index of data in a case", "synonyms": [ "indexed search" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1052" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/KeywordIndex", "https://ontology.solveit-df.org/solveit/observable/Wordlist" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet" ], "references": [ { "DFCite_id": "DFCite-1103", "relevance_summary_280": "" } ] }, "DFT-1125": { "id": "DFT-1125", "name": "Keyword search (live)", "description": "Searching for keywords over the raw data in a case without using an index of text content", "synonyms": [ "live search" ], "details": "This may be done on a physical sector basis, or on a logical (file) basis.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1200", "DFW-1378" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet" ], "references": [ { "DFCite_id": "DFCite-1103", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1134", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1133", "relevance_summary_280": "" } ] }, "DFT-1126": { "id": "DFT-1126", "name": "Keyword search (live) (physical)", "description": "Searching for keywords over the raw data on a sector by sector basis", "synonyms": [ "live search" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1193", "DFW-1194", "DFW-1195", "DFW-1378" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet" ], "references": [ { "DFCite_id": "DFCite-1103", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1134", "relevance_summary_280": "" } ] }, "DFT-1127": { "id": "DFT-1127", "name": "Keyword search (live) (logical)", "description": "Searching for keywords over the raw data, without an index of text content, but on a file by file basis", "synonyms": [ "live search" ], "details": "This approach can include decoding the individual file formats and content. It can also overcome limitations associated with compressed data or data split due to file fragmentation.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1195", "DFW-1378" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet" ], "references": [ { "DFCite_id": "DFCite-1103", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1133", "relevance_summary_280": "" } ] }, "DFT-1128": { "id": "DFT-1128", "name": "Search for indicators of malware", "description": "Searching for the presence of current or historical malware on a system", "synonyms": [ "virus scan", "malware scan" ], "details": "This can involve searching for malware itself or other indicators e.g. persistence mechanisms, delivery method etc.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1129": { "id": "DFT-1129", "name": "Search for indicators of clock tampering", "description": "Searching for indicators that the system clock has been tampered with", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1127", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1039", "relevance_summary_280": "" } ] }, "DFT-1130": { "id": "DFT-1130", "name": "Search for indicators of encrypted data", "description": "Searching for the presence of current or historical encrypted data on a system", "synonyms": [], "details": "This can include encryption software itself, or encrypted files.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.unifiedcyberontology.org/uco/observable/Application" ], "references": [] }, "DFT-1131": { "id": "DFT-1131", "name": "Search for indicators of trail obfuscation", "description": "Searching for the presence of current or historical trail obfuscation on a system", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Application" ], "references": [ { "DFCite_id": "DFCite-1082", "relevance_summary_280": "" } ] }, "DFT-1132": { "id": "DFT-1132", "name": "Search for indicators of artifact wiping", "description": "Searching for the presence of current or historical artifact wiping", "synonyms": [ "artifact scrubbing" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Application" ], "references": [ { "DFCite_id": "DFCite-1082", "relevance_summary_280": "" } ] }, "DFT-1133": { "id": "DFT-1133", "name": "Extract artifacts from AI companion app(s)", "description": "The forensic examination of the artifacts describing the configuration or the interaction with an AI companion app or service.", "synonyms": [], "details": "An AI companion is defined as \"a type of generative AI-based conversational agent (CA) explicitly designed for companionship and friendship with a human user (Strohmann et al. 2022; Pentina et al. 2023)\" (Bayor et al 2025).", "subtechniques": [], "examples": [ "See Hargreaves & Drury (2025)" ], "weaknesses": [ "DFW-1201", "DFW-1202", "DFW-1203", "DFW-1204", "DFW-1205", "DFW-1206", "DFW-1207", "DFW-1208", "DFW-1209", "DFW-1210", "DFW-1211", "DFW-1212", "DFW-1213", "DFW-1214", "DFW-1215", "DFW-1216", "DFW-1217", "DFW-1218", "DFW-1219", "DFW-1220", "DFW-1221", "DFW-1222", "DFW-1223", "DFW-1224", "DFW-1225", "DFW-1226", "DFW-1227" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/AiChatAppFiles" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Message", "https://ontology.unifiedcyberontology.org/uco/observable/Call", "https://ontology.unifiedcyberontology.org/uco/observable/callType", "https://ontology.unifiedcyberontology.org/uco/observable/sentTime", "https://ontology.unifiedcyberontology.org/uco/observable/receivedTime", "https://ontology.unifiedcyberontology.org/uco/observable/messageType", "https://ontology.unifiedcyberontology.org/uco/observable/Account", "https://ontology.unifiedcyberontology.org/uco/observable/emailAddress", "https://ontology.unifiedcyberontology.org/uco/observable/phoneNumber", "https://ontology.unifiedcyberontology.org/uco/configuration/Configuration" ], "references": [ { "DFCite_id": "DFCite-1055", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1012", "relevance_summary_280": "" } ] }, "DFT-1134": { "id": "DFT-1134", "name": "Use time anchors to estimate clock offset", "description": "Correlate timestamps from the system clock and an external trusted time source (Time Anchoring)", "synonyms": [ "Timestamp correlation", "Time anchoring (Vanini et al 2024)" ], "details": "Correlate timestamps from the system clock and an external trusted source of time contained in the same artifact, allowing an offset to be estimated *for the point in time the timestamp was recorded*", "subtechniques": [], "examples": [ "Browser caches often contain local timestamps and those derived from external servers", "Records in web browser history databases contain local timestamps and, in some cases, timestamps from external servers, embedded in URLs", "Email headers often record timestamps derived from external mail servers as well as timestamps generated by the local system time", "Missed call or voicemail notification messages often include a timestamp derived from an external time source, e.g., missed call from XX on 2018-06-06 at 01:32:49 pm, which can be compared to the local file system time the message was received" ], "weaknesses": [ "DFW-1260", "DFW-1261", "DFW-1262", "DFW-1263" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/DateTimeStamp" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/TimestampOffset" ], "references": [ { "DFCite_id": "DFCite-1020", "relevance_summary_280": "Defines the concept of a time anchor and illustrates how the time anchoring technique can be applied in practice" } ] }, "DFT-1137": { "id": "DFT-1137", "name": "Extract browser history artifacts", "description": "The examination of the history component of a web browser.", "synonyms": [ "web history examination", "internet history examination" ], "details": "Typically this would involve the examination of data in one or more SQLite tables.", "subtechniques": [], "examples": [ "places.sqlite for Firefox", "History for Chrome" ], "weaknesses": [ "DFW-1243", "DFW-1244", "DFW-1108", "DFW-1245", "DFW-1246", "DFW-1109", "DFW-1110", "DFW-1111", "DFW-1112" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/BrowserAppFiles" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/URLHistory" ], "references": [] }, "DFT-1138": { "id": "DFT-1138", "name": "Extract browser cache artifacts", "description": "The examination of the content saved locally by browsers to improve performance", "synonyms": [ "web cache examination", "internet cache examination" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1252" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/BrowserCacheData" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/URL", "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.unifiedcyberontology.org/uco/observable/httpRequestHeader", "https://ontology.solveit-df.org/solveit/observable/httpResponseHeader" ], "references": [ { "DFCite_id": "DFCite-1148", "relevance_summary_280": "Provides a description of the google Chrome cache structures" } ] }, "DFT-1139": { "id": "DFT-1139", "name": "Extract browser session artifacts", "description": "The examination of sessions and open tabs and their individual histories", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1140": { "id": "DFT-1140", "name": "Extract browser autofill artifacts", "description": "The examination of data that is stored to autocomplete entries in forms", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1141": { "id": "DFT-1141", "name": "Extract browser bookmark artifacts", "description": "The examination of the links saved within a browser to facilitate quick access", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1247" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/BrowserBookmark" ], "references": [] }, "DFT-1142": { "id": "DFT-1142", "name": "Extract browser download artifacts", "description": "The examination of records of files downloaded with a browser", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1248" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/URL", "https://ontology.unifiedcyberontology.org/uco/observable/File" ], "references": [] }, "DFT-1143": { "id": "DFT-1143", "name": "Extract browser configuration artifacts", "description": "The examination of a browsers configuration", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/configuration/Configuration" ], "references": [] }, "DFT-1144": { "id": "DFT-1144", "name": "Enumerate browser profiles", "description": "The enumeration of the separate user profiles set up within a browser", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1249" ], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1145": { "id": "DFT-1145", "name": "Extract browser extensions artifacts", "description": "The examination of the extensions installed within a browser", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1146": { "id": "DFT-1146", "name": "Extract browser synchronization artifacts", "description": "The examination of the settings and artifacts resulting from a browser synchronization feature", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/configuration/Configuration" ], "references": [] }, "DFT-1147": { "id": "DFT-1147", "name": "Extract browser cookie artifacts", "description": "The examination of stored browser cookies", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/CookieHistory", "https://ontology.unifiedcyberontology.org/uco/observable/BrowserCookie" ], "references": [] }, "DFT-1148": { "id": "DFT-1148", "name": "Extract browser web storage artifacts", "description": "The examination of ", "synonyms": [ "browser storage examination", "web storage examination", "HTML5 storage examination", "local storage examination" ], "details": "Web storage is a browser-based API bundled in HTML5 specifications that allow persistent client-side storage for web applications. (Mendoza 2015)", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1099", "relevance_summary_280": "" } ] }, "DFT-1149": { "id": "DFT-1149", "name": "Extract artifacts from the file versioning feature", "description": "Extraction of data from the versioning system used by an operating system to store older versions of files.", "synonyms": [ "shadow copy examination", "previous versions", "macOS 'Versions' examination", "'Revert to...' feature examination" ], "details": "Operating systems often maintain versioning systems that preserve older versions of files, either for backup purposes or to enable users to restore previous states. These systems create snapshots or shadow copies at regular intervals or when significant changes occur. Digital forensic examination of these versioning features can reveal files that have been modified or deleted, providing valuable evidence of system activity and user behavior. The examination process involves identifying the versioning mechanism used by the operating system, locating the stored versions, and extracting relevant data for analysis.", "subtechniques": [], "examples": [ "Volume Shadow Service (VSS)", "MacOS \"Revert to\" feature" ], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.unifiedcyberontology.org/uco/observable/version", "https://ontology.unifiedcyberontology.org/uco/observable/modifiedTime" ], "references": [ { "DFCite_id": "DFCite-1005", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1059", "relevance_summary_280": "Section 8 covers volume shadow copies in a broader paper on Windows Vista. It describes using a virtualised or cloned system along with standard vssadmin commands to mount volumes. This is outdated now and offline parsing is typically possible." }, { "DFCite_id": "DFCite-1087", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1120", "relevance_summary_280": "" } ] }, "DFT-1150": { "id": "DFT-1150", "name": "Recover non-allocated files using residual file metadata", "description": "Use metadata that remains in the file system to recover non-allocated files", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1134", "DFW-1135", "DFW-1253", "DFW-1254", "DFW-1255", "DFW-1256" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/FileSystem" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/core/confidence", "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.unifiedcyberontology.org/uco/observable/Directory" ], "references": [ { "DFCite_id": "DFCite-1030", "relevance_summary_280": "Defines a standardized vocabulary for classifying, authenticating and evaluating non-allocated file recovery results" }, { "DFCite_id": "DFCite-1024", "relevance_summary_280": "The foundational text book on file system forensic analysis" } ] }, "DFT-1151": { "id": "DFT-1151", "name": "Keyword search (over extracted artifacts)", "description": "Keyword searching only applied over extracted artifacts", "synonyms": [ "search artifacts only" ], "details": "This limited scope search may be performed within tools themselves e.g. McQuaid (2017), or within an exported packaged report.", "subtechniques": [], "examples": [ "Using Keywords with Magnet AXIOM (McQuaid 2017)" ], "weaknesses": [ "DFW-1257" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/ArtifactSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet" ], "references": [ { "DFCite_id": "DFCite-1098", "relevance_summary_280": "" } ] }, "DFT-1153": { "id": "DFT-1153", "name": "Apply offset to a timestamp", "description": "Application of a time offset to a timestamp", "synonyms": [], "details": "This could be a clock offset, a timezone or other reason for a timestamp correction", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1264", "DFW-1265", "DFW-1267", "DFW-1268" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/DateTimeStamp", "https://ontology.solveit-df.org/solveit/observable/TimelineEntry" ], "references": [] }, "DFT-1154": { "id": "DFT-1154", "name": "Reconstruct an identity associated with an event", "description": "The process of attempting to link an identity (account, person etc.) to a reconstructed event", "synonyms": [ "Identity-based event reconstruction", "Resolving the person-device gap", "Resolving the person-account gap," ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1150" ], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/identity/Person", "https://ontology.unifiedcyberontology.org/uco/observable/Account", "https://ontology.unifiedcyberontology.org/uco/core/confidence" ], "references": [ { "DFCite_id": "DFCite-1027", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1119", "relevance_summary_280": "" } ] }, "DFT-1155": { "id": "DFT-1155", "name": "Reconstruct that a specific event may have occurred", "description": "The process of reconstructing that an operation occurred on a digital system", "synonyms": [ "Operation-based event reconstruction", "Activity-based event reconstruction", "Action-based event reconstruction" ], "details": "While some event reconstruction needs a time component, there are some questions that are simply explaining what happened, or if something happened. The time component may need to investigated later, or may be learned as a byproduct of reconstructing the event, but isn't intrinsic to the question being asked.\ne.g. Was this file opened? How many times was this file opened? What data has been exfiltrated?", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1150" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/Timeline", "https://ontology.solveit-df.org/solveit/observable/ArtifactSet", "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/analysis/HypothesisedEvent" ], "references": [] }, "DFT-1156": { "id": "DFT-1156", "name": "Reconstruct if an event could have functionally occurred on a system given its capabilities", "description": "Reconstructing the configuration or capabilities of a system at the time of an event", "synonyms": [ "Functional-based event reconstruction" ], "details": "Considering how a system works and what conditions were necessary for an event to be possible, i.e. supporting or refuting if a hypothesis is feasible.\n\nThis might involve questions such as:\n- is a program or system capable of performing some action\n- how was the program or system configured (to determine if an operation was possible)", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/configuration/Configuration", "https://ontology.unifiedcyberontology.org/uco/configuration/dependencies", "https://ontology.unifiedcyberontology.org/uco/core/confidence" ], "references": [] }, "DFT-1157": { "id": "DFT-1157", "name": "Extract device data using exposed service", "description": "Use an exposed service on a device to extract data. This represents several of the mobile data extraction methods e.g. Query content providers (android), AFC (iOS).", "synonyms": [], "details": "", "subtechniques": [ "DFT-1019" ], "examples": [ "Extraction of data using AFC on iOS", "Android Debug Bridge (ADB) provides command line access when USB debugging is enabled on Android devices", "Extraction of data by querying Content Providers on Android (via ADB)", "Media Transfer Protocol (MTP)" ], "weaknesses": [ "DFW-1037", "DFW-1041", "DFW-1040", "DFW-1271", "DFW-1272", "DFW-1273" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/ServiceBasedExtractionData" ], "references": [] }, "DFT-1158": { "id": "DFT-1158", "name": "Configure device to enable a service needed for data extraction", "description": "Change a setting on a device such that a service needed for data extraction is enabled. This may require a user PIN that can be obtained using other techniques.", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "Turn on developer mode to make use of Android Debug Bridge (ADB)" ], "weaknesses": [ "DFW-1274" ], "CASE_input_classes": [], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1004", "relevance_summary_280": "" } ] }, "DFT-1159": { "id": "DFT-1159", "name": "Extract mobile data via deployed agent", "description": "Deploy software to a mobile device that can carry out some function, either collect data with available permissions or attempt further exploitation e.g. sandbox escape.", "synonyms": [], "details": "While Android agents can be sideloaded with adb, deploying agents on iOS may require a developer account. Output may be equivalent of a file system acquisition if an exploit is successful. Otherwise data such as contacts would be extracted.", "subtechniques": [], "examples": [ "Elcomsoft", "Belkasoft" ], "weaknesses": [ "DFW-1276" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/ServiceBasedExtractionData" ], "references": [ { "DFCite_id": "DFCite-1041", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1016", "relevance_summary_280": "" } ] }, "DFT-1160": { "id": "DFT-1160", "name": "Collect data with 'cloud backup restore' approach", "description": "Restore a device's cloud backup to a donor device, then subsequently use a local acquisition approach on that donor device, e.g. T1019/T1020", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/SmartDevice" ], "references": [ { "DFCite_id": "DFCite-1046", "relevance_summary_280": "" } ] }, "DFT-1161": { "id": "DFT-1161", "name": "Collect data from cloud service via API using credentials", "description": "Copying data from a cloud service using the officially supported API of the provider.", "synonyms": [ "Cloud Data Collection via RESTful API", "API-based cloud acquisition" ], "details": "API-based forensic acquisition of cloud data using the officially supported API of the provider can provide additional details and structure that is not available via other access methods. Requests may target public or undocumented endpoints identified via network observation or reverse engineering. Returned responses may include artifacts such as messages, file metadata, activity logs, and identity attributes. Analysts may use traffic capture tools or instrumentation to extract and store this data for forensic or intelligence purposes, both reactively and proactively.", "subtechniques": [], "examples": [ "Magnet AXIOM Cloud", "Oxygen Forensic Cloud Extractor", "Cellebrite UFED Cloud", "kumodd", "FOREST (open-source cloud forensic tool)" ], "weaknesses": [ "DFW-1356", "DFW-1367", "DFW-1371", "DFW-1372", "DFW-1373", "DFW-1374", "DFW-1375", "DFW-1376", "DFW-1377", "DFW-1357", "DFW-1358", "DFW-1359", "DFW-1360", "DFW-1361", "DFW-1362", "DFW-1363", "DFW-1364", "DFW-1365", "DFW-1366", "DFW-1368", "DFW-1369", "DFW-1370" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/OnlineService" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Message", "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.unifiedcyberontology.org/uco/observable/ContentData", "https://ontology.unifiedcyberontology.org/uco/observable/Account", "https://ontology.unifiedcyberontology.org/uco/observable/EventRecord", "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "references": [ { "DFCite_id": "DFCite-1159", "relevance_summary_280": "Open-source tool that implements this technique by inspecting and tracking RESTful API traffic from cloud client applications." }, { "DFCite_id": "DFCite-1160", "relevance_summary_280": "Proposes a hybrid cloud data acquisition approach that combines API-based collection with other methods." }, { "DFCite_id": "DFCite-1161", "relevance_summary_280": "Early example of API-based forensic acquisition of cloud user data, applied to the Amazon Alexa ecosystem." } ] }, "DFT-1162": { "id": "DFT-1162", "name": "Read data from a device via In-System Programming (ISP)", "description": "", "synonyms": [ "ISCP", "In-circuit serial Programming" ], "details": "", "subtechniques": [ "DFT-1027" ], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Image" ], "references": [ { "DFCite_id": "DFCite-1136", "relevance_summary_280": "" } ] }, "DFT-1163": { "id": "DFT-1163", "name": "Capture mobile device screenshots (automatically)", "description": "Programmatically controlling a mobile device while capturing screenshots of the display.", "synonyms": [], "details": "This is the automated version of DFT-1022. The device is controlled programmatically, and screenshots are captured automatically.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/DeviceScreenshotCapture" ], "references": [ { "DFCite_id": "DFCite-1138", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1137", "relevance_summary_280": "" } ] }, "DFT-1164": { "id": "DFT-1164", "name": "Read data directly from a block device", "description": "Rather than imaging a block device, this involves accessing it directly without the expectation of saving block data to a forensic image format.", "synonyms": [], "details": "This would typically be followed by processing of the data that is read to then provide a live view of partitions and file systems, and facilitates logical file extraction or any other direct operations on the data.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface", "https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed" ], "references": [] }, "DFT-1165": { "id": "DFT-1165", "name": "Extract software configuration information", "description": "Examination of one or more files to extract configuration information for a piece of software.", "synonyms": [], "details": "A configuration file of a browser for example may contain the home page that is set or other information. This technique extracts and presents that configuration information.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/ApplicationFiles" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/configuration/Configuration" ], "references": [] }, "DFT-1166": { "id": "DFT-1166", "name": "Connect directly to storage media", "description": "This technique describes the occasions where it is necessary to connect directly to a disk without a hardware write blocker. This would typically then involve a subseqeunt software write blocker, which then presents a write protected interface.", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1277" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Disk", "https://ontology.unifiedcyberontology.org/uco/observable/StorageMedium" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface" ], "references": [] }, "DFT-1167": { "id": "DFT-1167", "name": "Extract search terms from URLs", "description": "Parsing a URL and extracting search terms from the parameters.", "synonyms": [], "details": "These may be `q=` strings or some other encoded parameters. \n\nThis would include web search URLs such as Google searches but could also include search terms entered into other sites such as travel or shopping sites.", "subtechniques": [], "examples": [ "Google search URLs", "DuckDuckGo search URLs" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/URLHistory", "https://ontology.unifiedcyberontology.org/uco/observable/urlHistoryEntry", "https://ontology.unifiedcyberontology.org/uco/observable/URL" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/keywordSearchTerm" ], "references": [ { "DFCite_id": "DFCite-1065", "relevance_summary_280": "" } ] }, "DFT-1168": { "id": "DFT-1168", "name": "Identify volumes", "description": "From a partition or data from a full disk, identify volumes.", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1300" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed", "https://ontology.unifiedcyberontology.org/uco/observable/DiskPartition" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/FileSystem" ], "references": [] }, "DFT-1169": { "id": "DFT-1169", "name": "Filter files related to an application", "description": "This technique takes a set of files and determines which are related to a specified application.", "synonyms": [], "details": "A research process informs the set of files that are likely to be relevant to a particular application.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/ApplicationFiles", "https://ontology.solveit-df.org/solveit/observable/BrowserAppFiles", "https://ontology.solveit-df.org/solveit/observable/BrowserCacheData", "https://ontology.solveit-df.org/solveit/observable/ChatAppFiles", "https://ontology.solveit-df.org/solveit/observable/AiChatAppFiles", "https://ontology.solveit-df.org/solveit/observable/EmailAppFiles", "https://ontology.solveit-df.org/solveit/observable/HealthAppFiles", "https://ontology.solveit-df.org/solveit/observable/MapsAppFiles", "https://ontology.solveit-df.org/solveit/observable/NavigationAppFiles", "https://ontology.solveit-df.org/solveit/observable/PaymentAppFiles", "https://ontology.solveit-df.org/solveit/observable/RemindersAppFiles", "https://ontology.solveit-df.org/solveit/observable/SocialMediaAppFiles", "https://ontology.solveit-df.org/solveit/observable/CalendarAppFiles", "https://ontology.solveit-df.org/solveit/observable/PhotosAppFiles", "https://ontology.solveit-df.org/solveit/observable/GamingAppFiles" ], "references": [] }, "DFT-1170": { "id": "DFT-1170", "name": "Read contents from logical forensic container file(s)", "description": "Decodes logical image formats such as L01, AD1, CTR, or AFF4-L. The output here is not an image file but rather a set of files and their metadata.", "synonyms": [ "Logical image decoding", "Read logical image" ], "details": "", "subtechniques": [], "examples": [ "L01", "AD1", "CTR", "AFF4-L" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/LogicalImageContainer" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "references": [ { "DFCite_id": "DFCite-1035", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1069", "relevance_summary_280": "" } ] }, "DFT-1171": { "id": "DFT-1171", "name": "Access a file system via live operating system", "description": "This involves accessing a live system and relying on the operating system's parsing of the file system to access files.", "synonyms": [ "Access file system via the running operating system" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Computer" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "references": [] }, "DFT-1172": { "id": "DFT-1172", "name": "Read bitstream from raw image file(s)", "description": "This technique reads data from a raw image e.g. a dd image.", "synonyms": [ "read dd file" ], "details": "This provides the 'raw' equivalent of reading data from a forensic image container e.g. EWF. This provides random access to the bitstream so the stored sectors can be processed further.