W1145: Failure to extract timestamps from a data source
Failure to extract timestamps from a data source
W1111: Incorrect recovery of information regarding a web visit from non-allocated data
Incorrect recovery of information regarding a web visit from non-allocated data
M1160: Testing that picture message sender and recipient extraction are correct
Testing that picture message sender and recipient extraction are correct
W1055: Data not indexed for keyword searching due to missing substring feature
Data not indexed for keyword searching due to missing substring feature
W1199: Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical
Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical
W1247: Attributing saved browser bookmarks to a user but they were bundled with the browser installation
Attributing saved browser bookmarks to a user but they were bundled with the browser installation
M1029: Testing of keyword indexing component of tool
Testing of keyword indexing component of tool
W1054: Data not indexed for keyword searching due to text encoding
Data not indexed for keyword searching due to text encoding
T1099: File repair with grafting
Repair file by grafting different reference data onto fragment(s)
T1013: Use software write blockers to provide read only access to storage media
NIST (2006) NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response, https://doi.org/10.6028/NIST.SP.800-86
Use of a software-based tool that prevents a computer from writing to computer storage media connected to it (NIST 2006)
Use software write blockers to provide read only access to storage media
W1246: Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database
Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database
M1189: Conduct experiments to determine if content from the page in question is cached only when viewed in the browser
Horsman, G., 2018. I didn't see that! An examination of internet browser cache behaviour following website visits. Digital Investigation, 25, pp.105-113.
Conduct experiments to determine if content from the page in question is cached only when viewed in the browser
T1028: Chip-off
M1164: Testing of account details recovery from AI companion app
Testing of account details recovery from AI companion app
W1127: Failure to validate metadata: this could allow details such as acquisition date to be changed
Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
Failure to validate metadata: this could allow details such as acquisition date to be changed
W1112: Failure to recover browser history from non-allocated data
Failure to recover browser history from non-allocated data
W1273: Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device
Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device
M1212: Test the parsing of split forensic images with the maximum number of segments possible
Test the parsing of split forensic images with the maximum number of segments possible
M1114: Clear use of language around mobile file system extractions, making the limitations clear and differentiating from a full disk image
Clear use of language around mobile file system extractions, making the limitations clear and differentiating from a full disk image
W1081: Failing to recover file system metadata
W1158: Use of mobile exploit renders device unusable or 'bricked'
Tyler, J., 2012 p50. XDA Developers' Android Hacker's Toolkit: The Complete Guide to Rooting, ROMs and Theming. John Wiley & Sons
Use of mobile exploit renders device unusable or 'bricked'
T1126: Keyword search (live) (physical)
NIST, 2025. Computer forensics tools & techniques catalog: string search, https://toolcatalog.nist.gov/taxonomy/index.php?ff_id=31
X-Ways (2025), X-Ways Manual: Simultaneous Search (section 5.10), https://www.x-ways.net/winhex/manual.pdf
Searching for keywords over the raw data on a sector by sector basis
M1059: Ongoing research and documentation of syncronisation artefacts
Ongoing research and documentation of syncronisation artefacts
M1159: Testing for deleted picture message recovery from AI companion app
Testing for deleted picture message recovery from AI companion app
W1026: Selective extraction of a backup implies partial collection when it is in reality a full collection followed by deletion.
Selective extraction of a backup implies partial collection when it is in reality a full collection followed by deletion.
T1142: Browser downloads examination
The examination of records of files downloaded with a browser
W1222: Presenting account details that did not exist
Presenting account details that did not exist
T1023: Cloud data collection to access data via a live web page using credentials
Cloud data collection to access data via a live web page using credentials
M1019: Consider if file system acquisition is possible/permitted
Consider if file system acquisition is possible/permitted
W1175: Failure to find internal unattached storage media
Failure to find internal unattached storage media
W1152: Generated report does not include all bookmarks
Generated report does not include all bookmarks
W1263: Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring
Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring
T1071: Database examination
sqlite-forensic-corpus (2018), https://faui1-files.cs.fau.de/public/sqlite-forensic-corpus/
Nemetz, S., Schmitt, S. and Freiling, F., 2018. A standardized corpus for SQLite database forensics. Digital Investigation, 24, pp.S121-S130.
Examination of a database file(s) to extract information from within
W1207: Failure to display a message to or from the AI companion app in the context of other messages
Failure to display a message to or from the AI companion app in the context of other messages
M1187: Ensure browser cache data is also considered
Ensure browser cache data is also considered
M1136: Testing of archive format parsing
M1060: Repair salvaged content by grafting different reference data onto fragment(s)
Repair salvaged content by grafting different reference data onto fragment(s)
W1114: Failure to locate a relevant device at a physical crime scene
Failure to locate a relevant device at a physical crime scene
W1015: Powering on SSD results in sectors being wiped by TRIM operation
DSTL Digital Forensics Bulletin, TRIM & Garbage Collection on SSDs, Edition 27, July 2024 DSTL/PUB160897, https://mailchi.mp/3b5bda81ff5f/digital-forensic-bulletin-edition27-trim-and-garbage-collection-on-ssds9445401
Powering on SSD results in sectors being wiped by TRIM operation
W1053: Incorrect parsing of a supplied regular expression used for keyword searching
Incorrect parsing of a supplied regular expression used for keyword searching
W1078: Presenting a live file as deleted
W1195: Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file
Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file
M1051: Validation of specific file system parsing operation for the file system under consideration
Validation of specific file system parsing operation for the file system under consideration
M1040: Use of AI to flag potentially relevant content to reduce need for manual review
Use of AI to flag potentially relevant content to reduce need for manual review
W1272: Failure to preserve all relevant timestamps of files obtained using exposed services on a device
Failure to preserve all relevant timestamps of files obtained using exposed services on a device
W1235: Failure to extract log entry type
M1123: Apply system-wide record recovery for non-allocated database record data structures
Pereira, M.T., 2009. Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records. Digital Investigation, 5(3-4), pp.93-103.
Apply system-wide record recovery for non-allocated database record data structures
T1004: Selective file acquisition
FTK Imager - allows an AD1 logical container to be created of a selected subset of files within a previewed data source.
Previewing a data source and selecting a subset of the files for extraction into a container such as a tar/zip file or a forensic image format.
M1100: Apply additional resources to brute force attack
Apply additional resources to brute force attack
W1007: Acquistion does not include data in DCO
Gupta, M.R., Hoeschele, M.D. and Rogers, M.K., 2006. Hidden disk areas: HPA and DCO. International Journal of Digital Evidence, 5(1), pp.1-8.
W1197: Data not indexed for keyword searching due to compression
Data not indexed for keyword searching due to compression
W1133: Tool fails to express uncertainty in the classification of file recovery results, e.g., where content may be partly overwritten.
Casey, E., Nelson, A. and Hyde, J., 2019. Standardization of file recovery classification and authentication. Digital Investigation, 31, p.100873.
Tool fails to express uncertainty in the classification of file recovery results, e.g., where content may be partly overwritten.
Reconstruct events
Use available digital evidence to formulate and test hypotheses about events.
W1050: Failure to highlight that there are other apps present for which data is not available
Failure to highlight that there are other apps present for which data is not available
W1038: Backup process returns an incomplete set of backup data
Backup process returns an incomplete set of backup data
W1080: Recovering incorrect metadata about a directory
Recovering incorrect metadata about a directory
M1234: Exploit device to facilitate password/pincode attacks
Exploit device to facilitate password/pincode attacks
M1102: Apply techniques to read remapped sectors
Turner, P. The Remapped/Reallocated Sector Conundrum, Presentation at DFRWS US 2024, https://www.dfrws.org/wp-content/uploads/2023/07/turner-remappedsectors.pdf
Apply techniques to read remapped sectors
M1220: Periodically keep records of time offsets of significant external servers
Periodically keep records of time offsets of significant external servers
M1080: Use a hashset of known files to detect that recovered content does not match the expected file content
Use a hashset of known files to detect that recovered content does not match the expected file content
W1154: Report generated from bookmarks stored in manner that does not prevent tampering or corruption
Report generated from bookmarks stored in manner that does not prevent tampering or corruption
T1018: Remote data collection
T1040: Use mobile device exploit
Grover, J., 2013. Android forensics: Automated data collection and reporting from a mobile device. Digital Investigation, 10, pp.S12-S20.