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/RawImage" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed" ], "references": [] }, "DFT-1173": { "id": "DFT-1173", "name": "Extract data from captured screenshots", "description": "Processing a screenshot captured from a device to extract data for further processing.", "synonyms": [], "details": "When data has been captured from devices as screenshots, data can be extracted from them using OCR techniques to incorporate into the broader case data e..g to make searchable.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/DeviceScreenshotCapture" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Message", "https://ontology.unifiedcyberontology.org/uco/observable/Contact" ], "references": [] }, "DFT-1174": { "id": "DFT-1174", "name": "Read evidential files stored directly on local file system", "description": "Represents reading files that have been acquired or extracted directly to the local file system.", "synonyms": [], "details": "For example an ADB pull command against a directory can result in a set of files copied to the local file system. This represents reading those files directly to extract information.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.solveit-df.org/solveit/observable/ADBPullData", "https://ontology.solveit-df.org/solveit/observable/AFCExtractionData" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "references": [] }, "DFT-1175": { "id": "DFT-1175", "name": "Extract data from an Android device using content queries", "description": "Use of content queries on Android devices via adb to extract specific pieces of data exposed by content providers.", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/AndroidPhone" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Message", "https://ontology.unifiedcyberontology.org/uco/observable/Call", "https://ontology.unifiedcyberontology.org/uco/observable/Contact" ], "references": [ { "DFCite_id": "DFCite-1047", "relevance_summary_280": "" } ] }, "DFT-1176": { "id": "DFT-1176", "name": "Classify if an image is potentially synthetically generated", "description": "Classification of images with respect to their origin, i.e., whether they are synthetically generated or naturally captured by a camera.", "synonyms": [ "Deepfake Detection, Synthetic Image Detection, Image Source Attribution, Image Authentication, Image Source Classification" ], "details": "An image is analyzed using a method from the subtechniques. The output can be a classifier-predicted score of how many traces of synthetic origin can be found in an image, or extracted traces from the image that aid the analyst in their assessment of the image origin.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/RasterPicture" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification" ], "references": [] }, "DFT-1177": { "id": "DFT-1177", "name": "Extract artifacts from multiplayer game app(s)", "description": "Extracting artifacts from multiplayer gaming apps.", "synonyms": [ "gaming app examination" ], "details": "Multiplayer game apps often offer messaging, contacts/friends, and other features that could contain data that may be relevant to many types of case.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1279", "DFW-1287", "DFW-1288", "DFW-1289", "DFW-1290", "DFW-1291", "DFW-1292", "DFW-1293", "DFW-1294", "DFW-1280", "DFW-1281", "DFW-1282", "DFW-1283", "DFW-1284", "DFW-1285", "DFW-1286" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/GamingAppFiles" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Message", "https://ontology.unifiedcyberontology.org/uco/observable/Contact", "https://ontology.unifiedcyberontology.org/uco/configuration/Configuration", "https://ontology.unifiedcyberontology.org/uco/observable/Account" ], "references": [ { "DFCite_id": "DFCite-1143", "relevance_summary_280": "" } ] }, "DFT-1178": { "id": "DFT-1178", "name": "Store bitstream data in a raw image format", "description": "Storage of bitstream data recovered from a digital device as raw files.", "synonyms": [ "store dd image", "write dd image" ], "details": "Bitstream data resulting from disk imaging stored in a raw format. The imaged data may be stored as one file or split into several segments. The raw files may also be accompanied by complementary separate metadata files.", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/Bitstream" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/RawImage" ], "references": [] }, "DFT-1179": { "id": "DFT-1179", "name": "Extract artifacts from drone/UAV app(s)", "description": "The examination of a mobile app used to control Unmanned Areial Vehicles (UAVs) or 'drones'.", "synonyms": [ "UAV app examination" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [], "CASE_input_classes": [], "CASE_output_classes": [], "references": [] }, "DFT-1180": { "id": "DFT-1180", "name": "Extract file(s) from a pre-deletion container", "description": "An examination of the operating system structures that represent the 'pre-deletion' container (i.e. Recycle Bin/Trash) to extract those files and potentially additional metadata such as original path or date it was moved.", "synonyms": [ "Recycle Bin examination", "Trash examination" ], "details": "Content in pre-deletion containers such as the recycle bin/trash is not always viewable in a useful form without further processing. \nThis further processing should provide access to the file content but also potentially additional information such as data sent to recycle bin, or original path.", "subtechniques": [], "examples": [ "Windows Recycle Bin", "macOS Trash" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/File", "https://ontology.unifiedcyberontology.org/uco/observable/path", "https://ontology.solveit-df.org/solveit/observable/DateTimeStamp" ], "references": [] }, "DFT-1181": { "id": "DFT-1181", "name": "Extract artifacts from smart home app(s)", "description": "Examine the data stored by an app designed to control, monitor or program smart home capabilities.", "synonyms": [], "details": "There are many other components to a smart home system including the devices themselves (possibly different hubs and sensors), plus the online content. This technique focuses on the app.", "subtechniques": [], "examples": [ "SmartThings", "Apple Home", "Philips Hue" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/SmartHomeAppFiles" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/location/Location" ], "references": [] }, "DFT-1182": { "id": "DFT-1182", "name": "Filter a timeline for relevant entries", "description": "Provide some criteria that selects only a subset of timeline entries from a set. ", "synonyms": [], "details": "Filtering might be on timestamp type, within a defined time range, related to a particular file, or matching against some other content associated with the timestamp entries. ", "subtechniques": [], "examples": [ "Plaso", "TimeSketch" ], "weaknesses": [ "DFW-1295", "DFW-1296", "DFW-1297", "DFW-1298", "DFW-1299" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/Timeline" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/Timeline" ], "references": [] }, "DFT-1184": { "id": "DFT-1184", "name": "Sort a timeline so entries are ordered chronologically", "description": "Order a timeline based on the values in the timestamp entry.", "synonyms": [], "details": "This may be applied automatically to a generated timeline or may be applied as a separate process. ", "subtechniques": [], "examples": [ "Plaso", "TimeSketch" ], "weaknesses": [ "DFW-1308", "DFW-1309", "DFW-1310", "DFW-1311", "DFW-1312", "DFW-1313", "DFW-1314" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/Timeline" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/SortedTimeline" ], "references": [] }, "DFT-1185": { "id": "DFT-1185", "name": "Extract data from operating system notifications", "description": "Recovery of the notifications produced by applications that are stored by the operating system. ", "synonyms": [ "Notification analysis", "WPN analysis" ], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1315", "DFW-1316", "DFW-1317", "DFW-1318", "DFW-1319", "DFW-1320", "DFW-1321" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Message" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Message", "https://ontology.solveit-df.org/solveit/observable/DateTimeStamp" ], "references": [ { "DFCite_id": "DFCite-1149", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1150", "relevance_summary_280": "" } ] }, "DFT-1186": { "id": "DFT-1186", "name": "Compute per-file hash values", "description": "The process of computing one or more hash digests for each file in a set, producing per-file digests that can subsequently be used for matching, deduplication, or integrity comparison.", "synonyms": [ "File hashing", "Per-file hashing" ], "details": "This technique does vary based on the kind of digest produced: cryptographic-digest computation for exact matching, and fuzzy or similarity-digest computation for approximate matching. \n\nThe output of this technique is typically consumed by hash-matching techniques including DFT-1047, DFT-1050, and DFT-1051. \n\nThis technique is distinct from DFT-1042, which hashes the entire bitstream of a source device for acquisition integrity rather than individual files within the file system.", "subtechniques": [], "examples": [ "Autopsy hash lookup ingest module computing per-file hashes", "md5sum / sha256sum applied recursively over a mounted forensic image" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/hash" ], "references": [] }, "DFT-1187": { "id": "DFT-1187", "name": "Extract content from compound files", "description": "The process of extracting files and objects contained within compound files, including archives, Office documents, PDFs, and email containers, surfacing the contained items as first-class files for further analysis.", "synonyms": [ "Container file expansion", "Compound file expansion", "Embedded file extraction" ], "details": "'Compound file' is used here in the broad sense: any file format whose payload is one or more other files. \n\nThis covers user-downloaded archives (.zip, .rar, .7z, .tar), images and objects embedded in Office documents (.docx / .xlsx / .pptx, and legacy .doc / .xls / .ppt that use the Microsoft Compound File Binary Format, attachments and embedded streams in PDFs, and attachments inside email containers. \n\nExtracting them surfaces each contained item as a first-class file so downstream techniques such as file-type identification, extension-mismatch detection, and hash matching can operate on the content. \n\nThis is distinct from DFT-1045, which decodes archive containers produced by the forensic extraction pipeline (e.g. an iOS file-system extraction packaged as a TAR file); this technique is applied later in the workflow, against compound files encountered within user data. The technique should be applied recursively because extracted items may themselves be compound files.", "subtechniques": [], "examples": [ "Autopsy Embedded File Extractor module" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/File" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "references": [] }, "DFT-1190": { "id": "DFT-1190", "name": "Extract operating system version(s) from data source", "description": "The process of extracting and processing the artifacts that describe the current operating system version and associated version details e.g. build, service pack etc.", "synonyms": [], "details": "Each operating system will have a specific artifact that allows this to be performed e.g. details from the Registry on Windows. \n\nIt is also sometimes possible to determine older versions of the operating system which have been used, with timestamps, which may be useful for later functional reconstruction (DFT-1156)", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1324", "DFW-1325", "DFW-1326", "DFW-1327", "DFW-1328", "DFW-1329" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet" ], "CASE_output_classes": [], "references": [ { "DFCite_id": "DFCite-1157", "relevance_summary_280": "" } ] }, "DFT-1191": { "id": "DFT-1191", "name": "Parse allocated structures in Windows HIVE files", "description": "Enumerate the allocated structures within HIVE files (typically Windows Registry) to extract the tree structure along with keys and their values. ", "synonyms": [ "Registry analysis" ], "details": "This focuses on the data structure enumeration only, rather than taking a specific key and performing analysis on the data contained within. It covers allocated keys and values only.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1330", "DFW-1331", "DFW-1332", "DFW-1333", "DFW-1334", "DFW-1335", "DFW-1336", "DFW-1337" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/WindowsRegistryHive" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/WindowsRegistryKey", "https://ontology.unifiedcyberontology.org/uco/observable/WindowsRegistryValue" ], "references": [ { "DFCite_id": "DFCite-1158", "relevance_summary_280": "" } ] }, "DFT-1192": { "id": "DFT-1192", "name": "Disable connectivity using device configuration settings", "description": "This involves changing settings on a device to attempt to remove any connectivity options so that data cannot be sent or received over typical RF channels. This may involve multiple settings e.g. airplane mode and separate Bluetooth and WiFi toggles.", "synonyms": [], "details": "", "subtechniques": [], "examples": [ "airplane mode", "flight mode" ], "weaknesses": [ "DFW-1340", "DFW-1341", "DFW-1342", "DFW-1343" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice" ], "references": [] }, "DFT-1193": { "id": "DFT-1193", "name": "Read metadata from within a forensic image container", "description": "The processes of reading the metadata values stored within forensic container formats", "synonyms": [], "details": "This has been differentiated from reading data from text files that accompany raw disk images, but includes metadata stored within logical formats. ", "subtechniques": [], "examples": [ "EWF", "AFF4" ], "weaknesses": [ "DFW-1344", "DFW-1348", "DFW-1349", "DFW-1350", "DFW-1351", "DFW-1352", "DFW-1353", "DFW-1354", "DFW-1355", "DFW-1345", "DFW-1346", "DFW-1347" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer", "https://ontology.solveit-df.org/solveit/observable/LogicalImageContainer" ], "CASE_output_classes": [ "https://ontology.caseontology.org/case/investigation/exhibitNumber", "https://ontology.unifiedcyberontology.org/uco/core/name", "https://ontology.unifiedcyberontology.org/uco/observable/Note", "https://ontology.unifiedcyberontology.org/uco/core/description", "https://ontology.unifiedcyberontology.org/uco/types/Hash" ], "references": [] }, "DFT-1194": { "id": "DFT-1194", "name": "Classify if audio is potentially synthetically generated", "description": "Classification of audio with respect to its origin, i.e., whether it is synthetically generated (e.g. text-to-speech synthesis or voice conversion) or naturally captured from a live speaker.", "synonyms": [ "Audio deepfake detection", "Synthetic speech detection", "Voice clone detection", "Audio anti-spoofing", "Speech spoofing countermeasure" ], "details": "Audio content is analyzed for traces of synthetic generation. Methods include neural anti-spoofing classifiers (e.g. spectro-temporal graph attention networks trained on spoofed/bona-fide speech corpora) and signal-level analyses such as higher-order spectral (bispectral) statistics. The output is typically a classifier-predicted score or confidence that the audio is synthetically generated, or extracted signal traces that aid the analyst in assessing the audio's origin. This completes the modality triad alongside the existing video (DFT-1106) and image (DFT-1176) synthetic-classification techniques.", "subtechniques": [], "examples": [ "AASIST-family neural anti-spoofing classifiers", "ASVspoof challenge countermeasure systems", "Bispectral / higher-order spectral analysis of speech", "Project VIC Media Authentication Analyzer (AASIST-L neural detector + bispectrum heuristic in production)" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/AudioFile" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification" ], "references": [] }, "DFT-1195": { "id": "DFT-1195", "name": "Generate Alternative Hypotheses", "description": "The process of considering what are the alternative possibilities (other than the proposed hypothesis) for the digital forensic artifacts/traces that we are observing", "synonyms": [ "Claim", "Proposition" ], "details": "Considering alternative hypotheses is fundamental to scientific practices, and assists in mitigating the potential influence of bias. In investigative mode, experts generate possible explanations. In evaluative mode for expert opinion in court proceedings, the expert focuses on disputed issues and evaluates their observations.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1379", "DFW-1380", "DFW-1381", "DFW-1382", "DFW-1383", "DFW-1384", "DFW-1385", "DFW-1386" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/analysis/Hypothesis", "https://ontology.unifiedcyberontology.org/uco/observable/Observable" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/analysis/HypothesisSet" ], "references": [] }, "DFT-1196": { "id": "DFT-1196", "name": "Extract operating system installation date", "description": "Extract the date and time recorded as the installation date of the operating system.", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1387", "DFW-1388", "DFW-1389", "DFW-1390", "DFW-1391", "DFW-1392" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Observable" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/installDate" ], "references": [ { "DFCite_id": "DFCite-1157", "relevance_summary_280": "Discusses artifact locations for Windows installation date and details of older versions." } ] }, "DFT-1197": { "id": "DFT-1197", "name": "Determine mount point mappings within an operating system", "description": "This involves establishing what mount points (including drive letters) within an operating system are mapped to, either a partition or device. ", "synonyms": [ "drive letter mapping" ], "details": "On Windows this will typically be mapping drive letters to specific partitions on local disks or removable media, DVD drives, or even mounted encrypted containers. \n\nThe term 'mount point mapping' is used here to include drive letters on Windows and the use of folders as mount points on other operating systems.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1393", "DFW-1394", "DFW-1395", "DFW-1396" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Observable" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/Device", "https://ontology.unifiedcyberontology.org/uco/observable/DiskPartition", "https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship", "https://ontology.unifiedcyberontology.org/uco/observable/mountPoint", "https://ontology.unifiedcyberontology.org/uco/observable/driveLetter" ], "references": [] }, "DFT-1198": { "id": "DFT-1198", "name": "Compute hash of data read from source device", "description": "Process data accessed on a source device (e.g. attached disk or other media) and compute the cryptographic hash of the data", "synonyms": [], "details": "", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1397", "DFW-1398", "DFW-1399", "DFW-1400" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/Bitstream" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/types/Hash" ], "references": [] }, "DFT-1199": { "id": "DFT-1199", "name": "Compute hash of stored bitstream data", "description": "Cryptographically hashing either data exposed directly from a raw image or a decompressed physical image from a container format.", "synonyms": [], "details": "This is usually then compared with a hash stored internally in the disk image, or externally in a text file or another external source.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1401", "DFW-1402" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/types/Hash" ], "references": [] }, "DFT-1200": { "id": "DFT-1200", "name": "Evaluate observations in light of hypotheses", "description": "The process of assessing the probability or strength of the observations under each of two or more competing hypotheses, and expressing the strength of support for one over another.", "synonyms": [ "Evaluative interpretation", "Evidence evaluation", "Likelihood ratio assessment", "Scientific interpretation" ], "details": "In evaluative mode the hypotheses are fixed before evaluation begins and are taken as given, typically from DFT-1195; this technique does not formulate or revise them. The examiner assesses how probable or strong the observations are under each hypothesis in turn, assuming each to be true. Assigning a probability or strength to the observations under a hypothesis requires knowledge of how the system behaves under that hypothesis, drawn from DFT-1090 or from published data. The technique concludes with the strength of support expressed as a likelihood ratio, its verbal equivalent, or other method. Conveying that opinion is DFT-1093.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1403", "DFW-1404", "DFW-1405", "DFW-1406", "DFW-1407" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/analysis/HypothesisSet", "https://ontology.unifiedcyberontology.org/uco/observable/Observable" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult" ], "references": [ { "DFCite_id": "DFCite-1163", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1164", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1165", "relevance_summary_280": "" } ] }, "DFT-1202": { "id": "DFT-1202", "name": "Verify automated results manually", "description": "The process of manually reviewing the results from an automated process and checking the results are correct.", "synonyms": [ "manual verification" ], "details": "", "subtechniques": [], "examples": [ "Checking the decoding of a timestamp", "Checking that a recovered record exists" ], "weaknesses": [], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult", "https://ontology.unifiedcyberontology.org/uco/observable/ObservableObject" ], "CASE_output_classes": [ "https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult" ], "references": [] }, "DFT-1203": { "id": "DFT-1203", "name": "Use an AI-based prompt for interrogating case data", "description": "Using an AI-based chat interface to query the data within a case.", "synonyms": [], "details": "Behind this interface this could include querying artefacts extracted into a database and/or running tools dynamically.", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1422", "DFW-1433", "DFW-1444", "DFW-1450", "DFW-1451", "DFW-1452", "DFW-1453", "DFW-1454", "DFW-1455", "DFW-1423", "DFW-1424", "DFW-1425", "DFW-1426", "DFW-1427", "DFW-1428", "DFW-1429", "DFW-1430", "DFW-1431", "DFW-1432", "DFW-1434", "DFW-1435", "DFW-1436", "DFW-1437", "DFW-1438", "DFW-1439", "DFW-1440", "DFW-1441", "DFW-1442", "DFW-1443", "DFW-1445", "DFW-1446", "DFW-1447", "DFW-1448", "DFW-1449" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/FileSet", "https://ontology.solveit-df.org/solveit/observable/ArtifactSet" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/analysis/HypothesisedEvent", "https://ontology.solveit-df.org/solveit/observable/ArtifactSet", "https://ontology.unifiedcyberontology.org/uco/core/Annotation", "https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship" ], "references": [ { "DFCite_id": "DFCite-1169", "relevance_summary_280": "Proposes a methodology and public Windows 11 timeline dataset with ground truth for quantitatively evaluating LLM-based querying of forensic timeline data, with a ChatGPT case study (Sections 3-4)." } ] }, "DFT-1204": { "id": "DFT-1204", "name": "Verify hash of stored bitstream data matches a stored hash", "description": "Compares a hash computed over stored bitstream data against a recorded hash, to assess whether the stored data has changed since it was written.", "synonyms": [], "details": "The stored hash may be held inside the forensic image container, in an associated text file, or in a separate trusted location. \n\nThe same comparison applies in each case. The hash over the stored data is produced by DFT-1199 (Compute hash of stored bitstream data), and a hash held inside a container is read using DFT-1193 (Read metadata from within a forensic image container). \n\nThis technique covers verification carried out after imaging has finished, whereas DFT-1042 (Verify hash of copied data matches the hash of the data read from source device) covers the comparison made *during imaging* against a hash of data read from the source device.", "subtechniques": [], "examples": [ "ewfverify" ], "weaknesses": [ "DFW-1042", "DFW-1128", "DFW-1127" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/types/Hash" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/HashVerificationResult" ], "references": [ { "DFCite_id": "DFCite-1168", "relevance_summary_280": "" } ] }, "DFT-1205": { "id": "DFT-1205", "name": "Decode raw data into data value(s)", "description": "The process of interpreting a sequence of bytes as a typed value, such as a number, a string, or a date, under an assumed encoding.", "synonyms": [], "details": "Decoding is performed inside many other techniques rather than as a separate examination step, which is why its failures are currently recorded against whichever technique consumed the value. This provides a generic version of the technique. \n\nRelated techniques that depend on it include DFT-1191 (Parse allocated structures in Windows HIVE files), DFT-1071 (Extract data from SQLite database(s)) and DFT-1121 (Index a data source for keyword searching). DFT-1044 and DFT-1102 decode specific container formats rather than typed values. ", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1456" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ContentData" ], "CASE_output_classes": [], "references": [] }, "DFT-1206": { "id": "DFT-1206", "name": "Decode a number from raw data", "description": "The process of interpreting a sequence of bytes as a numeric value under an assumed width, signedness, and byte order.", "synonyms": [], "details": "Numeric decoding underlies most structured parsing, for example DFT-1191 (Parse allocated structures in Windows HIVE files), where values such as REG_DWORD and REG_QWORD are stored as raw integers. \n\nThis technique groups numbers together to include signed and unsigned, integers and floats, different endianness, and number of bytes considered in the decoding.\n\nNote that strings and timestamps are considered in separate techniques. \n", "subtechniques": [], "examples": [], "weaknesses": [ "DFW-1457", "DFW-1458", "DFW-1459", "DFW-1460", "DFW-1461", "DFW-1462", "DFW-1463", "DFW-1464", "DFW-1465" ], "CASE_input_classes": [ "https://ontology.unifiedcyberontology.org/uco/observable/ContentData" ], "CASE_output_classes": [], "references": [] }, "DFT-1208": { "id": "DFT-1208", "name": "Store acquisition metadata along with a forensic image format", "description": "Records details such as case and examiner details, and the acquisition hash, with a forensic image container alongside the bitstream data or logical files. ", "synonyms": [], "details": "This is the counterpart of DFT-1193, which reads these same values back. \n\nContainer formats such as EWF and AFF4 carry a case number, evidence number, examiner name, notes and description, together with the cryptographic hash computed during acquisition. \n\nDFT-1025 stores the bitstream itself, whereas this technique records the metadata that accompanies it. The hash written here is the value later verified against by DFT-1204. \n\nMetadata accompanying a raw image is held in a separate file rather than within a container, and is not covered by this technique.", "subtechniques": [], "examples": [ "ewfacquire" ], "weaknesses": [ "DFW-1473", "DFW-1474", "DFW-1475", "DFW-1476", "DFW-1477", "DFW-1478" ], "CASE_input_classes": [ "https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer", "https://ontology.solveit-df.org/solveit/observable/LogicalImageContainer", "https://ontology.caseontology.org/case/investigation/exhibitNumber", "https://ontology.unifiedcyberontology.org/uco/core/name", "https://ontology.unifiedcyberontology.org/uco/core/description", "https://ontology.unifiedcyberontology.org/uco/observable/Note", "https://ontology.unifiedcyberontology.org/uco/types/Hash" ], "CASE_output_classes": [ "https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer", "https://ontology.solveit-df.org/solveit/observable/LogicalImageContainer" ], "references": [] } }, "weaknesses": { "DFW-1001": { "id": "DFW-1001", "name": "Excluding a device during triage that contains relevant information", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1002": { "id": "DFW-1002", "name": "Use of triage technology results in changes to the target media", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1007", "DFM-1008" ], "references": [] }, "DFW-1003": { "id": "DFW-1003", "name": "Triage tool applies a simplification that does not correctly represent the meaning of the digital data", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1001" ], "references": [] }, "DFW-1004": { "id": "DFW-1004", "name": "Data copied does not include all sectors from LBA0 to LBA max due to the data copying process stopping prematurely", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1003", "DFM-1004", "DFM-1331" ], "references": [] }, "DFW-1005": { "id": "DFW-1005", "name": "Dogs fail to find a digital device", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1006": { "id": "DFW-1006", "name": "Acquisition tool does not copy data from HPA", "description": "Some forensic acquisition tools do not detect or acquire data stored within the HPA (Host Protected Area), resulting in an incomplete forensic image that omits potentially evidential data. This weakness arises because accessing the HPA typically requires issuing specific ATA commands (such as SET MAX ADDRESS) to temporarily remove the protection before imaging, a capability not universally implemented across acquisition tools (Gupta, Hoeschele and Rogers, 2006).", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1005", "DFM-1003" ], "references": [ { "DFCite_id": "DFCite-1052", "relevance_summary_280": "" } ] }, "DFW-1007": { "id": "DFW-1007", "name": "Acquisition tool does not copy data from DCO", "description": "The Device Configuration Overlay (DCO) is a feature of the ATA standard that allows hardware vendors or system manufacturers to permanently hide a portion of a hard disk drive's capacity from the host system, including the operating system and forensic acquisition tools. Unlike the HPA, the DCO operates at a lower level and persists across power cycles, meaning that without issuing specific ATA commands (such as DEVICE CONFIGURATION RESTORE) the hidden area remains inaccessible. Acquisition tools that do not detect or interact with the DCO will produce an incomplete forensic image, potentially missing evidential data stored in this region (Gupta, Hoeschele and Rogers, 2006).", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1006", "DFM-1003" ], "references": [ { "DFCite_id": "DFCite-1052", "relevance_summary_280": "" } ] }, "DFW-1008": { "id": "DFW-1008", "name": "Missing the existence of a device by missing synchronisation artefacts", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1059", "DFM-1057", "DFM-1027" ], "references": [] }, "DFW-1009": { "id": "DFW-1009", "name": "Missing the existence of a device by incorrectly parsing synchronisation artefacts", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1057" ], "references": [] }, "DFW-1010": { "id": "DFW-1010", "name": "Misattributing activity to the wrong device", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1058" ], "references": [] }, "DFW-1011": { "id": "DFW-1011", "name": "Suggesting the existence of a device that does not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1058", "DFM-1027" ], "references": [] }, "DFW-1012": { "id": "DFW-1012", "name": "Interaction with the target devices to read data causes changes", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1007", "DFM-1008" ], "references": [] }, "DFW-1013": { "id": "DFW-1013", "name": "During acquisition the data copying process results in extra bytes", "description": "These ", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1003", "DFM-1004" ], "references": [] }, "DFW-1014": { "id": "DFW-1014", "name": "Accessing the drive to copy data changes original data", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1007", "DFM-1008" ], "references": [] }, "DFW-1015": { "id": "DFW-1015", "name": "Powering on SSD results in sectors being wiped by TRIM operation", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT", "ASTM_INAC_COR" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1036", "relevance_summary_280": "" } ] }, "DFW-1016": { "id": "DFW-1016", "name": "Data copied from sectors on source device are not transferred correctly for storage", "description": "This describes some data transformation that happens inside the imaging tool that results in a mismatch between the source and destination data", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1004", "DFM-1331" ], "references": [] }, "DFW-1017": { "id": "DFW-1017", "name": "Files or data that is relevant to the investigation is missed", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1018": { "id": "DFW-1018", "name": "Data is collected that is not relevant to the investigation", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [], "references": [] }, "DFW-1019": { "id": "DFW-1019", "name": "Data is collected and assigned to incorrect device", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [], "references": [] }, "DFW-1020": { "id": "DFW-1020", "name": "Content of data collected is incorrect", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [], "references": [] }, "DFW-1021": { "id": "DFW-1021", "name": "Metadata of data collected is missing", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1022": { "id": "DFW-1022", "name": "Metadata of data collected is incorrect", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [], "references": [] }, "DFW-1023": { "id": "DFW-1023", "name": "Collection process changes content of data on target", "description": "", "categories": [ "ASTM_INAC_ALT", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1007", "DFM-1008" ], "references": [] }, "DFW-1024": { "id": "DFW-1024", "name": "Collection process changes metadata of data on target", "description": "", "categories": [ "ASTM_INAC_ALT", "ASTM_INAC_COR" ], "mitigations": [], "references": [] }, "DFW-1025": { "id": "DFW-1025", "name": "Data relevant to the case is excluded as part of the filtering process", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1010", "DFM-1011" ], "references": [] }, "DFW-1026": { "id": "DFW-1026", "name": "Selective extraction of a backup implies partial collection when it is in reality a full collection followed by deletion.", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1012" ], "references": [] }, "DFW-1027": { "id": "DFW-1027", "name": "Including data that was meant to be excluded with the selected filters", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [], "references": [] }, "DFW-1028": { "id": "DFW-1028", "name": "Due to the use of time based filters data extracted may be presented out of context", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1010", "DFM-1011" ], "references": [] }, "DFW-1029": { "id": "DFW-1029", "name": "Memory smearing may result in pointers being inconsistent within the memory image", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1086", "DFM-1088" ], "references": [ { "DFCite_id": "DFCite-1111", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1072", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1110", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1116", "relevance_summary_280": "" } ] }, "DFW-1030": { "id": "DFW-1030", "name": "Loading a memory imaging tool makes changes to the data in memory that is being acquired", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1087" ], "references": [ { "DFCite_id": "DFCite-1023", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1128", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1051", "relevance_summary_280": "" } ] }, "DFW-1031": { "id": "DFW-1031", "name": "Loading a memory imaging tool overwrites relevant data within memory", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1032": { "id": "DFW-1032", "name": "Not all memory is acquired", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1128", "relevance_summary_280": "" } ] }, "DFW-1033": { "id": "DFW-1033", "name": "Data referenced in memory is located within pagefile or swapfile but is not collected", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1240" ], "references": [ { "DFCite_id": "DFCite-1025", "relevance_summary_280": "" } ] }, "DFW-1034": { "id": "DFW-1034", "name": "Missing data from the running system due to the device being compromised (e.g. rootkit)", "description": "Malicious software on a device may limit the data reported via queries made to a running device.", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1013" ], "references": [] }, "DFW-1035": { "id": "DFW-1035", "name": "Collecting incorrect data from a running system due to the device being compromised (e.g. rootkit)", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_EX", "ASTM_INAC_AS", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1013" ], "references": [] }, "DFW-1036": { "id": "DFW-1036", "name": "Overwriting relevant data with changes caused by running the live tools", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1014", "DFM-1015" ], "references": [ { "DFCite_id": "DFCite-1062", "relevance_summary_280": "" } ] }, "DFW-1037": { "id": "DFW-1037", "name": "Presenting data from a mobile backup as complete, when it is in reality a partial set of files from the device", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1016", "DFM-1020" ], "references": [] }, "DFW-1038": { "id": "DFW-1038", "name": "Backup process returns an incomplete set of backup data", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1039": { "id": "DFW-1039", "name": "Backup data collection overwrites important data", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [], "references": [] }, "DFW-1040": { "id": "DFW-1040", "name": "Not considering SD Card acquisition in addition to other extractions performed", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1017", "DFM-1018" ], "references": [] }, "DFW-1041": { "id": "DFW-1041", "name": "Not considering file system acquisition as alternative", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1019" ], "references": [] }, "DFW-1042": { "id": "DFW-1042", "name": "Disk image was tampered with, but manipulated to have a collision with original hash", "description": "", "categories": [ "ASTM_INAC_COR" ], "mitigations": [ "DFM-1021", "DFM-1022", "DFM-1023", "DFM-1070" ], "references": [] }, "DFW-1043": { "id": "DFW-1043", "name": "Data is written to forensic format that does not preserve the original raw data", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1009" ], "references": [] }, "DFW-1044": { "id": "DFW-1044", "name": "Failing to extract a decryption key that is present", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1025" ], "references": [] }, "DFW-1045": { "id": "DFW-1045", "name": "Extracting an incorrect decryption key", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1024" ], "references": [] }, "DFW-1046": { "id": "DFW-1046", "name": "File not recovered from the stored backup", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1026", "DFM-1027" ], "references": [] }, "DFW-1047": { "id": "DFW-1047", "name": "File recovered from backup that did not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1026", "DFM-1027" ], "references": [] }, "DFW-1048": { "id": "DFW-1048", "name": "File recovered from backup but presented in the wrong location", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1026", "DFM-1027" ], "references": [] }, "DFW-1049": { "id": "DFW-1049", "name": "File content recovered incorrectly from backup", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1026", "DFM-1027" ], "references": [] }, "DFW-1050": { "id": "DFW-1050", "name": "Failure to highlight that there are other apps present for which data is not available", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1028" ], "references": [] }, "DFW-1051": { "id": "DFW-1051", "name": "Failure to highlight that not all app data may be present in a backup", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1028" ], "references": [] }, "DFW-1052": { "id": "DFW-1052", "name": "Incorrect retrieval of results from an index", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_EX" ], "mitigations": [ "DFM-1030", "DFM-1034" ], "references": [] }, "DFW-1053": { "id": "DFW-1053", "name": "Incorrect parsing of a supplied regular expression used for keyword searching", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1035", "DFM-1036" ], "references": [] }, "DFW-1054": { "id": "DFW-1054", "name": "Data not indexed for keyword searching due to text encoding", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1029", "DFM-1034", "DFM-1146" ], "references": [] }, "DFW-1055": { "id": "DFW-1055", "name": "Data not indexed for keyword searching due to missing substring feature", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1029", "DFM-1034", "DFM-1147" ], "references": [] }, "DFW-1056": { "id": "DFW-1056", "name": "Data not indexed for keyword searching due to case sensitivity problem", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1029", "DFM-1034", "DFM-1148" ], "references": [] }, "DFW-1057": { "id": "DFW-1057", "name": "Relevant keyword results not captured by the case-type keyword list used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1031", "DFM-1032" ], "references": [] }, "DFW-1058": { "id": "DFW-1058", "name": "Results appear in an ‘artefact’ or ‘result’ but the context, source or provenance of result is unclear", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1037" ], "references": [] }, "DFW-1059": { "id": "DFW-1059", "name": "Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1032", "DFM-1033", "DFM-1038" ], "references": [] }, "DFW-1060": { "id": "DFW-1060", "name": "A relevant piece of media was not flagged as relevant", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1039", "DFM-1040", "DFM-1041" ], "references": [] }, "DFW-1061": { "id": "DFW-1061", "name": "An irrelevant piece of media was flagged as relevant", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1039", "DFM-1040", "DFM-1041", "DFM-1042" ], "references": [] }, "DFW-1062": { "id": "DFW-1062", "name": "The grade or specific tag given to item is incorrect", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1039", "DFM-1040", "DFM-1041", "DFM-1042" ], "references": [] }, "DFW-1063": { "id": "DFW-1063", "name": "Incorrectly parsing the partitions table(s)", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_EX" ], "mitigations": [ "DFM-1047", "DFM-1050", "DFM-1027" ], "references": [] }, "DFW-1064": { "id": "DFW-1064", "name": "Making incorrect assumptions about sector size e.g. 512 rather than 4096", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1045", "DFM-1046" ], "references": [ { "DFCite_id": "DFCite-1126", "relevance_summary_280": "" } ] }, "DFW-1065": { "id": "DFW-1065", "name": "Failing to correctly parse start sector pointers from partition tables", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_EX" ], "mitigations": [ "DFM-1047" ], "references": [] }, "DFW-1066": { "id": "DFW-1066", "name": "Missing deleted but recoverable partitions from unpartitioned space", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1043", "DFM-1044" ], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1061", "relevance_summary_280": "" } ] }, "DFW-1067": { "id": "DFW-1067", "name": "Failure to check the integrity of partition table (where possible e.g. GPT)", "description": "", "categories": [ "ASTM_INAC_COR" ], "mitigations": [ "DFM-1048", "DFM-1049" ], "references": [] }, "DFW-1068": { "id": "DFW-1068", "name": "Failing to identify the existence of an allocated file", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1069": { "id": "DFW-1069", "name": "Failing to identify the existence of an allocated directory", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1070": { "id": "DFW-1070", "name": "Failing to recover the complete contents of an allocated file", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1071": { "id": "DFW-1071", "name": "Failing to recover a complete listing of an allocated directory", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1072": { "id": "DFW-1072", "name": "Recovering incorrect contents of an allocated file", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1073": { "id": "DFW-1073", "name": "Recovering an incorrect listing of an allocated directory", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1074": { "id": "DFW-1074", "name": "Attributing a file to the wrong directory", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1075": { "id": "DFW-1075", "name": "Presenting a file that does not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1076": { "id": "DFW-1076", "name": "Presenting a directory that does not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1077": { "id": "DFW-1077", "name": "Presenting a non-allocated file as an allocated file", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1078": { "id": "DFW-1078", "name": "Presenting an allocated file as non-allocated", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1079": { "id": "DFW-1079", "name": "Recovering incorrect metadata about a file", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1080": { "id": "DFW-1080", "name": "Recovering incorrect metadata about a directory", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1081": { "id": "DFW-1081", "name": "Failing to recover file system metadata", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1082": { "id": "DFW-1082", "name": "Recovering file system metadata incorrectly", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1083": { "id": "DFW-1083", "name": "Failure to recover additional specialised file system specific content e.g. Alternate Data Streams", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1084": { "id": "DFW-1084", "name": "Failure to correctly recover specialised file system specific content e.g. Alternate Data Streams", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1050", "DFM-1051", "DFM-1052", "DFM-1053" ], "references": [] }, "DFW-1085": { "id": "DFW-1085", "name": "Missing messages from the live set of messages", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1055", "DFM-1056" ], "references": [ { "DFCite_id": "DFCite-1105", "relevance_summary_280": "" } ] }, "DFW-1086": { "id": "DFW-1086", "name": "Failing to recover deleted but recoverable messages", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1055", "DFM-1056", "DFM-1077" ], "references": [] }, "DFW-1087": { "id": "DFW-1087", "name": "Presenting a live message that did not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1050" ], "references": [] }, "DFW-1088": { "id": "DFW-1088", "name": "Presenting a deleted message that did not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1050" ], "references": [] }, "DFW-1089": { "id": "DFW-1089", "name": "Recovering a live message with incorrect content", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1055", "DFM-1056", "DFM-1050" ], "references": [] }, "DFW-1090": { "id": "DFW-1090", "name": "Recovering a live message with incorrect metadata", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1055", "DFM-1056", "DFM-1050" ], "references": [ { "DFCite_id": "DFCite-1123", "relevance_summary_280": "" } ] }, "DFW-1091": { "id": "DFW-1091", "name": "Recovering a deleted message with incorrect content", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1055", "DFM-1056", "DFM-1050" ], "references": [] }, "DFW-1092": { "id": "DFW-1092", "name": "Recovering a deleted message with incorrect metadata", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1055", "DFM-1056", "DFM-1050" ], "references": [] }, "DFW-1093": { "id": "DFW-1093", "name": "Presenting a deleted message as live", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1050" ], "references": [] }, "DFW-1094": { "id": "DFW-1094", "name": "Attributing a message to the incorrect sender", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1050" ], "references": [] }, "DFW-1095": { "id": "DFW-1095", "name": "Attributing a message to the incorrect thread", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1050" ], "references": [] }, "DFW-1096": { "id": "DFW-1096", "name": "Failing to recover attachments for a live message", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1055", "DFM-1056" ], "references": [] }, "DFW-1097": { "id": "DFW-1097", "name": "Failing to recover attachment for a deleted message", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1055", "DFM-1056" ], "references": [] }, "DFW-1098": { "id": "DFW-1098", "name": "Assigning incorrect metadata to a message attachment", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1050" ], "references": [] }, "DFW-1099": { "id": "DFW-1099", "name": "Assigning an attachment to an incorrect messages", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1050" ], "references": [] }, "DFW-1100": { "id": "DFW-1100", "name": "Tool fails to display special effects or highlight within a message", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1050" ], "references": [] }, "DFW-1101": { "id": "DFW-1101", "name": "Failure to recover message edits if available", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1050" ], "references": [] }, "DFW-1102": { "id": "DFW-1102", "name": "Failure to display that a message had a previous state", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_MISINT" ], "mitigations": [ "DFM-1054", "DFM-1027", "DFM-1050" ], "references": [] }, "DFW-1103": { "id": "DFW-1103", "name": "Failure to carve salvageable content", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1078" ], "references": [] }, "DFW-1104": { "id": "DFW-1104", "name": "Incorrect carving of a complete file", "description": "", "categories": [ "ASTM_INAC_ALT", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1062", "DFM-1063", "DFM-1064", "DFM-1090" ], "references": [] }, "DFW-1105": { "id": "DFW-1105", "name": "Incorrect reassembly of a file", "description": "", "categories": [ "ASTM_INAC_ALT", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1062", "DFM-1063", "DFM-1064", "DFM-1090" ], "references": [] }, "DFW-1106": { "id": "DFW-1106", "name": "Incorrect attribution of salvaged content to a current file system rather than a previous one", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1061" ], "references": [] }, "DFW-1107": { "id": "DFW-1107", "name": "Failure to repair a content fragment", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1060", "DFM-1065" ], "references": [] }, "DFW-1108": { "id": "DFW-1108", "name": "Failure to recover history resulting from private browsing", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1066", "DFM-1067" ], "references": [ { "DFCite_id": "DFCite-1066", "relevance_summary_280": "" } ] }, "DFW-1109": { "id": "DFW-1109", "name": "Incorrect recovery of information regarding a web visit from allocated data", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_INAC_ALT", "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1110": { "id": "DFW-1110", "name": "Failure to recover browser history from live data", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1111": { "id": "DFW-1111", "name": "Incorrect recovery of information regarding a web visit from non-allocated data", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_INAC_ALT", "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1112": { "id": "DFW-1112", "name": "Failure to recover browser history from non-allocated data", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1113": { "id": "DFW-1113", "name": "Misinterpretation a URL located on disk/memory as a web visit", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1190" ], "references": [] }, "DFW-1114": { "id": "DFW-1114", "name": "Failure to locate a relevant device at a physical crime scene", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1068", "DFM-1069", "DFM-1231", "DFM-1232" ], "references": [] }, "DFW-1115": { "id": "DFW-1115", "name": "Device is remote wiped because faraday environment was insufficient.", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1002" ], "references": [] }, "DFW-1116": { "id": "DFW-1116", "name": "Last wifi connection is overwritten because faraday environment was insufficient.", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1002" ], "references": [] }, "DFW-1117": { "id": "DFW-1117", "name": "Calls, messages or other data was received and overwrote relevant data because faraday environment was insufficient.", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1002" ], "references": [] }, "DFW-1118": { "id": "DFW-1118", "name": "Hardware write blocker fails to prevent modifications to the attached device.", "description": "", "categories": [ "ASTM_INAC_COR" ], "mitigations": [ "DFM-1071", "DFM-1072", "DFM-1073" ], "references": [] }, "DFW-1119": { "id": "DFW-1119", "name": "Hardware write blocker hides the existence of an HPA.", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1005" ], "references": [] }, "DFW-1120": { "id": "DFW-1120", "name": "Hardware write blocker hides the existence of an DCO.", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1006" ], "references": [] }, "DFW-1121": { "id": "DFW-1121", "name": "Image format parsing fails to to present all blocks from within a forensic container image in their ‘flat’ (dd) representation", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFW-1122": { "id": "DFW-1122", "name": "Image format parsing presents incorrect data within sectors of the image", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFW-1123": { "id": "DFW-1123", "name": "Image format parsing presents incorrect forensic image metadata", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFW-1124": { "id": "DFW-1124", "name": "Failure to compute hash of source device correctly during disk image verification", "description": "This could result in a message indicating corrupt evidence, thus stopping or delaying further investigation", "categories": [ "ASTM_INAC_AS", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1075", "DFM-1085" ], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFW-1125": { "id": "DFW-1125", "name": "Failure to validate hash properly during disk image verification", "description": "This could allow errors from earlier to propagate e.g. incorrect sectors", "categories": [ "ASTM_INAC_AS", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1075", "DFM-1085" ], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFW-1126": { "id": "DFW-1126", "name": "Failure to validate hash properly allowing an incomplete disk image to present as validated", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1075", "DFM-1085" ], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFW-1127": { "id": "DFW-1127", "name": "Failure to validate disk image metadata", "description": "This could allow details such as acquisition date to be changed", "categories": [ "ASTM_INAC_COR" ], "mitigations": [ "DFM-1076" ], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFW-1128": { "id": "DFW-1128", "name": "Disk image has been replaced with tampered version along with updated stored hash", "description": "", "categories": [ "ASTM_INAC_COR" ], "mitigations": [ "DFM-1022", "DFM-1023", "DFM-1074" ], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1079", "relevance_summary_280": "" } ] }, "DFW-1129": { "id": "DFW-1129", "name": "File type is incorrectly identified", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1109", "DFM-1111", "DFM-1112" ], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFW-1130": { "id": "DFW-1130", "name": "Missing assignment of a file type: reporting a file as unknown when it has a known type within the digital forensic science body of knowledge ", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1109", "DFM-1110", "DFM-1111", "DFM-1112" ], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFW-1131": { "id": "DFW-1131", "name": "Missing