A process that typically exploits a security flaw in a specific device or operating system to enable users to perform higher privileged functions on a device (derived from Grover 2013)
M1083: Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)
Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)
W1079: Recovering incorrect metadata about a file
Recovering incorrect metadata about a file
M1070: Ensure hash algorithm(s) used are resistant to collisions through data manipulation
Ensure hash algorithm(s) used are resistant to collisions through data manipulation
W1224: Presenting a deleted account as live, or vice versa
Presenting a deleted account as live, or vice versa
M1181: Testing logfile parsing capability
M1092: Optimise dictionary
Kanta, A., Coisel, I. and Scanlon, M., 2023. Harder, better, faster, stronger: Optimising the performance of context-based password cracking dictionaries. Forensic Science International: Digital Investigation, 44, p.301507.
W1138: Failing to identify password in the time available
Failing to identify password in the time available
M1096: Apply additional resources to dictionary attack
Apply additional resources to dictionary attack
W1209: Failure to recover deleted but recoverable images sent to or from the AI companion app
Failure to recover deleted but recoverable images sent to or from the AI companion app
M1054: Testing of message extraction and parsing features
Testing of message extraction and parsing features
W1233: Failure to communicate imprecision in log entry timestamp
Failure to communicate imprecision in log entry timestamp
W1027: Including data that was meant to be excluded with the selected filters
Including data that was meant to be excluded with the selected filters
M1027: Dual tool verification
M1162: Testing of deleted call record recovery from AI companion app
Testing of deleted call record recovery from AI companion app
T1115: Visualisation of geolocation information
Autopsy Geolocation view (Basis Technology 2020)
Magnet Axiom 'World map view' (Magnet 2020)
Magnet 2020, Using the Geolocation Data Filter in Magnet AXIOM & AXIOM Cyber, https://www.magnetforensics.com/blog/using-the-geolocation-data-filter-in-magnet-axiom-axiom-cyber/
Magnet 2024, Moving in the right direction with Animated maps, https://www.magnetforensics.com/blog/moving-in-the-right-direction-with-animated-maps/
Basis Technology 2020, Autopsy User Documentation: Geolocation Overview, https://sleuthkit.org/autopsy/docs/user-docs/4.13.0/geolocation_page.html
Presenting points or paths visually using extracted data, typically on a map
Visualisation of geolocation information
W1090: Recovering a live message with incorrect metadata
Time is not on our side when it comes to Messages in iOS 11, https://smarterforensics.com/2017/09/time-is-not-on-our-side-when-it-comes-to-messages-in-ios-11/
Recovering a live message with incorrect metadata
M1207: Ensure training is in place for tool operators to separate fact from interpretation within the tool used
ISO 21043-5:2025 - Forensic sciences — Part 5: Reporting
International Organization for Standardization (ISO) (2015) ISO/IEC 27042:2015 Guidelines for the analysis and interpretation of digital evidence.
Ensure training is in place for tool operators to separate fact from interpretation within the tool used
W1063: Incorrectly parsing the partitions table(s)
Incorrectly parsing the partitions table(s)
M1127: Use a similar system to test steps required to interrupt the normal boot process and boot from Trusted Bootable Environment
Use a similar system to test steps required to interrupt the normal boot process and boot from Trusted Bootable Environment
T1151: Keyword search (over extracted artifacts)
Using Keywords with Magnet AXIOM (McQuaid 2017)
McQuaid, J. (2017) Using Keywords with Magnet AXIOM, Magnet Forensics, https://www.magnetforensics.com/blog/using-keywords-with-magnet-axiom/
Keyword searching only applied over extracted artifacts
This limited scope search may be performed within tools themselves e.g. McQuaid (2017), or within an exported packaged report.
Keyword search (over extracted artifacts)
W1268: Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used
Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used
W1070: Failing to recover the complete contents of a live file
Failing to recover the complete contents of a live file
M1157: Ensure messages are viewed in the context of the message thread
Ensure messages are viewed in the context of the message thread
T1062: Decryption of encrypted file systems/volumes
The process of decrypting an encrypted file system/volume to make its contents accessible for analysis.
The output of this process will vary depending on the encryption implementation in place. If encryption is at the sector level then it would result in a decrypted forensic image, but if it uses file-based encryption then the process would result in an equivalent volume but with the file content/metadata decrypted.
Decryption of encrypted file systems/volumes
W1231: Interpreting log entry absence as evidence of deletion rather than logging configuration
Interpreting log entry absence as evidence of deletion rather than logging configuration
M1068: Use digital sniffer dogs to assist in locating evidence
Petersen, S.J. and Schoon, A., 2022. Dogs as Detectors for Hidden Digital Storage Devices: A Pilot Study from the National Police of The Netherlands. In Canines (pp. 535-557). Jenny Stanford Publishing.
Use digital sniffer dogs to assist in locating evidence
T1102: Decode data from image from unmanaged NAND
Decode data from image from unmanaged NAND
W1202: Failure to recover deleted but recoverable messages to or from the AI companion app
Failure to recover deleted but recoverable messages to or from the AI companion app
M1145: Apply OCR to files and search or index resulting text
Apply OCR to files and search or index resulting text
M1009: Check hash of image matches hash of source material
Check hash of image matches hash of source material
T1019: Mobile backup extraction
Use of ADB to generate an Android backup
Using the backup capability of a device to extract a subset of its contents
W1066: Missing deleted but recoverable partitions from unpartitioned space
Hargreaves, C., Repository for 'An abstract model for digital forensic analysis tools - A foundation for systematic error mitigation analysis', https://github.com/chrishargreaves/digital-forensic-tool-abstractions/tree/main
Missing deleted but recoverable partitions from unpartitioned space
W1258: Failure to present uncertainty associated with automated interpretation of data into artifacts
Failure to present uncertainty associated with automated interpretation of data into artifacts
M1229: Determine last timezone used on system
W1059: Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical
Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical
M1041: Regular breaks to minimise investigator fatigue
Regular breaks to minimise investigator fatigue
M1095: Order dictionary to test the most likely candidates first
Order dictionary to test the most likely candidates first
T1006: Digital sniffer dogs
The use of canines to locate obscured digital storage devices.
W1084: Failure to correctly recover specialised file system specific content e.g. Alternate Data Streams
Failure to correctly recover specialised file system specific content e.g. Alternate Data Streams
M1085: Use of multiple tools to verify disk image hash
Use of multiple tools to verify disk image hash
W1208: Failure to recover live images sent to or from the AI companion app
Failure to recover live images sent to or from the AI companion app
T1025: Writing data to a forensic image format
2009 M57-Jean - Data is supplied as a ‘multi-volume Expert Witness file’ - i.e. split EnCase E01 & E02 image files (https://digitalcorpora.org/corpora/scenarios/m57-jean/)
FTK Imager: This tool can be used to acquire data from block devices in various image formats including RAW, EWF, and AFF
Magnet Acquire: This tool can be used to acquire data from block devices in various image formats including RAW and EWF.
libewf: This open source library allows access to the EWF format. The accompanying ewftools proves tools to verify, inspect and create EWF images.
Storage of data recovered from a digital device in various formats which might include bitstream data or a logical set of files
Bitstream data that would result from disk imaging would be stored in formats such as: RAW, EWF, AFF4. For sets of files that are extracted there are proprietary logical formats from tool vendors. The imaged data may be split into several linked container formats. e.g. e01, e02 e03 etc.
M1101: Apply time offset to timestamp
W1124: Failure to compute hash correctly: this could result in a message indicating corrupt evidence, thus stopping or delaying further investigation
Failure to compute hash correctly: this could result in a message indicating corrupt evidence, thus stopping or delaying further investigation
W1134: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected
Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected
W1061: An irrelevant piece of media was flagged as relevant
An irrelevant piece of media was flagged as relevant
Read data from digital evidence storage formats
Access data within digital evidence containers such as disk images, memory dumps, or archive formats.