recognition of multiple file types: reporting a file as a limited set of types, or a single type, when it can be interpreted as having more than one, such as a GIF and Java Jar", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1109", "DFM-1111", "DFM-1112" ], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1090", "relevance_summary_280": "" } ] }, "DFW-1132": { "id": "DFW-1132", "name": "Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_INAC_ALT" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFW-1133": { "id": "DFW-1133", "name": "Tool fails to express uncertainty in the classification of file recovery results, e.g., where content may be partly overwritten.", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1084" ], "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1030", "relevance_summary_280": "" } ] }, "DFW-1134": { "id": "DFW-1134", "name": "Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected ", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1079", "DFM-1080", "DFM-1081", "DFM-1082", "DFM-1083" ], "references": [ { "DFCite_id": "DFCite-1030", "relevance_summary_280": "Defines a standardized vocabulary for classifying, authenticating and evaluating non-allocated file recovery results" } ] }, "DFW-1135": { "id": "DFW-1135", "name": "Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected ", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1079", "DFM-1080", "DFM-1081", "DFM-1082", "DFM-1083" ], "references": [ { "DFCite_id": "DFCite-1030", "relevance_summary_280": "" } ] }, "DFW-1136": { "id": "DFW-1136", "name": "Data cannot be read from a device due to the device having failed physically", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1089" ], "references": [] }, "DFW-1137": { "id": "DFW-1137", "name": "Failing to determine password as it is not in the dictionary used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1091", "DFM-1092", "DFM-1093", "DFM-1094", "DFM-1205", "DFM-1231" ], "references": [] }, "DFW-1138": { "id": "DFW-1138", "name": "Failing to identify password in the time available", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1092", "DFM-1095", "DFM-1096", "DFM-1097", "DFM-1205", "DFM-1231" ], "references": [] }, "DFW-1139": { "id": "DFW-1139", "name": "System locks after X failed dictionary attempts", "description": "", "categories": [ "ASTM_INAC_ALT", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1094", "DFM-1095", "DFM-1097", "DFM-1231" ], "references": [] }, "DFW-1140": { "id": "DFW-1140", "name": "Failing to determine password as it is not in the search space", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1097", "DFM-1098", "DFM-1099", "DFM-1231" ], "references": [] }, "DFW-1141": { "id": "DFW-1141", "name": "Failing to determine password via brute force in the time available", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1097", "DFM-1098", "DFM-1099", "DFM-1100", "DFM-1231" ], "references": [] }, "DFW-1142": { "id": "DFW-1142", "name": "System locks after X failed brute force attempts", "description": "", "categories": [ "ASTM_INAC_ALT", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1097", "DFM-1098", "DFM-1099", "DFM-1231" ], "references": [] }, "DFW-1143": { "id": "DFW-1143", "name": "Data is not read from remapped sectors e.g. G-Lists during the acquisition process", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1102" ], "references": [ { "DFCite_id": "DFCite-1124", "relevance_summary_280": "" } ] }, "DFW-1144": { "id": "DFW-1144", "name": "Failure to identify timestamps in a data source", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1145": { "id": "DFW-1145", "name": "Failure to extract timestamps from a data source", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1146": { "id": "DFW-1146", "name": "Failure to consider non-timestamp based timing information", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1039", "relevance_summary_280": "" } ] }, "DFW-1147": { "id": "DFW-1147", "name": "Failure to normalise timestamps correctly during timeline generation", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_ALT" ], "mitigations": [], "references": [] }, "DFW-1148": { "id": "DFW-1148", "name": "Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1101", "DFM-1225", "DFM-1227", "DFM-1228" ], "references": [] }, "DFW-1149": { "id": "DFW-1149", "name": "Failure to consider timestamp inaccuracy at time of inferred event", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_EX", "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1103" ], "references": [] }, "DFW-1150": { "id": "DFW-1150", "name": "Misinterpreting events from automated processes as user generated ones", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1073", "relevance_summary_280": "" } ] }, "DFW-1151": { "id": "DFW-1151", "name": "Incorrectly decoding a timestamp from a data source", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [], "references": [] }, "DFW-1152": { "id": "DFW-1152", "name": "Generated report does not include all bookmarks", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1104", "DFM-1105" ], "references": [] }, "DFW-1153": { "id": "DFW-1153", "name": "Report generated from bookmarks does not render all content (e.g. previews, string extracts) correctly", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1106", "DFM-1107" ], "references": [] }, "DFW-1154": { "id": "DFW-1154", "name": "Report generated from bookmarks stored in manner that does not prevent tampering or corruption", "description": "", "categories": [ "ASTM_INAC_COR" ], "mitigations": [ "DFM-1108", "DFM-1299" ], "references": [] }, "DFW-1155": { "id": "DFW-1155", "name": "Bookmark added by examiner is not recorded", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1156": { "id": "DFW-1156", "name": "Bookmark added by examiner is is recorded with incorrect tag/label/category", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [], "references": [] }, "DFW-1157": { "id": "DFW-1157", "name": "Use of mobile exploit changes/overwrites data that was relevant to the investigation", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1042", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1049", "relevance_summary_280": "" } ] }, "DFW-1158": { "id": "DFW-1158", "name": "Use of mobile exploit renders device unusable or 'bricked'", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1125", "relevance_summary_280": "" } ] }, "DFW-1159": { "id": "DFW-1159", "name": "Presenting a mobile file system acquisition as a bitwise copy of the device", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1114" ], "references": [] }, "DFW-1160": { "id": "DFW-1160", "name": "Failure to copy relevant files from the mobile device", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1161": { "id": "DFW-1161", "name": "Lack of privileges for file system acquisition", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1113" ], "references": [] }, "DFW-1162": { "id": "DFW-1162", "name": "Changing relevant files during file system acquisition", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [], "references": [] }, "DFW-1163": { "id": "DFW-1163", "name": "Changing relevant file metadata during file system acquisition", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [], "references": [] }, "DFW-1164": { "id": "DFW-1164", "name": "Files are still encrypted using file-based encryption so inaccessible", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1115", "DFM-1116", "DFM-1117" ], "references": [] }, "DFW-1165": { "id": "DFW-1165", "name": "Failure to preserve original timestamps from the data source in an archive", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT", "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1166": { "id": "DFW-1166", "name": "Consideration of live database content only", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1122", "DFM-1123" ], "references": [ { "DFCite_id": "DFCite-1113", "relevance_summary_280": "" } ] }, "DFW-1167": { "id": "DFW-1167", "name": "Combining data from multiple tables that should not be joined", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_INAC_ALT", "ASTM_MISINT" ], "mitigations": [ "DFM-1118", "DFM-1119", "DFM-1120", "DFM-1121" ], "references": [] }, "DFW-1168": { "id": "DFW-1168", "name": "Data extracted from a table is assigned an incorrect interpretation", "description": "", "categories": [ "ASTM_INAC_ALT", "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1169": { "id": "DFW-1169", "name": "Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_INAC_ALT", "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1170": { "id": "DFW-1170", "name": "Failure to recover data stored in Write Ahead Log (WAL) files", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1124" ], "references": [ { "DFCite_id": "DFCite-1021", "relevance_summary_280": "" } ] }, "DFW-1171": { "id": "DFW-1171", "name": "Failure to recover data stored in database journal files", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1125" ], "references": [ { "DFCite_id": "DFCite-1021", "relevance_summary_280": "" } ] }, "DFW-1172": { "id": "DFW-1172", "name": "Relevant reference data missed as its necessity was not known at time of preservation", "description": "Missing reference data means inference of event that did not happen", "categories": [ "ASTM_INCOMP", "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1139" ], "references": [] }, "DFW-1173": { "id": "DFW-1173", "name": "The recorded time offset is incorrect because the trusted time source used for reference was incorrect", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [], "references": [] }, "DFW-1174": { "id": "DFW-1174", "name": "Failure to find internal attached storage media", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1175": { "id": "DFW-1175", "name": "Failure to find internal unattached storage media", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1176": { "id": "DFW-1176", "name": "Unable to physically remove/detach internal storage media", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1126" ], "references": [ { "DFCite_id": "DFCite-1071", "relevance_summary_280": "" } ] }, "DFW-1177": { "id": "DFW-1177", "name": "Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence", "description": "", "categories": [ "ASTM_INAC_ALT", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1126", "DFM-1127" ], "references": [] }, "DFW-1178": { "id": "DFW-1178", "name": "Inability to load the forensic bootable environment due to system configuration", "description": "System configuration may not permit alternative booting e.g., Secureboot is enabled", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1128", "DFM-1129", "DFM-1130" ], "references": [] }, "DFW-1179": { "id": "DFW-1179", "name": "Failure to detect internal disk from bootable environment", "description": "For example this may be due to missing drivers", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1131" ], "references": [] }, "DFW-1180": { "id": "DFW-1180", "name": "Failing to decrypt internal disk using the bootable environment", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1132", "DFM-1133" ], "references": [] }, "DFW-1182": { "id": "DFW-1182", "name": "Bootable environment overwrites relevant data on the target device", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1008", "DFM-1014", "DFM-1015" ], "references": [] }, "DFW-1183": { "id": "DFW-1183", "name": "Failure to identify the existence of a connected device", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1027", "DFM-1134" ], "references": [] }, "DFW-1184": { "id": "DFW-1184", "name": "Presenting devices 'seen' as devices connected", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1027", "DFM-1135", "DFM-1050" ], "references": [] }, "DFW-1185": { "id": "DFW-1185", "name": "Failure to enumerate all files in a standard archive format", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1136", "DFM-1137", "DFM-1027" ], "references": [] }, "DFW-1186": { "id": "DFW-1186", "name": "Missing files with file name/path-based pattern matching due to renaming", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1187": { "id": "DFW-1187", "name": "Failure to match file name/path pattern due to mismatch of search term used and pattern match engine.", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1188": { "id": "DFW-1188", "name": "Failure to match file name/path pattern due to implementation error in matching engine.", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1138" ], "references": [] }, "DFW-1189": { "id": "DFW-1189", "name": "Artifact extraction is incomplete due to app version changes.", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1139" ], "references": [] }, "DFW-1190": { "id": "DFW-1190", "name": "Interpretation of app data is incorrect due to app version changes.", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1139" ], "references": [] }, "DFW-1191": { "id": "DFW-1191", "name": "Missing changes in app artifacts during research since app interaction is needed to cause changes", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1140" ], "references": [] }, "DFW-1192": { "id": "DFW-1192", "name": "Relevant results not captured by the case-specific keywords used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1031", "DFM-1141", "DFM-1142", "DFM-1152" ], "references": [] }, "DFW-1193": { "id": "DFW-1193", "name": "Keyword results missed since relevant keyword is split over a sector or cluster boundary", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1143", "DFM-1144" ], "references": [] }, "DFW-1194": { "id": "DFW-1194", "name": "Keyword results missed since relevant keyword is inside compressed or encoded data", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1143", "DFM-1144" ], "references": [] }, "DFW-1195": { "id": "DFW-1195", "name": "Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1151" ], "references": [] }, "DFW-1196": { "id": "DFW-1196", "name": "One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1145" ], "references": [] }, "DFW-1197": { "id": "DFW-1197", "name": "Data not indexed for keyword searching due to compression", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1029", "DFM-1034", "DFM-1149" ], "references": [] }, "DFW-1198": { "id": "DFW-1198", "name": "Data not indexed for keyword searching due to file or content encoding", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1029", "DFM-1034", "DFM-1150" ], "references": [] }, "DFW-1199": { "id": "DFW-1199", "name": "Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1033", "DFM-1038", "DFM-1142", "DFM-1152" ], "references": [] }, "DFW-1200": { "id": "DFW-1200", "name": "Failure to conduct iterative keyword searching due to excessive time taken per search", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1153" ], "references": [] }, "DFW-1201": { "id": "DFW-1201", "name": "Failure to recover live messages to or from the AI companion app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1154", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1202": { "id": "DFW-1202", "name": "Failure to recover deleted but recoverable messages to or from the AI companion app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1155", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1203": { "id": "DFW-1203", "name": "Presenting a message from the user or AI companion app that did not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1154", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1204": { "id": "DFW-1204", "name": "Presenting a deleted message to the AI companion app as a live one, or vice versa", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1155", "DFM-1027", "DFM-1050", "DFM-1055" ], "references": [] }, "DFW-1205": { "id": "DFW-1205", "name": "Presenting a message to the AI chat app as from the AI companion app, or vice versa", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1154", "DFM-1155", "DFM-1027", "DFM-1156", "DFM-1055" ], "references": [] }, "DFW-1206": { "id": "DFW-1206", "name": "Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app", "description": "", "categories": [ "ASTM_INAC_COR" ], "mitigations": [ "DFM-1050", "DFM-1155", "DFM-1027" ], "references": [] }, "DFW-1207": { "id": "DFW-1207", "name": "Failure to display a message to or from the AI companion app in the context of other messages", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1157" ], "references": [] }, "DFW-1208": { "id": "DFW-1208", "name": "Failure to recover live images sent to or from the AI companion app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1158", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1209": { "id": "DFW-1209", "name": "Failure to recover deleted but recoverable images sent to or from the AI companion app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1159", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1210": { "id": "DFW-1210", "name": "Presenting an image sent from the user or AI companion app that did not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1158", "DFM-1159", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1211": { "id": "DFW-1211", "name": "Presenting a deleted image sent to the AI companion app as a live one, or vice versa", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1158", "DFM-1159", "DFM-1027", "DFM-1050", "DFM-1055" ], "references": [] }, "DFW-1212": { "id": "DFW-1212", "name": "Presenting an image sent to the AI chat app as from the AI companion app, or vice versa", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1160", "DFM-1158", "DFM-1159", "DFM-1027", "DFM-1050", "DFM-1055" ], "references": [] }, "DFW-1213": { "id": "DFW-1213", "name": "Failure to display an image to or from the AI companion app in the context of other messages", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1157" ], "references": [] }, "DFW-1214": { "id": "DFW-1214", "name": "Failure to recover live records of calls to or from the AI companion app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1161", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1215": { "id": "DFW-1215", "name": "Failure to recover deleted but recoverable records of calls to or from the AI companion app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1162", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1216": { "id": "DFW-1216", "name": "Presenting a call to or from the AI companion app that did not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1161", "DFM-1162", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1217": { "id": "DFW-1217", "name": "Presenting a deleted call to the AI companion app as a live one, or vice versa", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1161", "DFM-1162", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1218": { "id": "DFW-1218", "name": "Presenting a call to the AI companion app as from the AI companion app, or vice versa", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1161", "DFM-1162", "DFM-1027", "DFM-1163", "DFM-1055" ], "references": [] }, "DFW-1219": { "id": "DFW-1219", "name": "Failure to recover metadata associated with an interaction with the AI companion app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1161", "DFM-1162", "DFM-1027", "DFM-1050", "DFM-1154", "DFM-1155", "DFM-1158", "DFM-1159", "DFM-1055" ], "references": [] }, "DFW-1220": { "id": "DFW-1220", "name": "Presenting an incorrect timestamp associated with an interaction with the AI companion app", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1027", "DFM-1050", "DFM-1161", "DFM-1162", "DFM-1154", "DFM-1155", "DFM-1158", "DFM-1159", "DFM-1055" ], "references": [] }, "DFW-1221": { "id": "DFW-1221", "name": "Failure to recover account details from the AI app data", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1164", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1222": { "id": "DFW-1222", "name": "Presenting account details that did not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1164", "DFM-1027", "DFM-1050", "DFM-1055" ], "references": [] }, "DFW-1223": { "id": "DFW-1223", "name": "Live access to the device (for extraction) updates last access times for an account", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1165", "DFM-1166", "DFM-1167", "DFM-1168" ], "references": [] }, "DFW-1224": { "id": "DFW-1224", "name": "Presenting a deleted account as live, or vice versa", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1164", "DFM-1050", "DFM-1027" ], "references": [] }, "DFW-1225": { "id": "DFW-1225", "name": "Failure to recover relevant app settings", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1169", "DFM-1170", "DFM-1027" ], "references": [] }, "DFW-1226": { "id": "DFW-1226", "name": "Failure to recover relevant AI bot settings", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1171", "DFM-1170", "DFM-1027", "DFM-1055" ], "references": [] }, "DFW-1227": { "id": "DFW-1227", "name": "Associating a configured bot with the wrong account", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1171", "DFM-1027", "DFM-1050", "DFM-1055" ], "references": [] }, "DFW-1228": { "id": "DFW-1228", "name": "Log entry missing due to incorrect parsing of logfile", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1181", "DFM-1027" ], "references": [] }, "DFW-1229": { "id": "DFW-1229", "name": "Log entry missing due to being stored in archived copies of logs", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1175" ], "references": [] }, "DFW-1230": { "id": "DFW-1230", "name": "Log entry missing due to rotation size or timing", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1172", "DFM-1173", "DFM-1175" ], "references": [ { "DFCite_id": "DFCite-1140", "relevance_summary_280": "" } ] }, "DFW-1231": { "id": "DFW-1231", "name": "Interpreting log entry absence as evidence of deletion rather than logging configuration", "description": "", "categories": [ "ASTM_INAC_COR" ], "mitigations": [ "DFM-1174" ], "references": [] }, "DFW-1232": { "id": "DFW-1232", "name": "Failure to extract log entry timestamp", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1180", "DFM-1027" ], "references": [] }, "DFW-1233": { "id": "DFW-1233", "name": "Failure to communicate imprecision in log entry timestamp", "description": "", "categories": [ "ASTM_INAC_COR" ], "mitigations": [ "DFM-1177" ], "references": [] }, "DFW-1234": { "id": "DFW-1234", "name": "Event time presented incorrectly due to incorrect timezone handling", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_EX", "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1027", "DFM-1178", "DFM-1179" ], "references": [] }, "DFW-1235": { "id": "DFW-1235", "name": "Failure to extract log entry type", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1027", "DFM-1182" ], "references": [] }, "DFW-1236": { "id": "DFW-1236", "name": "Incorrectly interpreting a log entry type based on a different version of the generating software or operating system", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1176" ], "references": [] }, "DFW-1243": { "id": "DFW-1243", "name": "Missing browser history data as it was conducted outside of configured retention period", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1192", "DFM-1193" ], "references": [] }, "DFW-1244": { "id": "DFW-1244", "name": "Missing browser history data as it was cleared by user", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1109", "relevance_summary_280": "" } ] }, "DFW-1245": { "id": "DFW-1245", "name": "Relying on times stored in browser history that are not representative of exact web page visit time", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [], "references": [ { "DFCite_id": "DFCite-1050", "relevance_summary_280": "" } ] }, "DFW-1246": { "id": "DFW-1246", "name": "Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1194", "DFM-1195", "DFM-1193" ], "references": [] }, "DFW-1247": { "id": "DFW-1247", "name": "Attributing saved browser bookmarks to a user but they were bundled with the browser installation", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [], "references": [] }, "DFW-1248": { "id": "DFW-1248", "name": "Missing browser downloads as the files were saved to a non-standard location", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1249": { "id": "DFW-1249", "name": "Missing a web browser profile as it was stored outside of the usual browser profile folders", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1191" ], "references": [] }, "DFW-1250": { "id": "DFW-1250", "name": "Incomplete browser activity extraction due to not considering the browser cache artifacts", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1187" ], "references": [] }, "DFW-1251": { "id": "DFW-1251", "name": "Incomplete browser activity extraction due to failure to consider multiple profiles", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1188" ], "references": [] }, "DFW-1252": { "id": "DFW-1252", "name": "Assuming that data stored in the cache was viewed by the user", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1189" ], "references": [ { "DFCite_id": "DFCite-1064", "relevance_summary_280": "" } ] }, "DFW-1253": { "id": "DFW-1253", "name": "Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1079", "DFM-1080", "DFM-1081", "DFM-1083" ], "references": [] }, "DFW-1254": { "id": "DFW-1254", "name": "Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1196", "DFM-1197", "DFM-1079", "DFM-1080", "DFM-1081" ], "references": [] }, "DFW-1255": { "id": "DFW-1255", "name": "Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL)", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1198", "DFM-1199", "DFM-1200", "DFM-1079", "DFM-1080", "DFM-1081" ], "references": [] }, "DFW-1256": { "id": "DFW-1256", "name": "Incorrect attribution of metadata to file content that was the result of 'file tunnelling'", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1079", "DFM-1080", "DFM-1081" ], "references": [] }, "DFW-1257": { "id": "DFW-1257", "name": "Missing content that is relevant to a keyword search but it has not been extracted as 'artifacts'", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1203", "DFM-1204" ], "references": [] }, "DFW-1258": { "id": "DFW-1258", "name": "Failure to present uncertainty associated with automated interpretation of data into artifacts", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1206", "DFM-1207", "DFM-1208", "DFM-1209" ], "references": [] }, "DFW-1259": { "id": "DFW-1259", "name": "Image format parsing fails to identify or assemble split forensic images", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1004", "DFM-1009", "DFM-1210", "DFM-1211", "DFM-1212", "DFM-1213", "DFM-1214", "DFM-1215" ], "references": [] }, "DFW-1260": { "id": "DFW-1260", "name": "Failure to derive clock offset due to inability to locate a suitable time anchor", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1222", "DFM-1218" ], "references": [] }, "DFW-1261": { "id": "DFW-1261", "name": "Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1217", "DFM-1220" ], "references": [] }, "DFW-1262": { "id": "DFW-1262", "name": "Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1216" ], "references": [] }, "DFW-1263": { "id": "DFW-1263", "name": "Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1221", "DFM-1219" ], "references": [] }, "DFW-1264": { "id": "DFW-1264", "name": "Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1223", "DFM-1226" ], "references": [] }, "DFW-1265": { "id": "DFW-1265", "name": "Offset applied to timestamp is incorrect due to variations in time zone over the history of data source", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1224" ], "references": [] }, "DFW-1266": { "id": "DFW-1266", "name": "Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1101", "DFM-1224", "DFM-1229", "DFM-1230" ], "references": [] }, "DFW-1267": { "id": "DFW-1267", "name": "Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1225" ], "references": [] }, "DFW-1268": { "id": "DFW-1268", "name": "Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1224" ], "references": [] }, "DFW-1269": { "id": "DFW-1269", "name": "Failure to apply time offset to a timeline entry", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_EX", "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1101" ], "references": [] }, "DFW-1270": { "id": "DFW-1270", "name": "Inability to create a device backup due to locked device", "description": "In most cases to create a backup the passcode must be provided to unlock the device.", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1097", "DFM-1234", "DFM-1235", "DFM-1236" ], "references": [] }, "DFW-1271": { "id": "DFW-1271", "name": "Inability to access required service as it is not enabled", "description": "For example, Developer Mode may not be enabled on an Android device, or iOS services stopped due to USB Restricted Mode", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1232" ], "references": [ { "DFCite_id": "DFCite-1015", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1004", "relevance_summary_280": "" } ] }, "DFW-1272": { "id": "DFW-1272", "name": "Failure to preserve all relevant timestamps of files obtained using exposed services on a device", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1233" ], "references": [] }, "DFW-1273": { "id": "DFW-1273", "name": "Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1233" ], "references": [] }, "DFW-1274": { "id": "DFW-1274", "name": "Inability to enable required service due to locked device", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1097", "DFM-1234", "DFM-1235", "DFM-1236", "DFM-1239" ], "references": [] }, "DFW-1275": { "id": "DFW-1275", "name": "Failure to store data due to size limitations of archive format used", "description": "Some archive file formats have limitations on the size of files that can be contained within them (Wikipedia 2026). If this is not considered and compensated for then large files that need to be stored may be skipped or cause other errors.", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1237" ], "references": [ { "DFCite_id": "DFCite-1130", "relevance_summary_280": "" } ] }, "DFW-1276": { "id": "DFW-1276", "name": "Relevant data is overwritten by deploying an agent to a mobile device", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1014" ], "references": [] }, "DFW-1277": { "id": "DFW-1277", "name": "Connection over a direct media interface causes changes to the target media", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT", "ASTM_INAC_COR" ], "mitigations": [ "DFM-1008", "DFM-1241" ], "references": [] }, "DFW-1278": { "id": "DFW-1278", "name": "Data copied does not include all sectors from LBA0 to LBA max due to the data copying process skipping some sectors or bytes", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1003", "DFM-1004", "DFM-1331" ], "references": [] }, "DFW-1279": { "id": "DFW-1279", "name": "Failure to recover live message from a multiplayer gaming app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1242", "DFM-1027", "DFM-1243" ], "references": [] }, "DFW-1280": { "id": "DFW-1280", "name": "Presenting a live contact from a gaming app as a deleted one or vice versa", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1245", "DFM-1244", "DFM-1243", "DFM-1027" ], "references": [] }, "DFW-1281": { "id": "DFW-1281", "name": "Failure to recover the gaming app configuration", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1027", "DFM-1247" ], "references": [] }, "DFW-1282": { "id": "DFW-1282", "name": "Recovering the gaming app configuration incorrectly", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1247", "DFM-1027" ], "references": [] }, "DFW-1283": { "id": "DFW-1283", "name": "Failure to recover a live account used in a gaming application", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1248", "DFM-1027" ], "references": [] }, "DFW-1284": { "id": "DFW-1284", "name": "Failure to recover a previous but removed account used in a gaming application", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1249", "DFM-1027" ], "references": [] }, "DFW-1285": { "id": "DFW-1285", "name": "Recovering an account used for a gaming application that was not actually used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1248", "DFM-1050", "DFM-1027" ], "references": [] }, "DFW-1286": { "id": "DFW-1286", "name": "Describing a live gaming app account as deleted/removed or vice versa", "description": "", "categories": [ "ASTM_INAC_AS", "ASTM_MISINT" ], "mitigations": [ "DFM-1248", "DFM-1249", "DFM-1050" ], "references": [] }, "DFW-1287": { "id": "DFW-1287", "name": "Failure to recover deleted message from a multiplayer gaming app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1244", "DFM-1027", "DFM-1243" ], "references": [] }, "DFW-1288": { "id": "DFW-1288", "name": "Presenting a live message from a gaming app that does not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1242", "DFM-1027", "DFM-1243" ], "references": [] }, "DFW-1289": { "id": "DFW-1289", "name": "Presenting a deleted message from a gaming app that does not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1244", "DFM-1027", "DFM-1243" ], "references": [] }, "DFW-1290": { "id": "DFW-1290", "name": "Presenting a live message from a gaming app as deleted or vice versa", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1244", "DFM-1242", "DFM-1027", "DFM-1243" ], "references": [] }, "DFW-1291": { "id": "DFW-1291", "name": "Failure to recover a live contact from a gaming app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1245", "DFM-1027", "DFM-1243" ], "references": [] }, "DFW-1292": { "id": "DFW-1292", "name": "Failure to recover a deleted contact from a gaming app", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1246", "DFM-1027", "DFM-1243" ], "references": [] }, "DFW-1293": { "id": "DFW-1293", "name": "Presenting a live contact from a gaming app that does not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1245", "DFM-1027", "DFM-1243" ], "references": [] }, "DFW-1294": { "id": "DFW-1294", "name": "Presenting a deleted contact from a gaming app that does not exist", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1246", "DFM-1027", "DFM-1243" ], "references": [] }, "DFW-1295": { "id": "DFW-1295", "name": "The filtered timeline misses relevant entries because filtering criteria was too strict", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_AS" ], "mitigations": [], "references": [] }, "DFW-1296": { "id": "DFW-1296", "name": "The filtered timeline misses relevant entries because the tool did not filter correctly", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1250" ], "references": [] }, "DFW-1297": { "id": "DFW-1297", "name": "The filtered timeline includes entries that are not relevant because the filtering criteria was too broad", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1251", "DFM-1252" ], "references": [] }, "DFW-1298": { "id": "DFW-1298", "name": "The filtered timeline includes entries that are not relevant because the tool did not filter correctly", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1250" ], "references": [] }, "DFW-1299": { "id": "DFW-1299", "name": "A filtered timeline is presented as a full timeline", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1253" ], "references": [] }, "DFW-1300": { "id": "DFW-1300", "name": "Missing deleted but recoverable volumes from unpartitioned space", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1044" ], "references": [] }, "DFW-1308": { "id": "DFW-1308", "name": "Sorted timeline is missing timeline entries due to tool error during sort process", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1259", "DFM-1268", "DFM-1269" ], "references": [] }, "DFW-1309": { "id": "DFW-1309", "name": "Sorted timeline is missing timeline entries because timeline contained entries not based on timestamps", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1260" ], "references": [] }, "DFW-1310": { "id": "DFW-1310", "name": "Sorted timeline has additional timeline entries due to tool error during sort process", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1259" ], "references": [] }, "DFW-1311": { "id": "DFW-1311", "name": "Timeline entry is in an incorrect sequence due to resolution of the timestamp used", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1261", "DFM-1262" ], "references": [ { "DFCite_id": "DFCite-1019", "relevance_summary_280": "Mentions different timestamp resolutions, e.g. hh:mm vs. hh:mm:ss (Section 6.1.2)" } ] }, "DFW-1312": { "id": "DFW-1312", "name": "Timeline entry is in an incorrect sequence due to underlying timestamp being based on an incorrect clock", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1225" ], "references": [ { "DFCite_id": "DFCite-1020", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1019", "relevance_summary_280": "Summarises that clock-related challenges originate from the system time which is used to derive timestamps. If the clock is incorrect, all timestamps originating from this clock are incorrect (Section 6.1.1)" } ] }, "DFW-1313": { "id": "DFW-1313", "name": "Timeline entry is in an incorrect sequence due to timezone already applied to timestamp", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1263" ], "references": [] }, "DFW-1314": { "id": "DFW-1314", "name": "Timeline entry is in an incorrect sequence due to a time offset being applied that is incorrect for the timeline entry", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1225" ], "references": [] }, "DFW-1315": { "id": "DFW-1315", "name": "Failure to recover a notification due to not attempting to parse the relevant data", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1264" ], "references": [] }, "DFW-1316": { "id": "DFW-1316", "name": "Failure to recover a notification due to a tool error parsing the relevant data", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1265" ], "references": [] }, "DFW-1317": { "id": "DFW-1317", "name": "Failure to recover a notification due to it being deleted because of the expiry time set", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1125", "DFM-1266" ], "references": [] }, "DFW-1318": { "id": "DFW-1318", "name": "Failure to recover a notification due to it being deleted because of it being viewed and cleared", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1125", "DFM-1266" ], "references": [] }, "DFW-1319": { "id": "DFW-1319", "name": "Associating a notification with an incorrect application due to tool error", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1265" ], "references": [] }, "DFW-1320": { "id": "DFW-1320", "name": "Failure to extract the creation time of a notification due to tool error", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1267" ], "references": [] }, "DFW-1321": { "id": "DFW-1321", "name": "Presenting the incorrect time for a notification due to tool error", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1267" ], "references": [] }, "DFW-1324": { "id": "DFW-1324", "name": "Failure to extract the operating system version due to a tool accessing the wrong artifact", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1272" ], "references": [] }, "DFW-1325": { "id": "DFW-1325", "name": "Failure to extract the operating system version because a tool parses the relevant artefact incorrectly", "description": "This weakness captures failing to extract a version at all, contrasted with extracting an incorrect version covered elsewhere. ", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1272" ], "references": [] }, "DFW-1326": { "id": "DFW-1326", "name": "Extracting an incorrect operating system version because a tool uses an incorrect or outdated artifact", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1272" ], "references": [] }, "DFW-1327": { "id": "DFW-1327", "name": "Extracting an incorrect operating system version because a tool parses the relevant artefact incorrectly", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1272" ], "references": [] }, "DFW-1328": { "id": "DFW-1328", "name": "Extracting a previous operating system version as if it were the current because a tool uses an incorrect or outdated artifact", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1272" ], "references": [] }, "DFW-1329": { "id": "DFW-1329", "name": "Failure to highlight previous versions of the operating system that were used on the device", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1273" ], "references": [] }, "DFW-1330": { "id": "DFW-1330", "name": "Failure to recover an allocated Registry key because of a parsing error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1274" ], "references": [] }, "DFW-1331": { "id": "DFW-1331", "name": "Failure to recover last modified time associated with an allocated Registry key because of a parsing error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1274" ], "references": [] }, "DFW-1332": { "id": "DFW-1332", "name": "Presenting an allocated Registry key that does not exist because of a parsing error in the tool used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1274" ], "references": [] }, "DFW-1333": { "id": "DFW-1333", "name": "Mapping an allocated Registry key to an incorrect point in the Registry tree structure because of a parsing error in the tool used", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1274" ], "references": [] }, "DFW-1334": { "id": "DFW-1334", "name": "Failure to recover allocated values associated with a Registry key because of a parsing error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1274" ], "references": [] }, "DFW-1335": { "id": "DFW-1335", "name": "Presenting an allocated Registry value that does not exist because of a parsing error in the tool used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1274" ], "references": [] }, "DFW-1336": { "id": "DFW-1336", "name": "Associating an allocated Registry value with an incorrect key because of a parsing error in the tool used", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [ "DFM-1274" ], "references": [] }, "DFW-1337": { "id": "DFW-1337", "name": "Presenting an allocated Registry key's modification time as the modification time for a specific value.", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1275" ], "references": [] }, "DFW-1338": { "id": "DFW-1338", "name": "Failing to acquire data due to omission of undocumented endpoints", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1276", "DFM-1277" ], "references": [ { "DFCite_id": "DFCite-1159", "relevance_summary_280": "Discusses limitations of API-based cloud acquisition and how endpoint coverage affects completeness of collected data." } ] }, "DFW-1339": { "id": "DFW-1339", "name": "Failing to acquire data because of filtering", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1276", "DFM-1277" ], "references": [ { "DFCite_id": "DFCite-1159", "relevance_summary_280": "Open-source tool that implements this technique by inspecting and tracking RESTful API traffic from cloud client applications." } ] }, "DFW-1340": { "id": "DFW-1340", "name": "Data on a mobile device is overwritten because not all relevant connectivity settings were configured correctly", "description": "This might include setting airplane mode only rather than WiFi and/or Bluetooth separately. This would also include the extreme case of a remote wipe being performed", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1278", "DFM-1279" ], "references": [] }, "DFW-1341": { "id": "DFW-1341", "name": "Data on a mobile device is overwritten because the connectivity settings were subsequently reset by an automated process", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1278" ], "references": [] }, "DFW-1342": { "id": "DFW-1342", "name": "Data is added to a mobile device because not all relevant connectivity settings were configured correctly", "description": "Data on a mobile device is added post-seizure because not all relevant connectivity settings were configured correctly", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1278", "DFM-1279" ], "references": [] }, "DFW-1343": { "id": "DFW-1343", "name": "Data is added to a mobile device because the connectivity settings were subsequently reset by an automated process", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1278" ], "references": [] }, "DFW-1344": { "id": "DFW-1344", "name": "The case number is not retrieved from the metadata inside a forensic container because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1027" ], "references": [] }, "DFW-1345": { "id": "DFW-1345", "name": "The case description retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1027", "DFM-1280" ], "references": [] }, "DFW-1346": { "id": "DFW-1346", "name": "The cryptographic hash is not retrieved from the metadata inside a forensic container because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1027" ], "references": [] }, "DFW-1347": { "id": "DFW-1347", "name": "The cryptographic hash retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1027", "DFM-1281" ], "references": [] }, "DFW-1348": { "id": "DFW-1348", "name": "The case number retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1027", "DFM-1280" ], "references": [] }, "DFW-1349": { "id": "DFW-1349", "name": "The evidence number is not retrieved from the metadata inside a forensic container because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1027" ], "references": [] }, "DFW-1350": { "id": "DFW-1350", "name": "The evidence number retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1027", "DFM-1280" ], "references": [] }, "DFW-1351": { "id": "DFW-1351", "name": "The examiner name is not retrieved from the metadata inside a forensic container because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1027" ], "references": [] }, "DFW-1352": { "id": "DFW-1352", "name": "The examiner name retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1027", "DFM-1280" ], "references": [] }, "DFW-1353": { "id": "DFW-1353", "name": "The notes field is not retrieved from the metadata inside a forensic container because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1027" ], "references": [] }, "DFW-1354": { "id": "DFW-1354", "name": "The notes field retrieved from the metadata inside a forensic container are incorrect because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1027", "DFM-1280" ], "references": [] }, "DFW-1355": { "id": "DFW-1355", "name": "The case description is not retrieved from the metadata inside a forensic container because of a programming error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1027" ], "references": [] }, "DFW-1356": { "id": "DFW-1356", "name": "Failing to acquire data due to omission of undocumented endpoints", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1276", "DFM-1277" ], "references": [ { "DFCite_id": "DFCite-1159", "relevance_summary_280": "Discusses limitations of API-based cloud acquisition and how endpoint coverage affects completeness of collected data." } ] }, "DFW-1357": { "id": "DFW-1357", "name": "Failing to acquire data because of timeout", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1296" ], "references": [] }, "DFW-1358": { "id": "DFW-1358", "name": "Failing to acquire data because historical records were not acquired", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1297" ], "references": [] }, "DFW-1359": { "id": "DFW-1359", "name": "Failing to acquire data because of truncation during format conversions", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1298", "DFM-1283" ], "references": [] }, "DFW-1360": { "id": "DFW-1360", "name": "Failing to acquire data because historical records were lost during format conversions", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1298", "DFM-1297" ], "references": [] }, "DFW-1361": { "id": "DFW-1361", "name": "Failing to acquire data because of provider-side outages or interruptions", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1296" ], "references": [] }, "DFW-1362": { "id": "DFW-1362", "name": "Failing to acquire data because of client-side network outages or interruptions", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1296" ], "references": [] }, "DFW-1363": { "id": "DFW-1363", "name": "Failing to acquire data because of acquisition tool misconfigurations", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1284" ], "references": [] }, "DFW-1364": { "id": "DFW-1364", "name": "Failing to acquire data because of acquisition tool bugs or limitations", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1285" ], "references": [] }, "DFW-1365": { "id": "DFW-1365", "name": "Failing to acquire data because of acquisition of non-production environment\"", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1286", "DFM-1287" ], "references": [] }, "DFW-1366": { "id": "DFW-1366", "name": "Inaccurate information collected resulting from data format conversions", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [], "references": [] }, "DFW-1367": { "id": "DFW-1367", "name": "Failing to acquire data because of filtering", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1050", "DFM-1276", "DFM-1277" ], "references": [ { "DFCite_id": "DFCite-1159", "relevance_summary_280": "Open-source tool that implements this technique by inspecting and tracking RESTful API traffic from cloud client applications." } ] }, "DFW-1368": { "id": "DFW-1368", "name": "Inaccurate information collected resulting from timestamp format conversions", "description": "", "categories": [ "ASTM_INAC_ALT" ], "mitigations": [], "references": [] }, "DFW-1369": { "id": "DFW-1369", "name": "Failing to acquire data structure because metadata and relationships were not acquired", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1288" ], "references": [] }, "DFW-1370": { "id": "DFW-1370", "name": "Failing to acquire cloud service logs because they are stored separately from data", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1289", "DFM-1290" ], "references": [] }, "DFW-1371": { "id": "DFW-1371", "name": "Failing to acquire data because an outdated API was used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1282" ], "references": [] }, "DFW-1372": { "id": "DFW-1372", "name": "Failing to acquire data because an outdated or incomplete schema was used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1291" ], "references": [] }, "DFW-1373": { "id": "DFW-1373", "name": "Failing to acquire data because of provider-side API limiting or throttling", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1292", "DFM-1293" ], "references": [] }, "DFW-1374": { "id": "DFW-1374", "name": "Failing to acquire data because of client-side API limiting or throttling", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1292" ], "references": [] }, "DFW-1375": { "id": "DFW-1375", "name": "Failing to acquire data because of errors accessing cloud service", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1137" ], "references": [] }, "DFW-1376": { "id": "DFW-1376", "name": "Failing to acquire data because credentials used do not have sufficient permissions", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1294" ], "references": [] }, "DFW-1377": { "id": "DFW-1377", "name": "Failing to acquire data because credentials used have expired or were revoked", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1295" ], "references": [] }, "DFW-1378": { "id": "DFW-1378", "name": "Relevant keywords not returned by live search due to improper handling of character encoding", "description": "Keyword searching (live) does not handle character encoding properly, causing search terms to miss content and fail to find relevant data (false negative).", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1034", "DFM-1027" ], "references": [] }, "DFW-1379": { "id": "DFW-1379", "name": "One or more proposed hypotheses are not mutually exclusive", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1300" ], "references": [] }, "DFW-1380": { "id": "DFW-1380", "name": "A proposed hypothesis suffers from a lack of falsifiability", "description": "A scientifically valid hypothesis must present an outcome that can be definitively proven false.", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1301" ], "references": [] }, "DFW-1381": { "id": "DFW-1381", "name": "A proposed hypothesis equates correlation with causation", "description": "Causal mechanisms are not explicitly established", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1302" ], "references": [] }, "DFW-1382": { "id": "DFW-1382", "name": "A hypothesis refers to \"device user\" rather than \"suspect\" when a specific individual is under investigation", "description": "When a specific individual is under investigation, address this fact. If the individual's use of a device is challenged, this should be explicitly addressed in hypothesis generation.", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1303" ], "references": [] }, "DFW-1383": { "id": "DFW-1383", "name": "A proposed hypothesis uses judgmental or loaded terminology", "description": "Judgmental or loaded terminology is outside the scope of digital forensics and could reflect bias", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1304" ], "references": [] }, "DFW-1384": { "id": "DFW-1384", "name": "Addressing the wrong level of the hierarchy of hypotheses required for the case", "description": "The hierarchy of hypotheses (a.k.a. hierarchy of propositions) are: 1) source level concerns where a trace came from (e.g., which device produced contraband), 2) activity level concerns what act produced it (e.g., who produced contraband), and 3) offense level concerns the criminal issue itself (e.g., whether the suspect knowingly produced contraband) — with higher levels being more relevant to decision-makers but requiring more case information to evaluate.", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1305" ], "references": [] }, "DFW-1385": { "id": "DFW-1385", "name": "A proposed hypothesis uses vague or complex phrasing", "description": "Hypotheses are declarative statements written in the present tense, without ambiguous language, multiple conditions, or conditional verbs (e.g., \"if-then\" or \"would\"). ", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1306" ], "references": [] }, "DFW-1386": { "id": "DFW-1386", "name": "A proposed hypothesis is overly specific to details in the case", "description": "Generating hypotheses that focus on specific details available early in an investigation can be too narrow to accomodate new details found later, and increases the risk of confirmation bias, such as focusing on the use of a specific wiping tool rather than any wiping tool being used", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1307" ], "references": [] }, "DFW-1387": { "id": "DFW-1387", "name": "The operating system installation date is not recovered because the tool fails while decoding the value", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1308" ], "references": [] }, "DFW-1388": { "id": "DFW-1388", "name": "The operating system installation date is not recovered because the tool examines an incorrect artifact", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1308" ], "references": [] }, "DFW-1389": { "id": "DFW-1389", "name": "The operating system installation date extracted does not reflect the time it was installed because the artifact represents an software update, or some other event", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1308" ], "references": [] }, "DFW-1390": { "id": "DFW-1390", "name": "The operating system installation date extracted does not reflect the time it was installed because the timezone conversion was applied incorrectly", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1308" ], "references": [] }, "DFW-1391": { "id": "DFW-1391", "name": "The operating system installation date extracted does not reflect the time it was installed because the tool incorrectly decoded the timestamp", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1308" ], "references": [] }, "DFW-1392": { "id": "DFW-1392", "name": "Presentation of the extracted operating system installation date does not highlight that there were previous operating systems installed prior to this date", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [ "DFM-1309" ], "references": [ { "DFCite_id": "DFCite-1157", "relevance_summary_280": "Shows additional artifacts for previously installed operating systems." } ] }, "DFW-1393": { "id": "DFW-1393", "name": "Failure to recover mount point mapping because multiple devices have used the mount point and older data has been overwritten", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1310", "DFM-1311" ], "references": [] }, "DFW-1394": { "id": "DFW-1394", "name": "Failure to recover mount point mapping because of a tool processing error", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1312" ], "references": [] }, "DFW-1395": { "id": "DFW-1395", "name": "Failure to recover mount point mapping because multiple operating systems are present and they use different mappings", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1313" ], "references": [] }, "DFW-1396": { "id": "DFW-1396", "name": "Extracting a relationship between a mount point and device/partition that is incorrect because of a tool processing error", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1312" ], "references": [] }, "DFW-1397": { "id": "DFW-1397", "name": "Cryptographic hash of the source data is incorrect because not all data was read from the device", "description": "A failure in reading the data part way through would result in a hash of only some of the data.", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1003" ], "references": [] }, "DFW-1398": { "id": "DFW-1398", "name": "Cryptographic