W1248: Missing browser downloads as the files were saved to a non-standard location
Missing browser downloads as the files were saved to a non-standard location
W1098: Assigning incorrect metadata to a message attachment
Assigning incorrect metadata to a message attachment
M1180: Testing correct extraction of logfile entry timestamps
Testing correct extraction of logfile entry timestamps
M1008: Use software write blocker
M1223: Apply time zone based offsets only to UTC stored timestamps
Apply time zone based offsets only to UTC stored timestamps
M1134: Testing that connected devices are detected.
Testing that connected devices are detected.
M1236: Attempt to obtain password/pincode with dictionary attacks
Attempt to obtain password/pincode with dictionary attacks
T1119: Automatically scan for artifact changes caused by app updates
Discussed in 'Puma: Automatically generating digital forensic reference data triggered by mobile application updates' (Claij-Swart et al. 2025)
Claij-Swart, A.A., Oudsen, E., Timbermont, B., Hargreaves, C. and Voigt, L.L., 2025. Automatically generating digital forensic reference data triggered by mobile application updates. Forensic Science International: Digital Investigation, 54, p.301985.
Claij-Swart et al. (2025), PUMA (Programmable Utility for Mobile Automation), https://github.com/NetherlandsForensicInstitute/puma
Monitor every version change of an application to determine if there are changes to the way the app stores data
Automatically scan for artifact changes caused by app updates
T1131: Search for indicators of trail obfuscation
Kessler, G.C., 2007. Anti-forensics and the digital investigator.
Searching for the presence of current or historical trail obfuscation on a system
Search for indicators of trail obfuscation
T1096: Run programs identification (OS)
The process of examining operating system files to extract artifacts that may indicate a program has been run.
While this technique may result in executable or script paths and timestamps, to evaluate a hypothesis that a program was run requires use of T1155 to evaluate if this occurred, and optionally T1117 if the time of access is relevant.
T1037: Obtain password from the device owner
T1055: File system content inspection
W1174: Failure to find internal attached storage media
Failure to find internal attached storage media
M1075: Testing programme to validate hashes of data in images is calculated correctly
Testing programme to validate hashes of data in images is calculated correctly
T1036: Smudge attack
W1267: Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source
Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source
Extract artifacts, or content of specific types
Process data to extract artifacts or stored content of specific types.
M1037: The context of relevant keyword results are manually checked
The context of relevant keyword results are manually checked
M1063: Verify semantic integrity of carved content using an automated tool
Verify semantic integrity of carved content using an automated tool
W1039: Backup data collection overwrites important data
Backup data collection overwrites important data
W1014: Imaging process changes original data
W1178: Inability to load the forensic bootable environment due to system configuration
Inability to load the forensic bootable environment due to system configuration
W1056: Data not indexed for keyword searching due to case sensitivity problem
Data not indexed for keyword searching due to case sensitivity problem
M1104: Testing of report generation functionality that all intended bookmarks are included
Testing of report generation functionality that all intended bookmarks are included
W1011: Suggesting the existence of a device that does not exist
Suggesting the existence of a device that does not exist
W1083: Failure to recover additional specialised file system specific content e.g. Alternate Data Streams
Failure to recover additional specialised file system specific content e.g. Alternate Data Streams
M1158: Testing for live picture message recovery from AI companion app
Testing for live picture message recovery from AI companion app
M1105: Manual verification that all intended bookmarks are included in the generated report.
Manual verification that all intended bookmarks are included in the generated report.
T1112: Physical disk identification and removal
Identifying physical storage media within devices and removing them
Physical disk identification and removal
W1179: Failure to detect internal disk from bootable environment
Failure to detect internal disk from bootable environment
T1081: Image content analysis
W1162: Changing relevant files during file system acquisition
Changing relevant files during file system acquisition
M1233: Test data extraction methods against reference data with known timestamps
Test data extraction methods against reference data with known timestamps
M1227: Search for indicators of clock tampering
Search for indicators of clock tampering
T1110: Preserving reference data
Spichiger, H. and Adelstein, F., 2025. Preserving meaning of evidence from evolving systems. Forensic Science International: Digital Investigation, 52, p.301867.
Reference data may be needed for later trace interpretation, but may change (especially server side software), so relevant data should be preserved close to the time of the event of interest
M1141: Careful review of case brief for case-specific keyword list generation
Careful review of case brief for case-specific keyword list generation
M1154: Testing for live message recovery from AI companion app
Testing for live message recovery from AI companion app
T1060: Enumerate allocated files and folders
The Sleuth Kit - allows parsing of file system structures
X-Ways Forensics - allows parsing of file system structures
Carrier, B., 2005. File system forensic analysis. Addison-Wesley Professional.
This involves parsing the live file system data structures and reconstructing the file system of the target media or device.
T1039: App downgrade
Downgrading an app to a version in which data is available e.g. via a backup method
W1164: Files are still encrypted using file-based encryption so inaccessible
Files are still encrypted using file-based encryption so inaccessible
M1146: Ensure keyword indexing settings capture text encodings required during indexing
Ensure keyword indexing settings capture text encodings required during indexing
Find potential digital evidence sources
Locate sources of digital evidence that may be relevant to the investigation.
W1141: Failing to determine password via brute force in the time available
Failing to determine password via brute force in the time available
M1033: Prioritization of search results based on context
Beebe, N.L. and Liu, L., 2014. Ranking algorithms for digital forensic string search hits. Digital Investigation, 11, pp.S124-S132.
Prioritization of search results based on context
M1112: Use of AI to classify files in addition to standard programmatic methods
Alam, S. and Demir, A.K., 2024. SIFT: Sifting file types—application of explainable artificial intelligence in cyber forensics. Cybersecurity, 7(1), p.52.
Karampidis, K. and Papadourakis, G., 2017. File type identification-computational intelligence for digital forensics. Journal of Digital Forensics, Security and Law, 12(2), p.6.
Use of AI to classify files in addition to standard programmatic methods
M1006: Testing to ensure software and hardware setup detects DCOs
Testing to ensure software and hardware setup detects DCOs
M1053: Verification of the file system specification used as the basis for the tool development
Verification of the file system specification used as the basis for the tool development
W1016: Data copied from sectors on source device are stored incorrectly
Data copied from sectors on source device are stored incorrectly
W1168: Data extracted from a table is assigned an incorrect interpretation
Data extracted from a table is assigned an incorrect interpretation
W1069: Failing to identify the existence of a live directory
Failing to identify the existence of a live directory
M1148: Ensure keyword indexing settings configure case sensitivity for indexing as required
Ensure keyword indexing settings configure case sensitivity for indexing as required
T1031: Key recovery from memory
Bulk Extractor - of the many scanners within bulk extractor, one of which attempts to locate AES keys.
Volatility - the plug in ‘trucryptmaster’ attempts to recover Truecrypt 7.1a master keys.
Hargreaves, C. and Chivers, H., 2008, March. Recovery of encryption keys from memory using a linear scan. In 2008 Third International Conference on Availability, Reliability and Security (pp. 1369-1376). IEEE.
Hargreaves & Chivers 2008b. Avoiding Live Imaging of Large Encrypted Volumes by Recovering Keys from Memory, Proceedings from 3rd Advances in Computer Security and Forensics
Halderman, J.A., Schoen, S.D., Heninger, N., Clarkson, W., Paul, W., Calandrino, J.A., Feldman, A.J., Appelbaum, J. and Felten, E.W., 2009. Lest we remember: cold-boot attacks on encryption keys. Communications of the ACM, 52(5), pp.91-98.