hash of the source data is incorrect because of a hash computation error", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1085", "DFM-1314" ], "references": [] }, "DFW-1399": { "id": "DFW-1399", "name": "Source data is changed when cryptographic hash is being computed because of writes made to the source device", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [ "DFM-1007", "DFM-1008" ], "references": [] }, "DFW-1400": { "id": "DFW-1400", "name": "Source data is changed when cryptographic hash is being computed because of SSD TRIM operations clearing data", "description": "", "categories": [ "ASTM_INCOMP", "ASTM_INAC_ALT" ], "mitigations": [], "references": [] }, "DFW-1401": { "id": "DFW-1401", "name": "Calculating an incorrect hash of data stored within a forensic image because internally stored data was not decompressed correctly", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1315" ], "references": [] }, "DFW-1402": { "id": "DFW-1402", "name": "Calculating an incorrect hash of data stored within a forensic image because it is split over multiple files and not all were included", "description": "For example hashing data only in an E01 file when there was also an E02.", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1316" ], "references": [] }, "DFW-1403": { "id": "DFW-1403", "name": "Failure to evaluate observations in light of the hypotheses because the examination was scoped to extracting and reporting artifacts, with no evaluative question posed", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1317" ], "references": [] }, "DFW-1404": { "id": "DFW-1404", "name": "Failure to evaluate observations in light of the hypotheses because the meaning of the observations was treated as self-evident", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1318" ], "references": [ { "DFCite_id": "DFCite-1165", "relevance_summary_280": "" } ] }, "DFW-1405": { "id": "DFW-1405", "name": "Failure to evaluate observations in light of the hypotheses because analytic output is delivered as fact", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1208" ], "references": [] }, "DFW-1406": { "id": "DFW-1406", "name": "Failure to consider alternative hypotheses because the examination was framed by the instructing party's proposition alone", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1319" ], "references": [] }, "DFW-1407": { "id": "DFW-1407", "name": "Failure to consider alternative hypotheses because the observations were assessed for how well they fitted the proposed hypothesis, a one-conditional judgment that never requires an alternative to be stated", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1318" ], "references": [ { "DFCite_id": "DFCite-1165", "relevance_summary_280": "" } ] }, "DFW-1422": { "id": "DFW-1422", "name": "An AI response to a question does not return a relevant event because it found something else relevant and stopped searching", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1423": { "id": "DFW-1423", "name": "An AI response to a question returns an event with one or more incorrect details because the supporting data was unreliable, but that was not recognised", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1350" ], "references": [] }, "DFW-1424": { "id": "DFW-1424", "name": "An AI response returns a sequence of events that do not reflect the true ordering of events that occurred because of failure to consider clock inaccuracies", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1227", "DFM-1225" ], "references": [] }, "DFW-1425": { "id": "DFW-1425", "name": "An AI response to a question presents an assertion that an event occurred as a fact not a hypothesis", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1426": { "id": "DFW-1426", "name": "An AI response to a query takes a biased tone because of the phrasing of the user's prompting", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1427": { "id": "DFW-1427", "name": "An AI response to a query takes a biased tone because of inherent bias in the data the model was trained on", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1428": { "id": "DFW-1428", "name": "An AI response to a query takes a biased tone because of phrasing in an embedded system prompt", "description": "", "categories": [ "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1429": { "id": "DFW-1429", "name": "An AI response to a query for relevant artifacts is missing one or more relevant artifacts because it found something else relevant and stopped searching", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1430": { "id": "DFW-1430", "name": "An AI response to a query for relevant artifacts is missing one or more relevant artifacts because the results exceed a context window", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1332" ], "references": [] }, "DFW-1431": { "id": "DFW-1431", "name": "An AI response to a query for relevant artifacts is missing one or more relevant artifacts because some were not recognised as relevant", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1333", "DFM-1334", "DFM-1335" ], "references": [] }, "DFW-1432": { "id": "DFW-1432", "name": "An AI response to a query for relevant artifacts includes reporting artifacts that are not relevant because the model could not successfully differentiate relevance", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1336" ], "references": [] }, "DFW-1433": { "id": "DFW-1433", "name": "An AI response to a question does not return a relevant event because the data needed to reconstruct the event was lost due to context window overflow", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1332" ], "references": [] }, "DFW-1434": { "id": "DFW-1434", "name": "An AI response to a query for relevant artifacts includes reporting artifacts that do not exist because of model hallucinations", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1337", "DFM-1338" ], "references": [] }, "DFW-1435": { "id": "DFW-1435", "name": "An AI response to a query does not provide the reasoning behind the results generated because the system is not capable of producing it", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1339", "DFM-1340" ], "references": [] }, "DFW-1436": { "id": "DFW-1436", "name": "An AI response to a query does not provide the reasoning behind the results generated because it was not requested", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1437": { "id": "DFW-1437", "name": "An AI response to a query does not provide a measure of confidence in the reasoning provided because the system is not capable of producing it", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1438": { "id": "DFW-1438", "name": "An AI response to a query does not provide a measure of confidence in the reasoning provided because it was not requested", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1439": { "id": "DFW-1439", "name": "An AI response to a query provides an inaccurate reasoning behind the results generated", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [], "references": [] }, "DFW-1440": { "id": "DFW-1440", "name": "An observation referred to in the reasoning provided by an AI system does not exist because of model hallucinations", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1341" ], "references": [] }, "DFW-1441": { "id": "DFW-1441", "name": "An observation that contradicts the conclusions drawn by an AI system are not presented when presenting reasoning because contradictory observations were not requested", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [], "references": [] }, "DFW-1442": { "id": "DFW-1442", "name": "An observation that contradicts the conclusions drawn by an AI system are not included when presenting reasoning because the system stopped searching for relevant data once it found sufficient supporting information", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [], "references": [] }, "DFW-1443": { "id": "DFW-1443", "name": "An AI response to a query does not provide an accurate confidence in the reasoning provided because the confidence value is fabricated", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [], "references": [] }, "DFW-1444": { "id": "DFW-1444", "name": "An AI response to a question does not return a relevant event because it was not recognised as relevant", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1343" ], "references": [] }, "DFW-1445": { "id": "DFW-1445", "name": "An observation referred to in the reasoning provided by and AI system does not support the conclusions drawn because the system is unable to accurately reason with the observable data that is available but does so anyway", "description": "", "categories": [ "ASTM_INAC_AS" ], "mitigations": [], "references": [] }, "DFW-1446": { "id": "DFW-1446", "name": "An AI response to a question does not return a relevant link because it found something else relevant and stopped searching", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1447": { "id": "DFW-1447", "name": "An AI response to a question does not return a relevant link because it could not correctly interpret the data needed to make the link", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1448": { "id": "DFW-1448", "name": "An AI response to a question asserts a link that does not exist because because of model hallucinations", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1342" ], "references": [] }, "DFW-1449": { "id": "DFW-1449", "name": "An AI response to a question asserts a link that does not exist because the supporting data was unreliable but that was not recognised", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [], "references": [] }, "DFW-1450": { "id": "DFW-1450", "name": "An AI response to a question does not return a relevant event because data needed to reconstruct the event was lost due to compression of the context", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1344" ], "references": [] }, "DFW-1451": { "id": "DFW-1451", "name": "An AI response to a question returns an event that did not occur because of model hallucinations", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1345" ], "references": [] }, "DFW-1452": { "id": "DFW-1452", "name": "An AI response to a question returns an event that did not occur because of an incorrect 'interpretation' of the meaning of some artifacts", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1346", "DFM-1347" ], "references": [] }, "DFW-1453": { "id": "DFW-1453", "name": "An AI response to a question returns an event that did not occur because the supporting data was unreliable, but that was not recognised", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [], "references": [] }, "DFW-1454": { "id": "DFW-1454", "name": "An AI response to a question returns an event with one or more incorrect details because of model hallucinations", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1348" ], "references": [] }, "DFW-1455": { "id": "DFW-1455", "name": "An AI response to a question returns an event with one or more incorrect details because of an incorrect 'interpretation' of the meaning of some artifacts", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1349", "DFM-1347" ], "references": [] }, "DFW-1456": { "id": "DFW-1456", "name": "The decoded value is incorrect because the incorrect data type was applied for decoding", "description": "For example a string was decoded as an integer - e.g. \"61 3A\" was decoded as integer 14945 rather than \"a:\" ", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1351" ], "references": [] }, "DFW-1457": { "id": "DFW-1457", "name": "The integer decoded from some data is incorrect because the incorrect number of bytes was examined", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1352" ], "references": [] }, "DFW-1458": { "id": "DFW-1458", "name": "The integer decoded from some data is incorrect because the endianness used was incorrect", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1353" ], "references": [] }, "DFW-1459": { "id": "DFW-1459", "name": "The integer decoded from some data is incorrect because the decoding was signed not unsigned or vice versa", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1354" ], "references": [] }, "DFW-1460": { "id": "DFW-1460", "name": "The integer decoded from some data is incorrect because it should have been decoded as a floating point number", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1461": { "id": "DFW-1461", "name": "The floating point number decoded from some data is incorrect because the incorrect number of bytes was examined", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1352" ], "references": [] }, "DFW-1462": { "id": "DFW-1462", "name": "The floating point number decoded from some data is incorrect because the endianness used was incorrect", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1355" ], "references": [] }, "DFW-1463": { "id": "DFW-1463", "name": "The floating point number decoded from some data is incorrect because the decoding was signed not unsigned or vice versa", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1354" ], "references": [] }, "DFW-1464": { "id": "DFW-1464", "name": "The floating point number decoded from some data is incorrect because it should have been decoded as an integer", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [], "references": [] }, "DFW-1465": { "id": "DFW-1465", "name": "The floating point number decoded from some data is incorrect because the original value could not be fully represented within the bytes available", "description": "For example some fraction that could not be represented exactly within 4 bytes", "categories": [ "ASTM_INAC_EX", "ASTM_MISINT" ], "mitigations": [ "DFM-1356" ], "references": [] }, "DFW-1473": { "id": "DFW-1473", "name": "The examiner-entered metadata was not stored along with the forensic container because of a software error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1363" ], "references": [] }, "DFW-1474": { "id": "DFW-1474", "name": "The examiner-entered metadata was not stored along with the forensic container because the examiner did not enter the details", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [], "references": [] }, "DFW-1475": { "id": "DFW-1475", "name": "The computed hash(s) were not stored along with the forensic container because of a software error in the tool used", "description": "", "categories": [ "ASTM_INCOMP" ], "mitigations": [ "DFM-1364" ], "references": [] }, "DFW-1476": { "id": "DFW-1476", "name": "The examiner-entered metadata stored along with the forensic container is incorrect because of a software error in the tool used", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [ "DFM-1363" ], "references": [] }, "DFW-1477": { "id": "DFW-1477", "name": "The examiner-entered metadata stored along with the forensic container is incorrect because the examiner entered the wrong details", "description": "", "categories": [ "ASTM_INAC_EX", "ASTM_INAC_AS" ], "mitigations": [], "references": [] }, "DFW-1478": { "id": "DFW-1478", "name": "The computed hash(s) stored along with the forensic container is incorrect because of a software error in the tool used", "description": "", "categories": [ "ASTM_INAC_EX" ], "mitigations": [ "DFM-1364" ], "references": [] } }, "mitigations": { "DFM-1001": { "id": "DFM-1001", "name": "Review of all triage results that are relied on during the full digital forensic examination", "description": "", "technique": null, "references": [] }, "DFM-1002": { "id": "DFM-1002", "name": "Testing of the faraday environment to be used", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1086", "relevance_summary_280": "" } ] }, "DFM-1003": { "id": "DFM-1003", "name": "Check image size corresponds with drive label", "description": "", "technique": null, "references": [] }, "DFM-1004": { "id": "DFM-1004", "name": "Check hash of image matches hash of source device", "description": "This mitigation refers to checking the hash of a source *device* and differs from M1009 which refers to source *material*. This differs based on whether data on a device needs to be hashed for verification, or a piece of data needs to be hashed (e.g. imaging a raw dd to a forensic container format).", "technique": "DFT-1042", "references": [] }, "DFM-1005": { "id": "DFM-1005", "name": "Testing to ensure that the software and hardware disk imaging setup can detect HPAs", "description": "Tests have been performed that the combination of hardware and software used can detect when HPAs are present.", "technique": null, "references": [] }, "DFM-1006": { "id": "DFM-1006", "name": "Testing to ensure software and hardware setup detects DCOs", "description": "", "technique": null, "references": [] }, "DFM-1007": { "id": "DFM-1007", "name": "Use hardware write blocker", "description": "", "technique": "DFT-1012", "references": [] }, "DFM-1008": { "id": "DFM-1008", "name": "Use software write blocker", "description": "", "technique": "DFT-1013", "references": [] }, "DFM-1009": { "id": "DFM-1009", "name": "Check hash of image matches hash of source material", "description": "This mitigation refers to checking the hash of a source *material* and differs from M1004 which refers to source *device*. \n\nThis differs based on whether data on a device needs to be hashed for verification, or a piece of data needs to be hashed (e.g. imaging a raw dd to a forensic container format).", "technique": null, "references": [] }, "DFM-1010": { "id": "DFM-1010", "name": "Perform full extraction instead of selective", "description": "", "technique": null, "references": [] }, "DFM-1011": { "id": "DFM-1011", "name": "Perform full extraction instead of selective, followed by partial processing", "description": "", "technique": null, "references": [] }, "DFM-1012": { "id": "DFM-1012", "name": "Clear presentation of the backup and deletion process", "description": "", "technique": null, "references": [] }, "DFM-1013": { "id": "DFM-1013", "name": "Consider memory acquisition and offline analysis instead", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1063", "relevance_summary_280": "" } ] }, "DFM-1014": { "id": "DFM-1014", "name": "Test and document changes made by the tools used", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1062", "relevance_summary_280": "" } ] }, "DFM-1015": { "id": "DFM-1015", "name": "Use tools only if changes made are to locations where relevant evidence is unlikely to be located.", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1062", "relevance_summary_280": "" } ] }, "DFM-1016": { "id": "DFM-1016", "name": "Alert user that the data collected is a partial set of data stored on the device", "description": "", "technique": null, "references": [] }, "DFM-1017": { "id": "DFM-1017", "name": "Check for physical presence of SD card", "description": "", "technique": null, "references": [] }, "DFM-1018": { "id": "DFM-1018", "name": "Check if presence of SD card is expected", "description": "", "technique": null, "references": [] }, "DFM-1019": { "id": "DFM-1019", "name": "Consider if file system acquisition is possible/permitted", "description": "", "technique": "DFT-1020", "references": [] }, "DFM-1020": { "id": "DFM-1020", "name": "Compare data extracted with full list of installed apps", "description": "", "technique": null, "references": [] }, "DFM-1021": { "id": "DFM-1021", "name": "Verify the disk image integrity with multiple hash algorithms e.g. MD5 and SHA1 (Kessler 2016)", "description": "", "technique": null, "references": [] }, "DFM-1022": { "id": "DFM-1022", "name": "Restrict access to stored disk images", "description": "", "technique": null, "references": [] }, "DFM-1023": { "id": "DFM-1023", "name": "Ensure and check logs of access to stored disk images", "description": "", "technique": null, "references": [] }, "DFM-1024": { "id": "DFM-1024", "name": "Validate extracted key against the encrypted material before powering off the machine from which the key was extracted (e.g. Hargreaves & Chivers 2008b)", "description": "", "technique": null, "references": [] }, "DFM-1025": { "id": "DFM-1025", "name": "Validation & testing against the encryption system under consideration", "description": "", "technique": null, "references": [] }, "DFM-1026": { "id": "DFM-1026", "name": "Testing of backup parsing method", "description": "", "technique": null, "references": [] }, "DFM-1027": { "id": "DFM-1027", "name": "Use dual tool verification", "description": "", "technique": null, "references": [] }, "DFM-1028": { "id": "DFM-1028", "name": "Parse app lists if available and highlight missing data", "description": "", "technique": null, "references": [] }, "DFM-1029": { "id": "DFM-1029", "name": "Testing of keyword indexing component of tool", "description": "", "technique": null, "references": [] }, "DFM-1030": { "id": "DFM-1030", "name": "Testing of retrieval of indexed content", "description": "", "technique": null, "references": [] }, "DFM-1031": { "id": "DFM-1031", "name": "Also using synonyms for terms used", "description": "", "technique": null, "references": [] }, "DFM-1032": { "id": "DFM-1032", "name": "Evaluation of the effectiveness of wordlist used for case-type searching", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1074", "relevance_summary_280": "" } ] }, "DFM-1033": { "id": "DFM-1033", "name": "Prioritization of search results based on context", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1014", "relevance_summary_280": "" } ] }, "DFM-1034": { "id": "DFM-1034", "name": "Comparison of index results with live search results", "description": "", "technique": "DFT-1125", "references": [] }, "DFM-1035": { "id": "DFM-1035", "name": "Verification against second tool with known different regex implementation", "description": "", "technique": null, "references": [] }, "DFM-1036": { "id": "DFM-1036", "name": "Testing of regular expression component of tool", "description": "", "technique": null, "references": [] }, "DFM-1037": { "id": "DFM-1037", "name": "The context of relevant keyword results are manually checked", "description": "", "technique": null, "references": [] }, "DFM-1038": { "id": "DFM-1038", "name": "Word list selected such that a practically reviewable number of results are returned", "description": "", "technique": null, "references": [] }, "DFM-1039": { "id": "DFM-1039", "name": "Hash matching to reduce need for manual review", "description": "", "technique": null, "references": [] }, "DFM-1040": { "id": "DFM-1040", "name": "Use of AI to flag potentially relevant content to reduce need for manual review", "description": "", "technique": null, "references": [] }, "DFM-1041": { "id": "DFM-1041", "name": "Regular breaks to minimise investigator fatigue", "description": "", "technique": null, "references": [] }, "DFM-1042": { "id": "DFM-1042", "name": "Secondary review of flagged items to ensure relevance", "description": "", "technique": null, "references": [] }, "DFM-1043": { "id": "DFM-1043", "name": "Scan for orphaned EPTs", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1135", "relevance_summary_280": "" } ] }, "DFM-1044": { "id": "DFM-1044", "name": "Scan for Volume Boot Records in unpartitioned space", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1135", "relevance_summary_280": "" } ] }, "DFM-1045": { "id": "DFM-1045", "name": "Explicitly detect sector size in use", "description": "", "technique": null, "references": [] }, "DFM-1046": { "id": "DFM-1046", "name": "Check pointer offsets for both 512 and 4096 sectors sizes", "description": "", "technique": null, "references": [] }, "DFM-1047": { "id": "DFM-1047", "name": "Testing partition table parsing on standard and non-standard configurations", "description": "", "technique": null, "references": [] }, "DFM-1048": { "id": "DFM-1048", "name": "Check built-in integrity checks of partition tables where possible", "description": "", "technique": null, "references": [] }, "DFM-1049": { "id": "DFM-1049", "name": "Check consistency between primary and backup partition tables (where possible)", "description": "", "technique": null, "references": [] }, "DFM-1050": { "id": "DFM-1050", "name": "Manually verify relevant data", "description": "", "technique": null, "references": [] }, "DFM-1051": { "id": "DFM-1051", "name": "Validation of specific file system parsing operation for the file system under consideration", "description": "", "technique": null, "references": [] }, "DFM-1052": { "id": "DFM-1052", "name": "Use of a second independent tool to compare live file system listing", "description": "", "technique": null, "references": [] }, "DFM-1053": { "id": "DFM-1053", "name": "Verification of the file system specification used as the basis for the tool development", "description": "", "technique": null, "references": [] }, "DFM-1054": { "id": "DFM-1054", "name": "Testing of message extraction and parsing features", "description": "", "technique": null, "references": [] }, "DFM-1055": { "id": "DFM-1055", "name": "Correlation of data extracted with data from service provider", "description": "", "technique": null, "references": [] }, "DFM-1056": { "id": "DFM-1056", "name": "Correlation of message data from third party data (another participant in message thread)", "description": "", "technique": null, "references": [] }, "DFM-1057": { "id": "DFM-1057", "name": "Testing of parsing of syncronisation artefacts", "description": "", "technique": null, "references": [] }, "DFM-1058": { "id": "DFM-1058", "name": "Checking for other confirmatory indicators of the inferred device's existence.", "description": "", "technique": null, "references": [] }, "DFM-1059": { "id": "DFM-1059", "name": "Ongoing research and documentation of syncronisation artefacts", "description": "", "technique": null, "references": [] }, "DFM-1060": { "id": "DFM-1060", "name": "Repair salvaged content by grafting different reference data onto fragment(s)", "description": "", "technique": "DFT-1099", "references": [] }, "DFM-1061": { "id": "DFM-1061", "name": "Use digital stratigraphy to attempt to attribute data within a specific file system", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1117", "relevance_summary_280": "" } ] }, "DFM-1062": { "id": "DFM-1062", "name": "Verify semantic integrity of carved content using manual inspection of relevant data", "description": "", "technique": null, "references": [] }, "DFM-1063": { "id": "DFM-1063", "name": "Verify semantic integrity of carved content using an automated tool", "description": "", "technique": null, "references": [] }, "DFM-1064": { "id": "DFM-1064", "name": "Verify that salvaged content is renderable using visual inspection of displayed/rendered content ", "description": "", "technique": null, "references": [] }, "DFM-1065": { "id": "DFM-1065", "name": "Render salvaged content by reconstructing a container around fragment(s) based on detected video frame and audio sample locations and (if available) a reference video file with similar parameters.", "description": "", "technique": null, "references": [] }, "DFM-1066": { "id": "DFM-1066", "name": "Attempt to reconstruct browser activity from other areas of disk", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1032", "relevance_summary_280": "" } ] }, "DFM-1067": { "id": "DFM-1067", "name": "Analyze web browser memory for web browsing activity", "description": "", "technique": "DFT-1105", "references": [ { "DFCite_id": "DFCite-1032", "relevance_summary_280": "" } ] }, "DFM-1068": { "id": "DFM-1068", "name": "Use digital sniffer dogs to assist in locating evidence", "description": "", "technique": "DFT-1006", "references": [ { "DFCite_id": "DFCite-1114", "relevance_summary_280": "" } ] }, "DFM-1069": { "id": "DFM-1069", "name": "Use a SyncTriage style approach to determine existence other synchronized devices", "description": "", "technique": "DFT-1007", "references": [ { "DFCite_id": "DFCite-1057", "relevance_summary_280": "" } ] }, "DFM-1070": { "id": "DFM-1070", "name": "Ensure hash algorithm(s) used are resistant to collisions through data manipulation", "description": "", "technique": null, "references": [] }, "DFM-1071": { "id": "DFM-1071", "name": "Thorough testing of write blocker against multiple targets to ensure that writes are not possible.", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1089", "relevance_summary_280": "" } ] }, "DFM-1072": { "id": "DFM-1072", "name": "Regular checks for hardware write blocker firmware updates.", "description": "", "technique": null, "references": [] }, "DFM-1073": { "id": "DFM-1073", "name": "Subscription to notifications from write blocker vendor for firmware updates or identified problems.", "description": "", "technique": null, "references": [] }, "DFM-1074": { "id": "DFM-1074", "name": "Validate image hash against one stored externally to the image in a trusted