This describes the technique whereby an attempt is made to extract key material from memory, or a memory acquisition of a running system to fascinate the decryption of some data
W1264: Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp
Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp
T1014: Chain of custody documentation
T1106: Deep fake detection (video)
W1088: Presenting a deleted message that did not exist
Presenting a deleted message that did not exist
W1271: Inability to access required service as it is not enabled
Belkasoft (undated) Dealing with Apple's USB Restricted Mode, https://belkasoft.com/dealing_with_usb_restricted_mode
Android (2025), How to Enable Android Developer Settings: Unlock your Device’s Hidden Potential, https://www.android.com/intl/en_uk/articles/enable-android-developer-settings/
Inability to access required service as it is not enabled
T1041: Pin2Pwn
W1252: Assuming that data stored in the cache was viewed by the user
Assuming that data stored in the cache was viewed by the user
W1215: Failure to recover deleted but recoverable records of calls to or from the AI companion app
Failure to recover deleted but recoverable records of calls to or from the AI companion app
W1117: Calls, messages or other data was received and overwrote relevant data because faraday environment was insufficient.
Calls, messages or other data was received and overwrote relevant data because faraday environment was insufficient.
M1093: Use mangling rules to generate variants of candidate passwords
Use mangling rules to generate variants of candidate passwords
T1069: Browser examination
Digital Detective Knowledgebase https://kb.digital-detective.net/display/BF
Oh, J., Lee, S. and Lee, S., 2011. Advanced evidence collection and analysis of web browser activity. Digital investigation, 8, pp.S62-S70.
Recovery of information left from web browsing activity (derived from Oh et al (2011))
This may involve: history, cached items, bookmarks, cookies, saved passwords, form data.
M1153: Index data in the case and perform iterative keyword searching using the index
Index data in the case and perform iterative keyword searching using the index
W1216: Presenting a call to or from the AI companion app that did not exist
Presenting a call to or from the AI companion app that did not exist
T1053: Entity extraction
T1144: Browser profile enumeration
The enumeration of the separate user profiles set up within a browser
W1102: Failure to display that a message had a previous state
Failure to display that a message had a previous state
W1176: Unable to physically remove/detach internal storage media
Interpol (2021), Guidelines for digital forensics first responders v7, Ch5 Specific Procedures p34, https://www.interpol.int/content/download/16243/file/Guidelines_to_Digital_Forensics_First_Responders_V7.pdf
Unable to physically remove/detach internal storage media
M1149: Ensure keyword indexing settings mean that decompression will be applied as required during indexing
Ensure keyword indexing settings mean that decompression will be applied as required during indexing
W1177: Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence
Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence
T1017: Network packet capture
M1036: Testing of regular expression component of tool
Testing of regular expression component of tool
M1066: Attempt to reconstruct browser activity from other areas of disk
Chivers, H., 2014. Private browsing: A window of forensic opportunity. Digital Investigation, 11(1), pp.20-29.
Attempt to reconstruct browser activity from other areas of disk
M1113: Use mobile exploit to gain privileged access
Use mobile exploit to gain privileged access
T1080: Video content analysis
M1004: Check hash of image matches hash of source device
Check hash of image matches hash of source device
M1072: Regular checks for hardware write blocker firmware updates.
Regular checks for hardware write blocker firmware updates.
W1146: Failure to consider non-timestamp based timing information
Dreier, L.M., Vanini, C., Hargreaves, C.J., Breitinger, F. and Freiling, F., 2024. Beyond timestamps: Integrating implicit timing information into digital forensic timelines. Forensic Science International: Digital Investigation, 49, p.301755.
Failure to consider non-timestamp based timing information
M1082: Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file
Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file
T1148: Browser web storage examination
Mendoza, A., Kumar, A., Midcap, D., Cho, H. and Varol, C., 2015. BrowStEx: A tool to aggregate browser storage artifacts for forensic analysis. Digital investigation, 14, pp.63-75.
Web storage is a browser-based API bundled in HTML5 specifications that allow persistent client-side storage for web applications. (Mendoza 2015)
T1095: Instrumentation
M1058: Checking for other confirmatory indicators of the inferred device's existence.
Checking for other confirmatory indicators of the inferred device's existence.
M1115: Attempt to brute force user PIN (potentially on device)
Attempt to brute force user PIN (potentially on device)
Extract artifacts stored by the operating system
Process data stored by the operating system to extract digital forensic artifacts.
T1068: Recently used file identification (OS)
The process of examining operating system files to extract artifacts that may indicate file accesses.
While this technique may result in file paths and timestamps, to evaluate a hypothesis that a file was accessed requires use of T1155 to evaluate if this access occurred, and optionally T1117 if the time of access is relevant.
M1055: Correlation of data extracted with data from service provider
Correlation of data extracted with data from service provider
W1226: Failure to recover relevant AI bot settings
Failure to recover relevant AI bot settings
M1005: Testing to ensure software and hardware setup detects HPAs
Testing to ensure software and hardware setup detects HPAs
M1156: Testing that message sender and recipient extraction are correct
Testing that message sender and recipient extraction are correct
W1043: Data is written to forensic format that does not preserve the original raw data
Data is written to forensic format that does not preserve the original raw data
T1049: Keyword searching
Beebe, N.L. and Clark, J.G., 2007. Digital forensic text string searching: Improving information retrieval effectiveness by thematically clustering search results. Digital investigation, 4, pp.49-54.
This technique involves searching data in the case for specific strings
This search may be conducted live, directly over the data, or from a generated index of strings extracted from the data. The words searched for may be either case-specific, or sometimes case-type specific.
W1153: Report generated from bookmarks does not render all content (e.g. previews, string extracts) correctly
Report generated from bookmarks does not render all content (e.g. previews, string extracts) correctly
M1088: If applicable, leverage hardware virtualization utilities to add a hypervisor to the system, i.e., virtualize the original system. This allows to either freeze the system before the acquisition or, if the system should not be completely frozen, to copy pages before they are modified.
Martignoni, L., Fattori, A., Paleari, R. and Cavallaro, L., 2010. Live and trustworthy forensic analysis of commodity production systems. In International Workshop on Recent Advances in Intrusion Detection (pp. 297-316). Berlin, Heidelberg: Springer Berlin Heidelberg.
Case, A. and Richard III, G. G., 2017. Memory forensics: The path forward. Digital investigation, 20, 23-33.
If applicable, leverage hardware virtualization utilities to add a hypervisor to the system, i.e., virtualize the original system. This allows to either freeze the system before the acquisition or, if the system should not be completely frozen, to copy pages before they are modified.
T1100: EXIF data extraction
T1043: Decode forensic image format
Cohen, M., Garfinkel, S. and Schatz, B., 2009. Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow. digital investigation, 6, pp.S57-S68.
Im, S., Park, H., Joun, J., Lee, S. and Park, J., 2024. Revisiting logical image formats for future digital forensics: A comprehensive analysis on L01 and AFF4-L. Forensic Science International: Digital Investigation, 50
The decoding of a forensic format such as EWF such that the raw sectors can be accessed by a forensic tool (typically performed on-the-fly internally in a tool.)
For example a EWF (Expert Witness Format) needs to be processed to expose the equivalent RAW image sectors. Therefore both the input and output types here are [https://ontology.unifiedcyberontology.org/uco/observable/Image]. This technique would not need to be used when working with a RAW image format directly. This also includes decoding logical formats such as L01, AD1, CTR, or AFF4-L. The output here is not an image file but rather a set of files and their metadata
T1030: Data read from unmanaged NAND
W1110: Failure to recover browser history from live data
Failure to recover browser history from live data
W1166: Consideration of live database content only
Consideration of live database content only
M1098: Optimise the brute force search space
W1191: Missing changes in app artifacts during research since app interaction is needed to cause changes
Missing changes in app artifacts during research since app interaction is needed to cause changes
W1122: Image format parsing presents incorrect data within sectors of the image
Image format parsing presents incorrect data within sectors of the image
M1016: Alert user that the data collected is a partial set of data stored on the device
Alert user that the data collected is a partial set of data stored on the device
W1188: Failure to match file name/path pattern due to implementation error in matching engine.
Failure to match file name/path pattern due to implementation error in matching engine.
M1222: Testing to ensure that tooling is able to extract local/external timestamp pairs (time anchors)
Testing to ensure that tooling is able to extract local/external timestamp pairs (time anchors)
W1254: Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information
Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information
W1109: Incorrect recovery of information regarding a web visit from allocated data
Incorrect recovery of information regarding a web visit from allocated data
M1205: Use wordlist generator with case data
Magnet Forensics (2019) Magnet Axiom Wordlist Generator. Magnet Forensics. Available at: https://www.magnetforensics.com/resources/magnet-axiom-wordlist-generator/
Magnet Forensics (2019) Utilizing AXIOM Wordlist Generator to Optimize Handset Lock Code Breaking, Magnet Forensics, Available at: https://www.magnetforensics.com/blog/utilizing-axiom-wordlist-generator-to-optimize-handset-lock-code-breaking/
W1156: Bookmark added by examiner is is recorded with incorrect tag/label/category
Bookmark added by examiner is is recorded with incorrect tag/label/category
T1038: Rainbow table-based password attack
T1114: Memory Acquisition via Cold Boot Attack
Extracting RAM data using Cold Boot Attack
Extracting volatile memory (RAM) from a powered-off system by quickly rebooting or transferring the memory module to another system before residual data fades. Cooling the memory modules can significantly slow down data decay, preserving critical data such as encryption keys or passwords.
An examiner freezes a computer’s RAM by spraying it with liquid nitrogen or even using inverted canned air, then powering off the live system without proper shutdown, and then booting into an external plugged USB, and try capturing the residual RAM content with encryption keys that might still be stored there
M1074: Validate image hash against one stored externally to the image in a trusted location.
Validate image hash against one stored externally to the image in a trusted location.
M1197: Check if file being recovered is resident (applicable on some file systems)
Check if file being recovered is resident (applicable on some file systems)
M1239: Obtain possible passwords/PIN codes from other devices with limited security
Obtain possible passwords/PIN codes from other devices with limited security
T1027: Data read using JTAG
M1196: Check if file being recovered is smaller than a block
Check if file being recovered is smaller than a block
T1154: Identity-based event reconstruction
Casey, E. and Jaquet-Chiffelle, D.O., 2019. Do identities matter?. Policing: A Journal of Policy and Practice, 13(1), pp.21-34.
Spichiger, H., 2025. Please mind the gap: A taxonomy for addressing the issue of linking person, account and device. Science & Justice, p.101314.
The process of attempting to link an identity (account, person etc.) to a reconstructed event
W1194: Keyword results missed since relevant keyword is inside compressed or encoded data
Keyword results missed since relevant keyword is inside compressed or encoded data
M1224: Check for location artifacts to infer the time zone at a specific moment
Check for location artifacts to infer the time zone at a specific moment
M1124: Examine database contents with and without Write Ahead Log (WAL) files applied
Caithness 2012, The Forensic Implications of SQLite’s Write Ahead Log, https://digitalinvestigation.wordpress.com/2012/05/04/the-forensic-implications-of-sqlites-write-ahead-log/
Caithness 2024, Time travelling with SQLite Journals and WAL, https://www.cclsolutionsgroup.com/post/time-travelling-with-sqlite-journals-and-wal
Examine database contents with and without Write Ahead Log (WAL) files applied
W1076: Presenting a directory that does not exist
Presenting a directory that does not exist
W1266: Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings
Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings
M1047: Testing partition table parsing on standard and non-standard configurations
Testing partition table parsing on standard and non-standard configurations
W1046: File not recovered from the stored backup
File not recovered from the stored backup
W1206: Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app
Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app
W1123: Image format parsing presents incorrect forensic image metadata
Image format parsing presents incorrect forensic image metadata
M1138: Testing file name/path pattern matching engine
Testing file name/path pattern matching engine
W1064: Making incorrect assumptions about sector size e.g. 512 rather than 4096
V, Kethareswaran; Khurana, Surinder Singh; Singh, Parvinder (2021), “File Carving based Digital Forensic Tools Testing Data Sets (Contiguous Files)”, Mendeley Data, V3, doi: 10.17632/2kh2bdsp5b.3
Making incorrect assumptions about sector size e.g. 512 rather than 4096
T1020: Mobile file system extraction
Cellebrite (undated), Full File System Extraction - Mobile Device Forensics, https://cellebrite.com/en/glossary/full-file-system-extraction-mobile-device-forensics/
Fukami, A., Stoykova, R. and Geradts, Z., 2021. A new model for forensic data extraction from encrypted mobile devices. Forensic Science International: Digital Investigation, 38, p.301169.
Magnet (2024) Revealing hidden data: Full file system extractions uncovered, https://www.magnetforensics.com/blog/revealing-hidden-data-full-file-system-extractions-uncovered/
Accessing the file system(s) of the device and extracting a set of files (full or partial depending on level of access)
Note that Fukami et al (2021) states "In order to conduct effective file system extraction, rooting the device is required." See T1040. Usually results in a zip/tar file. Rooting may provide access to the file system, but files may still be encrypted. Attacking the user pin, usually on device, using T1034, or T1035 may be necessary, unless the PIN can be obtained from the device user (T1037)
M1024: Validate extracted key against the encrypted material before powering off the machine from which the key was extracted (e.g. Hargreaves & Chivers 2008b)
Validate extracted key against the encrypted material before powering off the machine from which the key was extracted (e.g. Hargreaves & Chivers 2008b)
M1169: Testing of app settings recovery from AI companion app
Testing of app settings recovery from AI companion app
W1096: Failing to recover attachments for a live message
Failing to recover attachments for a live message
M1002: Testing of the faraday environment to be used
Lennox-Steele, A., & Nisbet, A. (2016). A forensic examination of several mobile device Faraday bags & materials to test their effectiveness. In Valli, C. (Ed.). (2016). The Proceedings of 14th Australian Digital Forensics Conference, 5-6 December 2016, Edith Cowan University, Perth, Australia. (pp 34-41).
Testing of the faraday environment to be used
W1108: Failure to recover history resulting from private browsing
Horsman, G., 2020. The challenge of identifying historic ‘private browsing’sessions on suspect devices. Forensic Science International: Digital Investigation, 34, p.300980.
Failure to recover history resulting from private browsing
T1077: Photos app examination
W1227: Associating a configured bot with the wrong account
Associating a configured bot with the wrong account
W1260: Failure to derive clock offset due to inability to locate a suitable time anchor
Failure to derive clock offset due to inability to locate a suitable time anchor
M1028: Parse app lists if available and highlight missing data
Parse app lists if available and highlight missing data
W1236: Incorrectly interpreting a log entry type based on a different version of the generating software or operating system
Incorrectly interpreting a log entry type based on a different version of the generating software or operating system
W1186: Missing files with file name/path-based pattern matching due to renaming
Missing files with file name/path-based pattern matching due to renaming
M1163: Testing that call record caller and recipient extraction are correct
Testing that call record caller and recipient extraction are correct
W1142: System locks after X failed brute force attempts
System locks after X failed brute force attempts
M1193: Obtain older versions of browser history files from backups or from file system versioning features
Obtain older versions of browser history files from backups or from file system versioning features
W1068: Failing to identify the existence of a live file
Failing to identify the existence of a live file
M1038: Word list selected such that a practically reviewable number of results are returned
Word list selected such that a practically reviewable number of results are returned
T1093: Write expert report
T1079: Audio content analysis
W1147: Failure to normalise timestamps correctly during timeline generation
Failure to normalise timestamps correctly during timeline generation
T1008: Profiling network traffic
Extract artifacts stored by applications
Process data stored by the applications to extract digital forensic artifacts.
M1012: Clear presentation of the backup and deletion process
Clear presentation of the backup and deletion process
T1118: Locate relevant files by path
Pattern matching in ALEAPP/iLEAPP to trigger specific plugins
Autopsy Interesting File module, https://sleuthkit.org/autopsy/docs/user-docs/3.1/interesting_page.html
Use the path of file name to determine potential relevance of artefact
T1003: Memory imaging
Latzo, T., Palutke, R. and Freiling, F., 2019. A universal taxonomy and survey of forensic memory acquisition techniques. Digital Investigation, 28, 56-69.