location.", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1060", "relevance_summary_280": "" } ] }, "DFM-1075": { "id": "DFM-1075", "name": "Testing programme to validate hashes of data in images is calculated correctly", "description": "", "technique": null, "references": [] }, "DFM-1076": { "id": "DFM-1076", "name": "Testing programme to validate hashes of metadata in images is calculated correctly", "description": "", "technique": null, "references": [] }, "DFM-1077": { "id": "DFM-1077", "name": "Ensure potential secondary locations for stored message content are reviewed.", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1097", "relevance_summary_280": "" } ] }, "DFM-1078": { "id": "DFM-1078", "name": "Use of multiple carving tools and comparing results", "description": "", "technique": null, "references": [] }, "DFM-1079": { "id": "DFM-1079", "name": "Analyse file content to detect incompatibility between the content and the recovered file system metadata", "description": "", "technique": null, "references": [] }, "DFM-1080": { "id": "DFM-1080", "name": "Use a hashset of known files to detect that recovered content does not match the expected file content", "description": "", "technique": null, "references": [] }, "DFM-1081": { "id": "DFM-1081", "name": "Check if recovered content matches with size in metadata e.g. file footer at expected location.", "description": "", "technique": null, "references": [] }, "DFM-1082": { "id": "DFM-1082", "name": "Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file", "description": "", "technique": null, "references": [] }, "DFM-1083": { "id": "DFM-1083", "name": "Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)", "description": "", "technique": null, "references": [] }, "DFM-1084": { "id": "DFM-1084", "name": "Test that the tool used expresses uncertainty in the classification of file recovery results", "description": "", "technique": null, "references": [] }, "DFM-1085": { "id": "DFM-1085", "name": "Use of multiple tools to verify disk image hash", "description": "", "technique": null, "references": [] }, "DFM-1086": { "id": "DFM-1086", "name": "Acquire the parts of memory with interconnected data first, before proceeding with a sequential acquisition.", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1111", "relevance_summary_280": "" } ] }, "DFM-1087": { "id": "DFM-1087", "name": "Acquire memory from outside of the target system for example using direct memory access (DMA) devices", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1085", "relevance_summary_280": "" } ] }, "DFM-1088": { "id": "DFM-1088", "name": "If applicable, leverage hardware virtualization utilities to add a hypervisor to the system, i.e., virtualize the original system. This allows to either freeze the system before the acquisition or, if the system should not be completely frozen, to copy pages before they are modified.", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1096", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1025", "relevance_summary_280": "" } ] }, "DFM-1089": { "id": "DFM-1089", "name": "Attempt physical disk repair", "description": "", "technique": null, "references": [] }, "DFM-1090": { "id": "DFM-1090", "name": "Compare carved results against known files (e.g. from another source)", "description": "", "technique": null, "references": [] }, "DFM-1091": { "id": "DFM-1091", "name": "Use a brute force attack instead", "description": "", "technique": "DFT-1034", "references": [] }, "DFM-1092": { "id": "DFM-1092", "name": "Optimise dictionary", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1076", "relevance_summary_280": "" } ] }, "DFM-1093": { "id": "DFM-1093", "name": "Use mangling rules to generate variants of candidate passwords", "description": "", "technique": null, "references": [] }, "DFM-1094": { "id": "DFM-1094", "name": "Include contextual information when assembling the dictionary", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1076", "relevance_summary_280": "" } ] }, "DFM-1095": { "id": "DFM-1095", "name": "Order dictionary to test the most likely candidates first", "description": "", "technique": null, "references": [] }, "DFM-1096": { "id": "DFM-1096", "name": "Apply additional resources to dictionary attack", "description": "", "technique": null, "references": [] }, "DFM-1097": { "id": "DFM-1097", "name": "Attempt to obtain password/passcode from the device owner", "description": "", "technique": "DFT-1037", "references": [] }, "DFM-1098": { "id": "DFM-1098", "name": "Optimise the brute force search space", "description": "", "technique": null, "references": [] }, "DFM-1099": { "id": "DFM-1099", "name": "Use a dictionary attack instead", "description": "", "technique": "DFT-1035", "references": [] }, "DFM-1100": { "id": "DFM-1100", "name": "Apply additional resources to brute force attack", "description": "", "technique": null, "references": [] }, "DFM-1101": { "id": "DFM-1101", "name": "Apply time offset to timestamp", "description": "", "technique": "DFT-1153", "references": [] }, "DFM-1102": { "id": "DFM-1102", "name": "Apply techniques to read remapped sectors", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1124", "relevance_summary_280": "" } ] }, "DFM-1103": { "id": "DFM-1103", "name": "Check that analysis of timestamp accuracy on which event reconstruction is based has been performed", "description": "", "technique": null, "references": [] }, "DFM-1104": { "id": "DFM-1104", "name": "Testing of report generation functionality that all intended bookmarks are included", "description": "", "technique": null, "references": [] }, "DFM-1105": { "id": "DFM-1105", "name": "Manual verification that all intended bookmarks are included in the generated report.", "description": "", "technique": null, "references": [] }, "DFM-1106": { "id": "DFM-1106", "name": "Testing that generated reports correctly represent/render all expected file types", "description": "", "technique": null, "references": [] }, "DFM-1107": { "id": "DFM-1107", "name": "Manual verification that all bookmarked items in the report are correctly rendered/represented.", "description": "", "technique": null, "references": [] }, "DFM-1108": { "id": "DFM-1108", "name": "Preserve hash in secure location of the generated report so intentional or unintentional modifications can be detected.", "description": "", "technique": null, "references": [] }, "DFM-1109": { "id": "DFM-1109", "name": "Testing that tool(s) identify file types correctly", "description": "", "technique": null, "references": [] }, "DFM-1110": { "id": "DFM-1110", "name": "Manual review of files classified as unknown", "description": "", "technique": null, "references": [] }, "DFM-1111": { "id": "DFM-1111", "name": "Use of multiple tools to classify file types", "description": "", "technique": null, "references": [] }, "DFM-1112": { "id": "DFM-1112", "name": "Use of AI to classify files in addition to standard programmatic methods", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1141", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1002", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1078", "relevance_summary_280": "" } ] }, "DFM-1113": { "id": "DFM-1113", "name": "Use mobile exploit to gain privileged access", "description": "", "technique": "DFT-1040", "references": [] }, "DFM-1114": { "id": "DFM-1114", "name": "Clear use of language around mobile file system extractions, making the limitations clear and differentiating from a full disk image", "description": "", "technique": null, "references": [] }, "DFM-1115": { "id": "DFM-1115", "name": "Attempt to brute force user PIN (potentially on device)", "description": "", "technique": "DFT-1034", "references": [] }, "DFM-1116": { "id": "DFM-1116", "name": "Attempt to dictionary attack user PIN (potentially on device)", "description": "", "technique": "DFT-1035", "references": [] }, "DFM-1117": { "id": "DFM-1117", "name": "Attempt to obtain user PIN from user", "description": "", "technique": "DFT-1037", "references": [] }, "DFM-1118": { "id": "DFM-1118", "name": "Recover appropriate database table joins from source application source code", "description": "", "technique": null, "references": [] }, "DFM-1119": { "id": "DFM-1119", "name": "Recover appropriate database table joins from source application reverse engineering", "description": "", "technique": null, "references": [] }, "DFM-1120": { "id": "DFM-1120", "name": "Recover appropriate database table joins from source application developer documentation", "description": "", "technique": null, "references": [] }, "DFM-1121": { "id": "DFM-1121", "name": "Infer appropriate table joins from extensive experimentation with known ground-truth data", "description": "", "technique": "DFT-1090", "references": [] }, "DFM-1122": { "id": "DFM-1122", "name": "Apply non-allocated record recovery to database file(s)", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1113", "relevance_summary_280": "" } ] }, "DFM-1123": { "id": "DFM-1123", "name": "Apply system-wide record recovery for non-allocated database record data structures", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1113", "relevance_summary_280": "" } ] }, "DFM-1124": { "id": "DFM-1124", "name": "Examine database contents with and without Write Ahead Log (WAL) files applied", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1021", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1022", "relevance_summary_280": "" } ] }, "DFM-1125": { "id": "DFM-1125", "name": "Examine database journal files", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1022", "relevance_summary_280": "" } ] }, "DFM-1126": { "id": "DFM-1126", "name": "Use forensic bootable environment to gain access to internal media", "description": "", "technique": "DFT-1113", "references": [] }, "DFM-1127": { "id": "DFM-1127", "name": "Use a similar system to test steps required to interrupt the normal boot process and boot from Trusted Bootable Environment", "description": "", "technique": null, "references": [] }, "DFM-1128": { "id": "DFM-1128", "name": "Use a Trusted Bootable Environment that is permitted to boot", "description": "", "technique": null, "references": [] }, "DFM-1129": { "id": "DFM-1129", "name": "Use USB flashdrive version if a CD version is not permitted to boot", "description": "", "technique": null, "references": [] }, "DFM-1130": { "id": "DFM-1130", "name": "Disable Secureboot in BIOS to permit bootable environment to load (risks wiping FDE key, requiring ADK).", "description": "", "technique": null, "references": [] }, "DFM-1131": { "id": "DFM-1131", "name": "Use a Trusted Bootable Environment that supports accessing the internal disk", "description": "", "technique": null, "references": [] }, "DFM-1132": { "id": "DFM-1132", "name": "Use a Trusted Bootable Environment that supports decryption of the internal disk", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1026", "relevance_summary_280": "" } ] }, "DFM-1133": { "id": "DFM-1133", "name": "Acquire the encrypted contents of the internal disk and decrypt the copy within a virtualized environment", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1026", "relevance_summary_280": "" } ] }, "DFM-1134": { "id": "DFM-1134", "name": "Testing that connected devices are detected.", "description": "", "technique": null, "references": [] }, "DFM-1135": { "id": "DFM-1135", "name": "Testing that correct metadata/status of connected devices is extracted", "description": "", "technique": null, "references": [] }, "DFM-1136": { "id": "DFM-1136", "name": "Testing of archive format parsing", "description": "", "technique": null, "references": [] }, "DFM-1137": { "id": "DFM-1137", "name": "Review of logs for any file extraction errors", "description": "", "technique": null, "references": [] }, "DFM-1138": { "id": "DFM-1138", "name": "Testing file name/path pattern matching engine", "description": "", "technique": null, "references": [] }, "DFM-1139": { "id": "DFM-1139", "name": "Use automated software monitoring to detect app artefact changes", "description": "", "technique": "DFT-1119", "references": [] }, "DFM-1140": { "id": "DFM-1140", "name": "Use automation framework to emulate user actions to generate test data", "description": "", "technique": null, "references": [] }, "DFM-1141": { "id": "DFM-1141", "name": "Careful review of case brief for case-specific keyword list generation", "description": "", "technique": null, "references": [] }, "DFM-1142": { "id": "DFM-1142", "name": "Review of case-specific keyword list by case officer", "description": "", "technique": null, "references": [] }, "DFM-1143": { "id": "DFM-1143", "name": "Use live logical keyword search", "description": "", "technique": "DFT-1127", "references": [] }, "DFM-1144": { "id": "DFM-1144", "name": "Use indexed keyword search", "description": "", "technique": "DFT-1124", "references": [] }, "DFM-1145": { "id": "DFM-1145", "name": "Apply OCR to files and search or index resulting text", "description": "", "technique": null, "references": [] }, "DFM-1146": { "id": "DFM-1146", "name": "Ensure keyword indexing settings capture text encodings required during indexing", "description": "", "technique": null, "references": [] }, "DFM-1147": { "id": "DFM-1147", "name": "Ensure keyword indexing settings configure text substring handling as required during indexing", "description": "", "technique": null, "references": [] }, "DFM-1148": { "id": "DFM-1148", "name": "Ensure keyword indexing settings configure case sensitivity for indexing as required", "description": "", "technique": null, "references": [] }, "DFM-1149": { "id": "DFM-1149", "name": "Ensure keyword indexing settings mean that decompression will be applied as required during indexing", "description": "", "technique": null, "references": [] }, "DFM-1150": { "id": "DFM-1150", "name": "Ensure keyword indexing settings mean that file formats will be decoded as required during indexing", "description": "", "technique": null, "references": [] }, "DFM-1151": { "id": "DFM-1151", "name": "Check keyword results are part of allocated file, or if not perform detailed analysis to determine if the association between keyword results and file is valid", "description": "", "technique": null, "references": [] }, "DFM-1152": { "id": "DFM-1152", "name": "Peer review of case-specific keyword list created", "description": "", "technique": null, "references": [] }, "DFM-1153": { "id": "DFM-1153", "name": "Index data in the case and perform iterative keyword searching using the index", "description": "", "technique": "DFT-1124", "references": [] }, "DFM-1154": { "id": "DFM-1154", "name": "Testing for live message recovery from AI companion app", "description": "", "technique": null, "references": [] }, "DFM-1155": { "id": "DFM-1155", "name": "Testing for deleted message recovery from AI companion app", "description": "", "technique": null, "references": [] }, "DFM-1156": { "id": "DFM-1156", "name": "Testing that message sender and recipient extraction are correct", "description": "", "technique": null, "references": [] }, "DFM-1157": { "id": "DFM-1157", "name": "Ensure messages are viewed in the context of the message thread", "description": "", "technique": null, "references": [] }, "DFM-1158": { "id": "DFM-1158", "name": "Testing for live picture message recovery from AI companion app", "description": "", "technique": null, "references": [] }, "DFM-1159": { "id": "DFM-1159", "name": "Testing for deleted picture message recovery from AI companion app", "description": "", "technique": null, "references": [] }, "DFM-1160": { "id": "DFM-1160", "name": "Testing that picture message sender and recipient extraction are correct", "description": "", "technique": null, "references": [] }, "DFM-1161": { "id": "DFM-1161", "name": "Testing of live call record recovery from AI companion app", "description": "", "technique": null, "references": [] }, "DFM-1162": { "id": "DFM-1162", "name": "Testing of deleted call record recovery from AI companion app", "description": "", "technique": null, "references": [] }, "DFM-1163": { "id": "DFM-1163", "name": "Testing that call record caller and recipient extraction are correct", "description": "", "technique": null, "references": [] }, "DFM-1164": { "id": "DFM-1164", "name": "Testing of account details recovery from AI companion app", "description": "", "technique": null, "references": [] }, "DFM-1165": { "id": "DFM-1165", "name": "Ensure data collection prior to any interaction with app", "description": "", "technique": null, "references": [] }, "DFM-1166": { "id": "DFM-1166", "name": "Remove all network connectivity from device", "description": "", "technique": null, "references": [] }, "DFM-1167": { "id": "DFM-1167", "name": "Check time of account access is prior to device seizure time", "description": "", "technique": null, "references": [] }, "DFM-1168": { "id": "DFM-1168", "name": "Request logs of access times from service provider", "description": "", "technique": null, "references": [] }, "DFM-1169": { "id": "DFM-1169", "name": "Testing of app settings recovery from AI companion app", "description": "", "technique": null, "references": [] }, "DFM-1170": { "id": "DFM-1170", "name": "Experiments with test device to view possible settings of forensic value", "description": "", "technique": null, "references": [] }, "DFM-1171": { "id": "DFM-1171", "name": "Testing of the recovery of companion AI bot settings", "description": "", "technique": null, "references": [] }, "DFM-1172": { "id": "DFM-1172", "name": "Also examine any older versions of the logs from backups", "description": "", "technique": null, "references": [] }, "DFM-1173": { "id": "DFM-1173", "name": "Check logging settings so the bounds of logging are known", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1140", "relevance_summary_280": "" } ] }, "DFM-1174": { "id": "DFM-1174", "name": "Check logging settings to determine expected behaviour", "description": "", "technique": null, "references": [] }, "DFM-1175": { "id": "DFM-1175", "name": "Ensure any available archive logs are also examined", "description": "", "technique": null, "references": [] }, "DFM-1176": { "id": "DFM-1176", "name": "Ensure log entry type interpretation applies for the software version being examined", "description": "", "technique": null, "references": [] }, "DFM-1177": { "id": "DFM-1177", "name": "Ensure resolution or limitations of logfile timestamps are understood", "description": "", "technique": null, "references": [] }, "DFM-1178": { "id": "DFM-1178", "name": "Ensure timezone handling method for logfile timestamps is understood", "description": "", "technique": null, "references": [] }, "DFM-1179": { "id": "DFM-1179", "name": "If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation", "description": "", "technique": null, "references": [] }, "DFM-1180": { "id": "DFM-1180", "name": "Testing correct extraction of logfile entry timestamps", "description": "", "technique": null, "references": [] }, "DFM-1181": { "id": "DFM-1181", "name": "Testing logfile parsing capability", "description": "", "technique": null, "references": [] }, "DFM-1182": { "id": "DFM-1182", "name": "Testing of correct log entry type extraction", "description": "", "technique": null, "references": [] }, "DFM-1187": { "id": "DFM-1187", "name": "Ensure browser cache data is also considered ", "description": "", "technique": "DFT-1138", "references": [] }, "DFM-1188": { "id": "DFM-1188", "name": "Ensure all profiles of the web browser are considered", "description": "", "technique": "DFT-1144", "references": [] }, "DFM-1189": { "id": "DFM-1189", "name": "Conduct experiments to determine if content from the page in question is cached only when viewed in the browser", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1064", "relevance_summary_280": "" } ] }, "DFM-1190": { "id": "DFM-1190", "name": "Ensure that the context of recovered URLs is considered during event reconstruction", "description": "", "technique": null, "references": [] }, "DFM-1191": { "id": "DFM-1191", "name": "Ensure that profile configuration is examined rather than just folders within the standard profile folder", "description": "", "technique": "DFT-1143", "references": [ { "DFCite_id": "DFCite-1101", "relevance_summary_280": "" } ] }, "DFM-1192": { "id": "DFM-1192", "name": "Examine browser configuration to determine history retention settings", "description": "", "technique": "DFT-1143", "references": [] }, "DFM-1193": { "id": "DFM-1193", "name": "Obtain older versions of browser history files from backups or from file system versioning features", "description": "", "technique": null, "references": [] }, "DFM-1194": { "id": "DFM-1194", "name": "Consider carefully page titles and other details associated with older web history visits when details are recovered using SQL join queries.", "description": "", "technique": null, "references": [] }, "DFM-1195": { "id": "DFM-1195", "name": "Also examine browser cache to confirm details about an older web visit when details are recovered using SQL join queries.", "description": "", "technique": "DFT-1138", "references": [] }, "DFM-1196": { "id": "DFM-1196", "name": "Check if file being recovered is smaller than a block", "description": "", "technique": null, "references": [] }, "DFM-1197": { "id": "DFM-1197", "name": "Check if file being recovered is resident (applicable on some file systems)", "description": "", "technique": null, "references": [] }, "DFM-1198": { "id": "DFM-1198", "name": "Check if file system and operating system make use of an 'allocated but unwritten' value e.g. VDL.", "description": "", "technique": null, "references": [] }, "DFM-1199": { "id": "DFM-1199", "name": "Check all relevant file size metadata values when recovering file content", "description": "", "technique": null, "references": [] }, "DFM-1200": { "id": "DFM-1200", "name": "Ensure that inconsistencies between allocated data size and data written size are clearly flagged.", "description": "", "technique": null, "references": [] }, "DFM-1203": { "id": "DFM-1203", "name": "Use indexed keyword search over broader content of the data source", "description": "", "technique": "DFT-1124", "references": [] }, "DFM-1204": { "id": "DFM-1204", "name": "Use live keyword search over broader content of the data source", "description": "", "technique": "DFT-1125", "references": [] }, "DFM-1205": { "id": "DFM-1205", "name": "Use wordlist generator with case data", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1094", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1095", "relevance_summary_280": "" } ] }, "DFM-1206": { "id": "DFM-1206", "name": "Ensure that tools used clearly separate fact from interpretation", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1070", "relevance_summary_280": "" } ] }, "DFM-1207": { "id": "DFM-1207", "name": "Ensure training is in place for tool operators to separate fact from interpretation within the tool used", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1068", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1070", "relevance_summary_280": "" } ] }, "DFM-1208": { "id": "DFM-1208", "name": "Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1068", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1070", "relevance_summary_280": "" } ] }, "DFM-1209": { "id": "DFM-1209", "name": "Ensure that tools used present the uncertainty associated with automated interpretation of data", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1068", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1070", "relevance_summary_280": "" } ] }, "DFM-1210": { "id": "DFM-1210", "name": "Use a forensic image format with internal integrity and continuity metadata", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1035", "relevance_summary_280": "" } ] }, "DFM-1211": { "id": "DFM-1211", "name": "Test the parsing of split forensic images", "description": "", "technique": null, "references": [] }, "DFM-1212": { "id": "DFM-1212", "name": "Test the parsing of split forensic images with the maximum number of segments possible", "description": "", "technique": null, "references": [] }, "DFM-1213": { "id": "DFM-1213", "name": "Test the parsing of split forensic images with missing segments", "description": "", "technique": null, "references": [] }, "DFM-1214": { "id": "DFM-1214", "name": "Ensure forensic tool UI clearly warns that there are problems while parsing a split forensic image file", "description": "", "technique": null, "references": [] }, "DFM-1215": { "id": "DFM-1215", "name": "Test the parsing of split forensic images with a corrupt segment", "description": "", "technique": null, "references": [] }, "DFM-1216": { "id": "DFM-1216", "name": "Check that the assumption is valid that the specific local/external timestamp pair should be correlated", "description": "", "technique": null, "references": [] }, "DFM-1217": { "id": "DFM-1217", "name": "Consider multiple time anchors and check if timestamps from multiple external time sources agree", "description": "", "technique": null, "references": [] }, "DFM-1218": { "id": "DFM-1218", "name": "Ensure that tools and processes take into account all current knowledge on sources of local/external timestamp pairs (time anchors)", "description": "", "technique": null, "references": [] }, "DFM-1219": { "id": "DFM-1219", "name": "Manual verification of timestamp decoding within a time anchor", "description": "", "technique": null, "references": [] }, "DFM-1220": { "id": "DFM-1220", "name": "Periodically keep records of time offsets of significant external servers", "description": "", "technique": "DFT-1110", "references": [] }, "DFM-1221": { "id": "DFM-1221", "name": "Testing of timestamp decoding within a time anchor", "description": "", "technique": null, "references": [] }, "DFM-1222": { "id": "DFM-1222", "name": "Testing to ensure that tooling is able to extract local/external timestamp pairs (time anchors)", "description": "", "technique": null, "references": [] }, "DFM-1223": { "id": "DFM-1223", "name": "Apply time zone based offsets only to UTC stored timestamps", "description": "", "technique": null, "references": [] }, "DFM-1224": { "id": "DFM-1224", "name": "Check for location artifacts to infer the time zone at a specific moment", "description": "", "technique": null, "references": [] }, "DFM-1225": { "id": "DFM-1225", "name": "Estimate clock offset at a specific point in time using time anchoring", "description": "", "technique": "DFT-1134", "references": [ { "DFCite_id": "DFCite-1020", "relevance_summary_280": "Proposes the mitigation technique described here and demonstrates its application through two case studies" } ] }, "DFM-1226": { "id": "DFM-1226", "name": "Testing to determine whether a timestamp is in UTC or local time", "description": "", "technique": null, "references": [] }, "DFM-1227": { "id": "DFM-1227", "name": "Search for indicators of clock tampering", "description": "", "technique": "DFT-1129", "references": [] }, "DFM-1228": { "id": "DFM-1228", "name": "Record system clock offset", "description": "", "technique": "DFT-1111", "references": [] }, "DFM-1229": { "id": "DFM-1229", "name": "Determine last timezone used on system", "description": "", "technique": null, "references": [] }, "DFM-1230": { "id": "DFM-1230", "name": "Ensure that daylight savings offsets that are applied to timestamps are correct", "description": "", "technique": null, "references": [] }, "DFM-1231": { "id": "DFM-1231", "name": "Make use of 'paired searching'", "description": "According to Fisher & Fisher (2012): \"Indoor crime scene searches are best done with two persons. One easy way of accomplishing a search in a room is to divide it in half. Each investigator searches one half. After they have done a thorough search, they switch halves.