Kornblum, J.D., 2007. Using every part of the buffalo in Windows memory analysis. Digital Investigation, 4(1), pp.24-29.
Involves creating a copy of the live memory data of a running system
Collection of Pagefile may also be useful (Kornblum 2007).
Establish identities
Attempt to link data or devices to individuals.
M1023: Ensure and check logs of access to stored disk images
Ensure and check logs of access to stored disk images
W1220: Presenting an incorrect timestamp associated with an interaction with the AI companion app
Presenting an incorrect timestamp associated with an interaction with the AI companion app
M1219: Manual verification of timestamp decoding within a time anchor
Manual verification of timestamp decoding within a time anchor
M1067: Analyze web browser memory for web browsing activity
Analyze web browser memory for web browsing activity
W1189: Artifact extraction is incomplete due to app version changes.
Artifact extraction is incomplete due to app version changes.
W1270: Inability to create a device backup due to locked device
Inability to create a device backup due to locked device
M1111: Use of multiple tools to classify file types
Use of multiple tools to classify file types
W1021: Metadata of data collected is missing
W1074: Attributing a file to the wrong directory
Attributing a file to the wrong directory
W1073: Recovering an incorrect listing of a live directory
Recovering an incorrect listing of a live directory
M1225: Estimate clock offset at a specific point in time using time anchoring
C. Vanini, C. Hargreaves, H. van Beek, F. Breitinger, 2024, Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction, Forensic Science International: Digital Investigation, 10.1016/j.fsidi.2024.301759
Estimate clock offset at a specific point in time using time anchoring
T1088: Relational-based event reconstruction
Casey, E., 2011. Digital evidence and computer crime: Forensic science, computers, and the internet. Academic press, Section 8.1.3
The process of determining the existence and nature of relationships between entities during event reconstruction
M1097: Attempt to obtain password/passcode from the device owner
Attempt to obtain password/passcode from the device owner
M1167: Check time of account access is prior to device seizure time
Check time of account access is prior to device seizure time
T1022: Mobile device screenshot based capture
An examiner directly manipulates the target mobile device using the device's input interface (i.e., keypads and buttons), and records the content shown on the display of the device. (Fukami et al 2021)
W1149: Failure to consider timestamp inaccuracy at time of inferred event
Failure to consider timestamp inaccuracy at time of inferred event
T1044: Mobile backup decoding
T1029: Access data from a desoldered eMMC via a chip reader
Access data from a desoldered eMMC via a chip reader
W1229: Log entry missing due to being stored in archived copies of logs
Log entry missing due to being stored in archived copies of logs
W1010: Misattributing activity to the wrong device
Misattributing activity to the wrong device
M1031: Also using synonyms for terms used
W1128: Image replaced with tampered version along with updated stored hash
Kemmerich, T., Junge, F., Kuntze, N., Rudolph, C., Endicott-Popovsky, B. and Großkopf, L., 2014. Generation and handling of hard drive duplicates as piece of evidence.
Image replaced with tampered version along with updated stored hash
T1097: Installed programs identification (OS)
Extraction and analysis of information that allows programs installed on an OS to be identified.
W1148: Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock
Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock
T1092: Produce tag-based automated report
Basis Technology 2019, Tagging, https://sleuthkit.org/autopsy/docs/user-docs/4.12.0/tagging_page.html
Basis Technology 2019, Reporting, https://sleuthkit.org/autopsy/docs/user-docs/4.12.0/reporting_page.html
Generate a report in PDF, HTML or other format that compiles tagged (or bookmarked) items from a case into a package that can be reviewed.
W1005: Dogs fail to find a digital device
M1011: Perform full extraction instead of selective, followed by partial processing
Perform full extraction instead of selective, followed by partial processing
T1033: Extraction of credential from an accessible device
Accessing a device with limited or no security to obtain a credential (e.g. password, PIN, token) that can be used to access another device or service.
Extraction of credential from an accessible device
M1022: Restrict access to stored disk images
M1046: Check pointer offsets for both 512 and 4096 sectors sizes
Check pointer offsets for both 512 and 4096 sectors sizes
M1021: Verify the disk image integrity with multiple hash algorithms e.g. MD5 and SHA1 (Kessler 2016)
Verify the disk image integrity with multiple hash algorithms e.g. MD5 and SHA1 (Kessler 2016)
T1073: Calendar app examination
M1199: Check all relevant file size metadata values when recovering file content
Check all relevant file size metadata values when recovering file content
W1212: Presenting an image sent to the AI chat app as from the AI companion app, or vice versa
Presenting an image sent to the AI chat app as from the AI companion app, or vice versa
M1069: Use a SyncTriage style approach to determine existence other synchronized devices
Hargreaves, C. and Marshall, A., 2019. SyncTriage: Using synchronisation artefacts to optimise acquisition order. Digital Investigation, 28, pp.S134-S140.
Use a SyncTriage style approach to determine existence other synchronized devices
M1172: Also examine any older versions of the logs from backups
Also examine any older versions of the logs from backups
T1108: Reminders app examination
M1076: Testing programme to validate hashes of metadata in images is calculated correctly
Testing programme to validate hashes of metadata in images is calculated correctly
T1116: Determine connected devices
ALEAPP abd_hots.py, https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/adb_hosts.py
Examine artifacts and extract indicators of devices that have been connected to the target device.
T1083: Memory examination (OS-level)
W1041: Not considering file system acquisition as alternative
Not considering file system acquisition as alternative
Review content for relevance
Review potentially relevant content to determine its significance or meaning.
W1093: Presenting a deleted message as live
W1012: Interaction with the target devices to read synronisation artefacts causes changes
Interaction with the target devices to read synronisation artefacts causes changes
W1198: Data not indexed for keyword searching due to file or content encoding
Data not indexed for keyword searching due to file or content encoding
T1078: Cloud sync app examination
M1192: Examine browser configuration to determine history retention settings
Examine browser configuration to determine history retention settings
T1103: Virtualise suspect system for previewing
A suspect disk image can be configured to boot as a virtual machine, which allows screenshots to be taken showing how the user's desktop looked for example.
Virtualise suspect system for previewing
M1116: Attempt to dictionary attack user PIN (potentially on device)
Attempt to dictionary attack user PIN (potentially on device)
W1052: Incorrect retrieval of results from an index
Incorrect retrieval of results from an index
M1010: Perform full extraction instead of selective
Perform full extraction instead of selective
M1144: Use indexed keyword search
T1047: Hash matching (reduce)
M1130: Disable Secureboot in BIOS to permit bootable environment to load (risks wiping FDE key, requiring ADK).
Disable Secureboot in BIOS to permit bootable environment to load (risks wiping FDE key, requiring ADK).
M1161: Testing of live call record recovery from AI companion app
Testing of live call record recovery from AI companion app
W1023: Collection process changes content of data on target
Collection process changes content of data on target
T1090: Experimentation
M1056: Correlation of message data from third party data (another participant in message thread)
Correlation of message data from third party data (another participant in message thread)
T1147: Browser cookie examination
The examination of stored browser cookies
T1098: User account analysis (OS)
Examination of information related to user account creation and logins
T1009: Locate cloud account identifiers
W1008: Missing the existence of a device by missing synchronisation artefacts
Missing the existence of a device by missing synchronisation artefacts
W1047: File recovered from backup that did not exist
File recovered from backup that did not exist
W1201: Failure to recover live messages to or from the AI companion app
Failure to recover live messages to or from the AI companion app
Detect anti-forensics and other anomalies
Search for indicators of anti-forensic techniques or other anomalies such as malware, which could affect interpretation.
W1214: Failure to recover live records of calls to or from the AI companion app
Failure to recover live records of calls to or from the AI companion app
Access partitions, volumes and file systems data
Process core data storage structures such as partitions, volumes, and file systems, recovering content and metadata.
W1144: Failure to identify timestamps in a data source
Failure to identify timestamps in a data source
T1130: Search for indicators of encrypted data
Searching for the presence of current or historical encrypted data on a system
This can include encryption software itself, or encrypted files.
M1039: Hash matching to reduce need for manual review
Hash matching to reduce need for manual review
W1034: Missing data from the live system due to compromised machine (e.g. rootkit)
Missing data from the live system due to compromised machine (e.g. rootkit)
M1044: Scan for Volume Boot Records in unpartitioned space
X-Ways - Provides an option called ‘Scan for Lost Partitions’ which explicitly scans for deleted partitions in unallocated space (X-Ways 2024)
Scan for Volume Boot Records in unpartitioned space
M1032: Evaluation of the effectiveness of wordlist used for case-type searching
Kanta, A. and Hargreaves, C., 2025, August. Measuring the effectiveness of keyword lists in digital forensics. In Proceedings of the 20th International Conference on Availability, Reliability and Security.
Evaluation of the effectiveness of wordlist used for case-type searching
M1155: Testing for deleted message recovery from AI companion app
Testing for deleted message recovery from AI companion app
M1238: Configure device to enable required service
Android (2025), Android Debug Bridge (adb), https://developer.android.com/tools/adb
Configure device to enable required service
T1058: Search for mismatched file extensions
Basis Technology (2015), Extension Mismatch Detector Module, https://sleuthkit.org/autopsy/docs/user-docs/3.1/extension_mismatch_detector_page.html
Checking the content of a file against its file extension to identify mismatches.
This results in a file path of an identified file, but also highlights the extension that the file has, and the file extension(s) that are expected
W1042: Disk image was tampered with, but manipulated to have a collision with original hash
Disk image was tampered with, but manipulated to have a collision with original hash
W1265: Offset applied to timestamp is incorrect due to variations in time zone over the history of data source
Offset applied to timestamp is incorrect due to variations in time zone over the history of data source
M1117: Attempt to obtain user PIN from user
T1066: Log file examination (OS)
M1165: Ensure data collection prior to any interaction with app
Ensure data collection prior to any interaction with app
M1094: Include contextual information when assembling the dictionary
Include contextual information when assembling the dictionary
T1074: Social network app examination
Prioritize digital evidence sources
Rank the evidence sources based on their relevance and potential value to the investigation.
W1259: Image format parsing fails to identify or assemble split forensic images
Image format parsing fails to identify or assemble split forensic images
T1132: Search for indicators of artifact wiping
Searching for the presence of current or historical artifact wiping
Search for indicators of artifact wiping
W1143: Acquisition method does not read remapped sectors e.g. G-Lists
Acquisition method does not read remapped sectors e.g. G-Lists
M1228: Record system clock offset
M1015: Use tools only if changes made are to locations where relevant evidence is unlikely to be located.
Hargreaves, C.J., 2009. Assessing the reliability of digital evidence from live investigations involving encryption. Chapter 5
Use tools only if changes made are to locations where relevant evidence is unlikely to be located.
T1011: Store seized devices in evidence bags
M1122: Apply non-allocated record recovery to database file(s)
Apply non-allocated record recovery to database file(s)
T1012: Connect storage medium via hardware write blocker
Lyle, J.R., 2006. A strategy for testing hardware write block devices. digital investigation, 3, pp.3-9.
A hardware write blocking device [should] prevent any change to data in the user area of a hard drive while allowing access to all data on a hard drive. (Lyle 2006)
Note that "Sometimes it may be desirable to change a drive configuration to obtain access to otherwise hidden sectors, for example, such as within an HPA (host protected area)." (Lyle 2006)
Connect storage medium via hardware write blocker
W1119: Hardware write blocker hides the existence of an HPA.
Hardware write blocker hides the existence of an HPA.
W1249: Missing a web browser profile as it was stored outside of the usual browser profile folders
Missing a web browser profile as it was stored outside of the usual browser profile folders
W1085: Missing messages from the live set of messages
New msgstore – Who ‘Dis? A Look At An Updated WhatsApp On Android, https://thebinaryhick.blog/2022/06/09/new-msgstore-who-dis-a-look-at-an-updated-whatsapp-on-android/
Missing messages from the live set of messages
M1030: Testing of retrieval of indexed content
M1168: Request logs of access times from service provider
Request logs of access times from service provider
W1165: Failure to preserve original timestamps from the data source in an archive
Failure to preserve original timestamps from the data source in an archive
T1087: Location-based event reconstruction
The process of assigning location properties to a reconstructed event
W1228: Log entry missing due to incorrect parsing of logfile
Log entry missing due to incorrect parsing of logfile
M1147: Ensure keyword indexing settings configure text substring handling as required during indexing
Ensure keyword indexing settings configure text substring handling as required during indexing
M1151: Check keyword results are part of allocated file, or if not perform detailed analysis to determine if the association between keyword results and file is valid
Check keyword results are part of allocated file, or if not perform detailed analysis to determine if the association between keyword results and file is valid
W1210: Presenting an image sent from the user or AI companion app that did not exist
Presenting an image sent from the user or AI companion app that did not exist
T1005: Conduct a search of a crime scene
Birzer, M.L., 2018. Crime Scene Search. Introduction to Criminal Investigation, p.35.
Forensic Science Regulator (2025) Incident scene examination (FSR-GUI-0006). GOV.UK. Available at: https://www.gov.uk/government/publications/incident-scene-examination-fsr-gui-0006
The process of 'carefully documenting the conditions at a crime scene and identifying all relevant physical evidence.' (Birzer 2018).
The UK's Forensic Science Regulator (FSR) guidance refers to "Incident scene examination" which takes a holistic approach and considers an incident scene in conjunction with the requirements of an investigation and the criminal justice system. The aim of incident scene examination is to identify and locate, or note the absence of, physical material which has relevance and significance to inform the investigation including, where relevant, the reconstruction of past events.
W1262: Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time
Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time
T1091: Bookmark artifacts
Make a record of selected files or pieces of data so they can be accessed easily, or used for generating automated reports.
M1171: Testing of the recovery of companion AI bot settings
Testing of the recovery of companion AI bot settings
M1128: Use a Trusted Bootable Environment that is permitted to boot
Use a Trusted Bootable Environment that is permitted to boot
W1182: Bootable environment overwrites relevant data on the target device
Bootable environment overwrites relevant data on the target device
W1103: Failure to carve salvageable content
W1048: File recovered from backup but presented in the wrong location
File recovered from backup but presented in the wrong location
M1182: Testing of correct log entry type extraction
Testing of correct log entry type extraction
W1225: Failure to recover relevant app settings
Failure to recover relevant app settings
M1120: Recover appropriate database table joins from source application developer documentation
Recover appropriate database table joins from source application developer documentation
M1170: Experiments with test device to view possible settings of forensic value
Experiments with test device to view possible settings of forensic value
W1204: Presenting a deleted message to the AI companion app as a live one, or vice versa
Presenting a deleted message to the AI companion app as a live one, or vice versa
M1078: Use of multiple carving tools and comparing results
Use of multiple carving tools and comparing results
M1139: Use automated software monitoring to detect app artefact changes
Use automated software monitoring to detect app artefact changes
W1136: Not recovering data from a failed hard drive
Not recovering data from a failed hard drive
T1117: Time-based event reconstruction
The process of assigning a time component to a reconstructed event
M1045: Explicitly detect sector size in use
T1056: Entity connection enumeration
T1111: Recording system clock offset
Recording a system clock compared with trusted time source
Collection of the time of a device clock compared with the correct time, allowing an offset to be calculated *for the point in time when the clock was observed*.