\" ", "technique": null, "references": [ { "DFCite_id": "DFCite-1043", "relevance_summary_280": "" } ] }, "DFM-1232": { "id": "DFM-1232", "name": "Adopt a systematic search pattern", "description": "According to Fisher & Fisher (2012): \"Criminal investigation texts recommend a variety of search patterns: the strip or lane search, grid search, spiral search, and quadrant search. \" ", "technique": null, "references": [ { "DFCite_id": "DFCite-1043", "relevance_summary_280": "" } ] }, "DFM-1233": { "id": "DFM-1233", "name": "Test data extraction methods against reference data with known timestamps", "description": "", "technique": null, "references": [] }, "DFM-1234": { "id": "DFM-1234", "name": "Exploit device to facilitate password/pincode attacks", "description": "", "technique": "DFT-1040", "references": [] }, "DFM-1235": { "id": "DFM-1235", "name": "Attempt to obtain password/pincode with brute force attacks", "description": "", "technique": "DFT-1034", "references": [] }, "DFM-1236": { "id": "DFM-1236", "name": "Attempt to obtain password/pincode with dictionary attacks", "description": "", "technique": "DFT-1035", "references": [] }, "DFM-1237": { "id": "DFM-1237", "name": "Ensure that archive format used can handle sufficiently large files", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1130", "relevance_summary_280": "" } ] }, "DFM-1238": { "id": "DFM-1238", "name": "Configure device to enable required service", "description": "For example turning on Developer Mode on Android to enable ADB", "technique": "DFT-1158", "references": [ { "DFCite_id": "DFCite-1003", "relevance_summary_280": "" }, { "DFCite_id": "DFCite-1004", "relevance_summary_280": "" } ] }, "DFM-1239": { "id": "DFM-1239", "name": "Obtain possible passwords/PIN codes from other devices with limited security", "description": "", "technique": "DFT-1033", "references": [] }, "DFM-1240": { "id": "DFM-1240", "name": "Check for indications of disk backed memory pages", "description": "", "technique": null, "references": [ { "DFCite_id": "DFCite-1143", "relevance_summary_280": "" } ] }, "DFM-1241": { "id": "DFM-1241", "name": "Avoid direct connection to media and use hardware write blocker instead", "description": "", "technique": "DFT-1012", "references": [] }, "DFM-1242": { "id": "DFM-1242", "name": "Testing live message recovery from multiplayer gaming app", "description": "", "technique": null, "references": [] }, "DFM-1243": { "id": "DFM-1243", "name": "Request user data from multiplayer gaming platform and compare", "description": "", "technique": null, "references": [] }, "DFM-1244": { "id": "DFM-1244", "name": "Testing deleted message recovery from multiplayer gaming app", "description": "", "technique": null, "references": [] }, "DFM-1245": { "id": "DFM-1245", "name": "Testing live contact recovery from a multiplayer gaming app", "description": "", "technique": null, "references": [] }, "DFM-1246": { "id": "DFM-1246", "name": "Testing deleted contact recovery from a multiplayer gaming app", "description": "", "technique": null, "references": [] }, "DFM-1247": { "id": "DFM-1247", "name": "Testing that gaming app configuration information is recovered correctly", "description": "", "technique": null, "references": [] }, "DFM-1248": { "id": "DFM-1248", "name": "Testing to ensure that live accounts are recovered correctly from a gaming app", "description": "", "technique": null, "references": [] }, "DFM-1249": { "id": "DFM-1249", "name": "Testing to ensure that deleted accounts are recovered correctly from a gaming app", "description": "", "technique": null, "references": [] }, "DFM-1250": { "id": "DFM-1250", "name": "Test that timeline analysis tool returns correct results when filter criteria are provided", "description": "", "technique": null, "references": [] }, "DFM-1251": { "id": "DFM-1251", "name": "Manually review timeline entries for relevance", "description": "", "technique": null, "references": [] }, "DFM-1252": { "id": "DFM-1252", "name": "Refine timeline filtering criteria to reduce set of entries to a manageable set for review", "description": "", "technique": null, "references": [] }, "DFM-1253": { "id": "DFM-1253", "name": "Ensure that timeline analysis tool highlights that a filtered timeline is presented e.g. x/y entries shown", "description": "", "technique": null, "references": [] }, "DFM-1259": { "id": "DFM-1259", "name": "Test that a timeline tool correctly sorts entries", "description": "", "technique": null, "references": [] }, "DFM-1260": { "id": "DFM-1260", "name": "Check that sorted timeline contains same number of entries as unsorted timeline", "description": "", "technique": null, "references": [] }, "DFM-1261": { "id": "DFM-1261", "name": "Test that timeline sorting correctly represents entries with low resolution timestamps", "description": "", "technique": null, "references": [] }, "DFM-1262": { "id": "DFM-1262", "name": "Test that timeline tools represent timeline entries with the same value at the same point in time, not in an artificial order", "description": "", "technique": null, "references": [] }, "DFM-1263": { "id": "DFM-1263", "name": "Check timeline entry to ensure that a timezone has not already been applied and shifted the timestamp value", "description": "", "technique": null, "references": [] }, "DFM-1264": { "id": "DFM-1264", "name": "Ensure that tools used extract data from any operating system notification databases or relevant files", "description": "", "technique": null, "references": [] }, "DFM-1265": { "id": "DFM-1265", "name": "Test that the tool used correctly recovers operating system notifications from the data structures examined", "description": "", "technique": null, "references": [] }, "DFM-1266": { "id": "DFM-1266", "name": "Examine longer lasting operating system notification storage locations if possible", "description": "", "technique": null, "references": [] }, "DFM-1267": { "id": "DFM-1267", "name": "Test that the tool used correctly recovers operating system notification timestamps from the data structures examined", "description": "", "technique": null, "references": [] }, "DFM-1268": { "id": "DFM-1268", "name": "Count timeline entries before and after sorting a timeline and check they are the same", "description": "", "technique": null, "references": [] }, "DFM-1269": { "id": "DFM-1269", "name": "Generate UUIDs of all timeline entries prior to a sort and ensure that all are present post-sort", "description": "", "technique": null, "references": [] }, "DFM-1270": { "id": "DFM-1270", "name": "Systematically analyse all fields and timestamps in API responses to recover evidence that would otherwise be missed", "description": "", "technique": null, "references": [] }, "DFM-1271": { "id": "DFM-1271", "name": "Cross-validate API-derived artefacts against independent sources to improve reliability", "description": "", "technique": null, "references": [] }, "DFM-1272": { "id": "DFM-1272", "name": "Test that the tool extracts the correct operating system", "description": "", "technique": null, "references": [] }, "DFM-1273": { "id": "DFM-1273", "name": "Ensure that older operating system versions are also displayed along with current version", "description": "", "technique": null, "references": [] }, "DFM-1274": { "id": "DFM-1274", "name": "Testing of Windows HIVE file parsing", "description": "", "technique": null, "references": [] }, "DFM-1275": { "id": "DFM-1275", "name": "Ensure tool presents Registry key modification times as applicable to a key only, not any individual value", "description": "", "technique": null, "references": [] }, "DFM-1276": { "id": "DFM-1276", "name": "Collect from all available API endpoints, including undocumented ones identified via client reverse engineering", "description": "", "technique": null, "references": [] }, "DFM-1277": { "id": "DFM-1277", "name": "Monitor structural changes to the target API and update parsing logic to prevent silent data loss", "description": "", "technique": null, "references": [] }, "DFM-1278": { "id": "DFM-1278", "name": "Place device in faraday bag to block connectivity", "description": "", "technique": "DFT-1010", "references": [] }, "DFM-1279": { "id": "DFM-1279", "name": "Ensure all relevant connectivity settings for this particular device have been disabled", "description": "", "technique": null, "references": [] }, "DFM-1280": { "id": "DFM-1280", "name": "Compare the metadata stored in a forensic container with that recorded in accompanying documentation", "description": "", "technique": null, "references": [] }, "DFM-1281": { "id": "DFM-1281", "name": "Compare the cryptographic hash stored in a forensic container with one recorded externally", "description": "", "technique": null, "references": [] }, "DFM-1282": { "id": "DFM-1282", "name": "Use up-to-date API", "description": "", "technique": null, "references": [] }, "DFM-1283": { "id": "DFM-1283", "name": "Use an alternative method that does not truncate data during format conversion", "description": "", "technique": null, "references": [] }, "DFM-1284": { "id": "DFM-1284", "name": "Ensure tool configuration is correct", "description": "", "technique": null, "references": [] }, "DFM-1285": { "id": "DFM-1285", "name": "Testing that a tool acquires complete and accurate data", "description": "", "technique": null, "references": [] }, "DFM-1286": { "id": "DFM-1286", "name": "Acquire data from production environment", "description": "", "technique": null, "references": [] }, "DFM-1287": { "id": "DFM-1287", "name": "Update non-production environment with latest production data", "description": "", "technique": null, "references": [] }, "DFM-1288": { "id": "DFM-1288", "name": "Ensure that tools preserve metadata and relationships", "description": "", "technique": null, "references": [] }, "DFM-1289": { "id": "DFM-1289", "name": "Acquire cloud service logs separately", "description": "", "technique": null, "references": [] }, "DFM-1290": { "id": "DFM-1290", "name": "Request cloud service logs from provider", "description": "", "technique": null, "references": [] }, "DFM-1291": { "id": "DFM-1291", "name": "Obtain an up-to-date schema", "description": "", "technique": null, "references": [] }, "DFM-1292": { "id": "DFM-1292", "name": "Rate limit API calls to stay within limits", "description": "", "technique": null, "references": [] }, "DFM-1293": { "id": "DFM-1293", "name": "Contact cloud service provider to lift API limits", "description": "", "technique": null, "references": [] }, "DFM-1294": { "id": "DFM-1294", "name": "Ensure credentials have sufficient permissions", "description": "", "technique": null, "references": [] }, "DFM-1295": { "id": "DFM-1295", "name": "Ensure credentials have not expired or been revoked", "description": "", "technique": null, "references": [] }, "DFM-1296": { "id": "DFM-1296", "name": "Determine cause of failure and retry acquiring data when resolved", "description": "", "technique": null, "references": [] }, "DFM-1297": { "id": "DFM-1297", "name": "Use an alternative method that preserves historical data", "description": "", "technique": null, "references": [] }, "DFM-1298": { "id": "DFM-1298", "name": "Acquire raw data without conversion", "description": "", "technique": null, "references": [] }, "DFM-1299": { "id": "DFM-1299", "name": "Cryptographically sign generated forensic analysis reports with an asymmetric key", "description": "Sign analysis reports and export bundles with an asymmetric key (e.g., Ed25519, ECDSA) and embed signatures in a manifest so subsequent tampering is detectable without relying solely on storing a hash in a separate location (DFM-1108).", "technique": null, "references": [] }, "DFM-1300": { "id": "DFM-1300", "name": "Ensure that hypotheses are mutually exclusive", "description": "", "technique": null, "references": [] }, "DFM-1301": { "id": "DFM-1301", "name": "Avoid hypotheses that rely on untestable assertions", "description": "", "technique": null, "references": [] }, "DFM-1302": { "id": "DFM-1302", "name": "Frame the hypothesis as a relational prediction", "description": "", "technique": null, "references": [] }, "DFM-1303": { "id": "DFM-1303", "name": "Refer to the to the \"suspect\" rather than \"device user\" when generating a hypothesis related to the accused individual", "description": "", "technique": null, "references": [] }, "DFM-1304": { "id": "DFM-1304", "name": "Avoid judgmental or loaded terminology in generated hypotheses", "description": "", "technique": null, "references": [] }, "DFM-1305": { "id": "DFM-1305", "name": "Ensure that hypotheses address the correct level of hierarchy (source, activity, or offense level)", "description": "", "technique": null, "references": [] }, "DFM-1306": { "id": "DFM-1306", "name": "Generate hypotheses as declarative statements written either in the present tense or specifying a past time period.", "description": "Digital forensics deals with the remnant results of an event, not the event itself. In digital forensics, we make observations in the present that \"may support only approximations about the past event.\" Any reconstruction or simulation of a past situation is \"incomplete, imperfect and degraded by time passing.\" Even when we boot a disk image in a virtual environment, it is on different hardware with a different network configuration/connection. Effective evaluative practice captures this fact by stating hypotheses in present tense or in terms of current observations relating to a specified time period in the past. For example, \"The defendant is the primary user of the mobile device,\" or \"When the offense occurred, the defendant was the primary user of the mobile device.\" As another example, \"The computer system can render and play the video frames fully\" or \"During the relevant time period, the computer system could render and play the video frames fully.\" Specifying the time period helps avoid mistakenly thinking that it is possible to recreate a past state perfectly, may be different from the latest state of a system, and reminds that there is inherent uncertainty requiring evaluation.", "technique": null, "references": [] }, "DFM-1307": { "id": "DFM-1307", "name": "Do not generate hypotheses that are overly narrow and may increase the risk of over-specificity or confirmation bias. For instance, refer to a class (wiping tool, Trojan horse program) rather than a member of class (e.g., Eraser.exe, Backdoor.exe) to avoid narrowly focusing on a specific detail", "description": "", "technique": null, "references": [] }, "DFM-1308": { "id": "DFM-1308", "name": "Test that the tool recovers the date of operating system installation correctly", "description": "", "technique": null, "references": [] }, "DFM-1309": { "id": "DFM-1309", "name": "Ensure that the tool examines artifacts of previous operating system installation and presents them clearly", "description": "", "technique": null, "references": [] }, "DFM-1310": { "id": "DFM-1310", "name": "Recover older copies of data that contains mount point mappings from backups", "description": "", "technique": null, "references": [] }, "DFM-1311": { "id": "DFM-1311", "name": "Recover older copies of data that contains mount point mappings from file versioning artifacts", "description": "", "technique": null, "references": [] }, "DFM-1312": { "id": "DFM-1312", "name": "Test that tool can correctly recover mount point mappings", "description": "", "technique": null, "references": [] }, "DFM-1313": { "id": "DFM-1313", "name": "Check for the presence of multiple operating systems and process mount point mappings for all of them", "description": "", "technique": null, "references": [] }, "DFM-1314": { "id": "DFM-1314", "name": "Test that cryptographically hashing data on a connected drive/media performs correctly", "description": "This differs from testing hashing data within forensic images as it replicates conditions of hashing external media attached for imaging", "technique": null, "references": [] }, "DFM-1315": { "id": "DFM-1315", "name": "Test that cryptographic hashes are calculated correctly over all compression settings used for forensic images", "description": "", "technique": null, "references": [] }, "DFM-1316": { "id": "DFM-1316", "name": "Test that cryptographic hashing of split forensic images includes the data from all files that make up that image", "description": "", "technique": null, "references": [] }, "DFM-1317": { "id": "DFM-1317", "name": "State the hypotheses to be evaluated before the examination begins", "description": "", "technique": null, "references": [] }, "DFM-1318": { "id": "DFM-1318", "name": "Assign the probability or strength of the observations under each competing hypothesis", "description": "", "technique": null, "references": [] }, "DFM-1319": { "id": "DFM-1319", "name": "Evaluate the observations under each party's claims, not only the instructing party's", "description": "", "technique": null, "references": [] }, "DFM-1331": { "id": "DFM-1331", "name": "Create a persistent log of any errors during data copying process", "description": "During any data copying process e.g. sectors, bytes, files ensure that any errors encountered are logged with clear details as to the scope of the error.", "technique": null, "references": [] }, "DFM-1332": { "id": "DFM-1332", "name": "Flag when an AI context window has reached a limit and prevent further processing within that session", "description": "", "technique": null, "references": [] }, "DFM-1333": { "id": "DFM-1333", "name": "Use keyword searching to complement AI-based queries for relevant artifacts", "description": "", "technique": "DFT-1049", "references": [ { "DFCite_id": "DFCite-1169", "relevance_summary_280": "Shows that supplying a keyword list derived from known events raised LLM rule-based anomaly detection on a timeline from a mean score of 0.127 to 0.984 (Table 1, Section 4.3.2)." } ] }, "DFM-1334": { "id": "DFM-1334", "name": "Use timeline analysis to complement AI-based queries for relevant artifacts", "description": "", "technique": "DFT-1086", "references": [] }, "DFM-1335": { "id": "DFM-1335", "name": "Use hash matching to complement AI-based queries for relevant artifacts", "description": "", "technique": "DFT-1050", "references": [] }, "DFM-1336": { "id": "DFM-1336", "name": "Manually verify artifacts reported as relevant by an AI system", "description": "", "technique": "DFT-1054", "references": [] }, "DFM-1337": { "id": "DFM-1337", "name": "Manual verification of the existence of artifacts reported by an AI system", "description": "", "technique": "DFT-1202", "references": [] }, "DFM-1338": { "id": "DFM-1338", "name": "Ensure AI-based tooling provides IDs that link to the artefacts to facilitate manual verification", "description": "", "technique": null, "references": [] }, "DFM-1339": { "id": "DFM-1339", "name": "Ensure that the AI-based system is capable of providing reasoning behind the selection of results that are relevant", "description": "", "technique": null, "references": [] }, "DFM-1340": { "id": "DFM-1340", "name": "Ensure that the AI-based system is capable of providing an audit trail of artifacts considered but excluded as relevant, along with the exclusion criteria", "description": "", "technique": null, "references": [] }, "DFM-1341": { "id": "DFM-1341", "name": "Manually verify an observation used as part of an AI system's reasoning explanation", "description": "", "technique": "DFT-1202", "references": [] }, "DFM-1342": { "id": "DFM-1342", "name": "Manually verify the link between entities that is asserted by and AI-based system", "description": "", "technique": null, "references": [] }, "DFM-1343": { "id": "DFM-1343", "name": "Use deterministic event reconstruction approaches to complement AI-based event reconstruction", "description": "", "technique": "DFT-1086", "references": [ { "DFCite_id": "DFCite-1169", "relevance_summary_280": "Shows that instructing the LLM to run a deterministic event reconstruction library raised single-event summarization from a mean score of 0.134 to 1.000 versus the LLM alone (Table 1, Section 4.3.3)." } ] }, "DFM-1344": { "id": "DFM-1344", "name": "Do not allow context compression during AI-based investigative sessions", "description": "", "technique": null, "references": [] }, "DFM-1345": { "id": "DFM-1345", "name": "Manually verify a reconstructed event's existence", "description": "", "technique": null, "references": [] }, "DFM-1346": { "id": "DFM-1346", "name": "Manually verify the interpretation of artifacts used for an event reconstruction", "description": "", "technique": "DFT-1202", "references": [] }, "DFM-1347": { "id": "DFM-1347", "name": "Look up in artifact catalogs how the identified artifacts should be interpreted", "description": "", "technique": null, "references": [] }, "DFM-1348": { "id": "DFM-1348", "name": "Manually verify the properties of a reconstructed event", "description": "", "technique": null, "references": [] }, "DFM-1349": { "id": "DFM-1349", "name": "Manually verify the artifacts used for an event reconstruction", "description": "", "technique": "DFT-1202", "references": [] }, "DFM-1350": { "id": "DFM-1350", "name": "Ensure that tools producing data supporting event reconstruction report any potential uncertainty in their results", "description": "", "technique": null, "references": [] }, "DFM-1351": { "id": "DFM-1351", "name": "Ensure that raw data is decoded as the correct data type", "description": "", "technique": null, "references": [] }, "DFM-1352": { "id": "DFM-1352", "name": "Ensure the correct number of bytes are used when decoding raw data into values", "description": "", "technique": null, "references": [] }, "DFM-1353": { "id": "DFM-1353", "name": "Ensure the correct endianness was used when decoding raw data into values", "description": "", "technique": null, "references": [] }, "DFM-1354": { "id": "DFM-1354", "name": "Ensure the correct signed/unsigned property is applied when decoding raw data into values", "description": "", "technique": null, "references": [] }, "DFM-1355": { "id": "DFM-1355", "name": "Ensure the correct endianness was used for value decoding", "description": "", "technique": null, "references": [] }, "DFM-1356": { "id": "DFM-1356", "name": "Ensure that any potential imprecision in decoding is also included when decoded values are presented", "description": "", "technique": null, "references": [] }, "DFM-1363": { "id": "DFM-1363", "name": "Test that examiner-entered metadata is correctly written by the acquisition software along with the forensic container", "description": "", "technique": null, "references": [] }, "DFM-1364": { "id": "DFM-1364", "name": "Test that hashes computed of data stored within a container are written correctly by the acquisition software along with the forensic container", "description": "", "technique": null, "references": [] } }, "objectives": [ { "id": "DFO-1015", "sort_order": 0, "name": "Prepare for a digital investigation", "description": "Conduct activities in preparation of conducting a digital investigation", "techniques": [ "DFT-1110" ], "references": [] }, { "id": "DFO-1014", "sort_order": 1, "name": "Find potential digital evidence sources", "description": "Locate sources of digital evidence that may be relevant to the investigation.", "techniques": [ "DFT-1005", "DFT-1006", "DFT-1009", "DFT-1008", "DFT-1007" ], "references": [] }, { "id": "DFO-1005", "sort_order": 2, "name": "Prioritize digital evidence sources", "description": "Rank the evidence sources based on their relevance and potential value to the investigation.", "techniques": [ "DFT-1001" ], "references": [] }, { "id": "DFO-1010", "sort_order": 3, "name": "Preserve digital evidence", "description": "Ensure the integrity and authenticity of digital evidence is maintained.", "techniques": [ "DFT-1011", "DFT-1010", "DFT-1012", "DFT-1013", "DFT-1114", "DFT-1192" ], "references": [] }, { "id": "DFO-1021", "sort_order": 4, "name": "Access device data for acquisition", "description": "Connect to physical sources of digital evidence to facilitate data extraction", "techniques": [ "DFT-1029", "DFT-1171", "DFT-1113", "DFT-1028", "DFT-1166", "DFT-1112" ], "references": [] }, { "id": "DFO-1016", "sort_order": 5, "name": "Overcome protection mechanisms", "description": "Attempt to gain access to protected data sources or other restricted data.", "techniques": [ "DFT-1039", "DFT-1034", "DFT-1035", "DFT-1033", "DFT-1031", "DFT-1041", "DFT-1038", "DFT-1032", "DFT-1036", "DFT-1037", "DFT-1040", "DFT-1158" ], "references": [] }, { "id": "DFO-1006", "sort_order": 6, "name": "Acquire data", "description": "Collect data from the identified evidence sources.", "techniques": [ "DFT-1163", "DFT-1023", "DFT-1024", "DFT-1104", "DFT-1160", "DFT-1030", "DFT-1002", "DFT-1157", "DFT-1159", "DFT-1016", "DFT-1003", "DFT-1022", "DFT-1017", "DFT-1162", "DFT-1111", "DFT-1018", "DFT-1004", "DFT-1020", "DFT-1175", "DFT-1164", "DFT-1161", "DFT-1198" ], "references": [] }, { "id": "DFO-1022", "sort_order": 7, "name": "Store acquired data", "description": "Store acquired data in one or more formats for subsequent examination and analysis", "techniques": [ "DFT-1025", "DFT-1026", "DFT-1178", "DFT-1208" ], "references": [] }, { "id": "DFO-1018", "sort_order": 8, "name": "Read data from digital evidence storage formats", "description": "Access data within digital evidence containers such as disk images, memory dumps, or archive formats.", "techniques": [ "DFT-1045", "DFT-1042", "DFT-1043", "DFT-1044", "DFT-1102", "DFT-1170", "DFT-1172", "DFT-1173", "DFT-1174", "DFT-1193", "DFT-1199", "DFT-1204" ], "references": [] }, { "id": "DFO-1007", "sort_order": 9, "name": "Reduce data under consideration", "description": "Filter the data to be considered in the investigation for practical, legal, or privacy protection reasons.", "techniques": [ "DFT-1047", "DFT-1048", "DFT-1046" ], "references": [] }, { "id": "DFO-1013", "sort_order": 10, "name": "Access partitions, volumes and file systems data", "description": "Process core data storage structures such as partitions, volumes, and file systems, recovering content and metadata.", "techniques": [ "DFT-1062", "DFT-1061", "DFT-1063", "DFT-1059", "DFT-1060", "DFT-1168" ], "references": [] }, { "id": "DFO-1017", "sort_order": 11, "name": "Extract artifacts stored by the operating system", "description": "Process data stored by the operating system to extract digital forensic artifacts.", "techniques": [ "DFT-1067", "DFT-1065", "DFT-1097", "DFT-1066", "DFT-1068", "DFT-1096", "DFT-1098", "DFT-1083", "DFT-1116", "DFT-1149", "DFT-1180", "DFT-1185", "DFT-1190", "DFT-1197", "DFT-1196" ], "references": [] }, { "id": "DFO-1011", "sort_order": 12, "name": "Extract artifacts stored by applications", "description": "Process data stored by the applications to extract digital forensic artifacts.", "techniques": [ "DFT-1069", "DFT-1073", "DFT-1072", "DFT-1078", "DFT-1070", "DFT-1075", "DFT-1077", "DFT-1074", "DFT-1105", "DFT-1107", "DFT-1108", "DFT-1109", "DFT-1133", "DFT-1179", "DFT-1181", "DFT-1177" ], "references": [] }, { "id": "DFO-1002", "sort_order": 13, "name": "Extract data from specific formats", "description": "Process data to extract artifacts from specific data formats.", "techniques": [ "DFT-1100", "DFT-1187", "DFT-1167", "DFT-1099", "DFT-1071", "DFT-1191", "DFT-1206", "DFT-1205" ], "references": [] }, { "id": "DFO-1023", "sort_order": 14, "name": "Extract specific artifact types", "description": "Process data to extract specific types of artifact", "techniques": [ "DFT-1052", "DFT-1121", "DFT-1169", "DFT-1165", "DFT-1053", "DFT-1056", "DFT-1021", "DFT-1120", "DFT-1076", "DFT-1186" ], "references": [] }, { "id": "DFO-1012", "sort_order": 15, "name": "Locate potentially relevant content", "description": "Attempt to find digital artifacts relevant to the investigation.", "techniques": [ "DFT-1051", "DFT-1050", "DFT-1049", "DFT-1118", "DFT-1086", "DFT-1203" ], "references": [] }, { "id": "DFO-1003", "sort_order": 16, "name": "Review content for relevance", "description": "Review potentially relevant content to determine its significance or meaning.", "techniques": [ "DFT-1054", "DFT-1055", "DFT-1079", "DFT-1080", "DFT-1081", "DFT-1082" ], "references": [] }, { "id": "DFO-1019", "sort_order": 17, "name": "Detect anti-forensics and other anomalies", "description": "Search for indicators of anti-forensic techniques or other anomalies such as malware, which could affect interpretation.", "techniques": [ "DFT-1057", "DFT-1058", "DFT-1128", "DFT-1129", "DFT-1130", "DFT-1131", "DFT-1132" ], "references": [] }, { "id": "DFO-1008", "sort_order": 18, "name": "Establish identities", "description": "Attempt to link data or devices to individuals.", "techniques": [ "DFT-1084", "DFT-1085" ], "references": [] }, { "id": "DFO-1009", "sort_order": 19, "name": "Create visualizations", "description": "Display information using visual representations to assist with analysis.", "techniques": [ "DFT-1103", "DFT-1115" ], "references": [] }, { "id": "DFO-1004", "sort_order": 20, "name": "Conduct research", "description": "Conduct research to gain additional knowledge to support the acquisition, extraction, or interpretation of digital evidence.", "techniques": [ "DFT-1090", "DFT-1095", "DFT-1089", "DFT-1101", "DFT-1119" ], "references": [] }, { "id": "DFO-1001", "sort_order": 21, "name": "Reconstruct events", "description": "Use available digital evidence to formulate and test hypotheses about events.", "techniques": [ "DFT-1087", "DFT-1088", "DFT-1117", "DFT-1154", "DFT-1155", "DFT-1156" ], "references": [] }, { "id": "DFO-1024", "sort_order": 22, "name": "Evaluate evidence", "description": "Evaluate evidence ", "techniques": [ "DFT-1195", "DFT-1200", "DFT-1202" ], "references": [] }, { "id": "DFO-1020", "sort_order": 23, "name": "Document digital forensic activities", "description": "Create documentation about techniques used and findings.", "techniques": [ "DFT-1091", "DFT-1094", "DFT-1092", "DFT-1093", "DFT-1014" ], "references": [] } ] }