M1175: Ensure any available archive logs are also examined
Ensure any available archive logs are also examined
M1213: Test the parsing of split forensic images with missing segments
Test the parsing of split forensic images with missing segments
T1072: Chat app examination
Analysis of the files that provide the backing store for a chat or messenger application
Messenger apps include: iOS Messenger WhatApp Telegram Signal Facebook Messenger …
W1193: Keyword results missed since relevant keyword is split over a sector or cluster boundary
Keyword results missed since relevant keyword is split over a sector or cluster boundary
M1235: Attempt to obtain password/pincode with brute force attacks
Attempt to obtain password/pincode with brute force attacks
W1211: Presenting a deleted image sent to the AI companion app as a live one, or vice versa
Presenting a deleted image sent to the AI companion app as a live one, or vice versa
W1092: Recovering a deleted message with incorrect metadata
Recovering a deleted message with incorrect metadata
T1153: Apply offset to a timestamp
Application of a time offset to a timestamp
This could be a clock offset, a timezone or other reason for a timestamp correction
T1035: Dictionary attack
Kanta, A., Coisel, I. and Scanlon, M., 2021, December. PCWQ: A framework for evaluating password cracking wordlist quality. In International Conference on Digital Forensics and Cyber Crime (pp. 159-175). Cham: Springer International Publishing.
A dictionary attack is a password cracking technique where an attacker uses a list of passwords, called a dictionary, to attempt to guess a password.
Dictionary attacks use list compiled common passwords that are likely to be used by people, such as dictionary words, names, common patterns or existing lists of popular or leaked passwords. Therefore, success depends on the quality and of dictionary list.
W1253: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information
Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information
W1077: Presenting a deleted file as a live file
Presenting a deleted file as a live file
T1133: AI companion app examination
Hargreaves & Drury, 2025, Forensic Analysis of AI Applications: A Replika "AI Companion" example, WSDF 2025
Bayor, L., Weinert, C., Maier, C. and Weitzel, T., 2025. Social-Oriented Communication with AI Companions: Benefits, Costs, and Contextual Patterns. Business & Information Systems Engineering, pp.1-19.
The forensic examination of the artifacts describing the configuration or the interaction with an AI companion app or service.
An AI companion is defined as "a type of generative AI-based conversational agent (CA) explicitly designed for companionship and friendship with a human user (Strohmann et al. 2022; Pentina et al. 2023)" (Bayor et al 2025).
W1251: Incomplete browser activity extraction due to failure to consider multiple profiles
Incomplete browser activity extraction due to failure to consider multiple profiles
W1009: Missing the existence of a device by incorrectly parsing synchronisation artefacts
Missing the existence of a device by incorrectly parsing synchronisation artefacts
W1151: Incorrectly decoding a timestamp from a data source
Incorrectly decoding a timestamp from a data source
W1058: Results appear in an ‘artefact’ or ‘result’ but the context, source or provenance of result is unclear
Results appear in an ‘artefact’ or ‘result’ but the context, source or provenance of result is unclear
M1135: Testing that correct metadata/status of connected devices is extracted
Testing that correct metadata/status of connected devices is extracted
T1075: Maps/travel app examination
W1029: Memory smearing may result in pointers being inconsistent within the memory image
Pagani, F., Fedorov, O. and Balzarotti, D., 2019. Introducing the temporal dimension to memory forensics. ACM Transactions on Privacy and Security (TOPS), 22(2), 1-21.
Jenny Ottmann, Üsame Cengiz, Frank Breitinger, and Felix Freiling, 2023. As if Time Had Stopped – Checking Memory Dumps for Quasi-Instantaneous Consistency. In Proceedings of the Digital Forensics Research Conference USA (DFRWS USA), Baltimore, MD, July 2023.
Ottmann, J., Breitinger, F. and Freiling, F., 2024. An experimental assessment of inconsistencies in memory forensics. ACM Transactions on Privacy and Security (TOPS). 27, 2:1–2:29.
Rzepka, L., Ottmann, J., Freiling, F. and Baier, H., 2024. Causal Inconsistencies are Normal in Windows Memory Dumps (too). Digital Threats: Research and Practice.
Memory smearing may result in pointers being inconsistent within the memory image
W1183: Failure to identify the existence of a connected device
Failure to identify the existence of a connected device
W1075: Presenting a file that does not exist
W1037: Presenting data as complete, that is in reality a partial set
Presenting data as complete, that is in reality a partial set
M1131: Use a Trusted Bootable Environment that supports accessing the internal disk
Use a Trusted Bootable Environment that supports accessing the internal disk
M1214: Ensure forensic tool UI clearly warns that there are problems while parsing a split forensic image file
Ensure forensic tool UI clearly warns that there are problems while parsing a split forensic image file
W1180: Failing to decrypt internal disk using the bootable environment
Failing to decrypt internal disk using the bootable environment
W1019: Data is collected and assigned to incorrect device
Data is collected and assigned to incorrect device
W1086: Failing to recover deleted but recoverable messages
Failing to recover deleted but recoverable messages
T1141: Browser bookmarks examination
The examination of the links saved within a browser to facilitate quick access
T1150: Recover non-allocated files using residual file metadata
Use metadata that remains in the file system to recover non-allocated files
Recover non-allocated files using residual file metadata
M1017: Check for physical presence of SD card
T1086: Timeline analysis
Berggren at al. (2014) TimeSketch, https://timesketch.org
Breitinger, F., Studiawan, H. and Hargreaves, C., 2025. SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges.
Casey, E., 2011. Digital evidence and computer crime: Forensic science, computers, and the internet. Academic press, Section 8.1.2
Hargreaves, C. and Patterson, J., 2012. An automated timeline reconstruction approach for digital forensic investigations. Digital Investigation, 9, pp.S69-S79.
The process of searching, filtering, sorting, highlighting, or aggregating timeline entries to determine which are relevant for event reconstruction, or to identify times of interest (adapted from Breitinger et al. 2025)
This can involve refinement approaches such as: filtering irrelevant entries, highlighting key entries, or aggregating entries into more meaningful events. This may result in a filtered timeline, or a set of highlighted timeline entries
T1067: Cloud synchronisation feature examination (OS)
Cloud synchronisation feature examination (OS)
M1188: Ensure all profiles of the web browser are considered
Ensure all profiles of the web browser are considered
M1216: Check that the assumption is valid that the specific local/external timestamp pair should be correlated
Check that the assumption is valid that the specific local/external timestamp pair should be correlated
T1128: Search for indicators of malware
Searching for the presence of current or historical malware on a system
This can involve searching for malware itself or other indicators e.g. persistence mechanisms, delivery method etc.
W1172: Relevant reference data missed as its necessity was not known at time of preservation
Relevant reference data missed as its necessity was not known at time of preservation
T1124: Keyword search (indexed)
Searching for keywords within a generated index of data in a case
W1230: Log entry missing due to rotation size or timing
Log entry missing due to rotation size or timing
M1077: Ensure potential secondary locations for stored message content are reviewed.
McGee, J. (2022). An Alternate Location for Deleted SMS/iMessage Data in Apple Devices. DFIR Review. Retrieved from https://dfir.pubpub.org/pub/yp6efc8q
Ensure potential secondary locations for stored message content are reviewed.
T1125: Keyword search (live)
X-Ways (2025), X-Ways Manual: Logical Search (section 5.11), https://www.x-ways.net/winhex/manual.pdf
Searching for keywords over the raw data in a case without using an index of text content
This may be done on a physical sector basis, or on a logical (file) basis.
M1152: Peer review of case-specific keyword list created
Peer review of case-specific keyword list created
T1123: Keyword search (case-specific wordlists)
Searching for case-specific keywords, e.g. people's names, places etc.
This complements case-type wordlists (T1122) using words typical to specific offenses.
Keyword search (case-specific wordlists)
M1090: Compare carved results against known files (e.g. from another source)
Compare carved results against known files (e.g. from another source)
W1261: Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring
Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring
M1118: Recover appropriate database table joins from source application source code
Recover appropriate database table joins from source application source code
M1043: Scan for orphaned EPTs
M1166: Remove all network connectivity from device
Remove all network connectivity from device
T1159: Extract mobile data via deployed agent
Elcomsoft 20203 https://blog.elcomsoft.com/2023/07/ios-device-acquisition-installing-the-extraction-agent/
Belkasoft https://belkasoft.com/agent_based_ios_acquisition
Deploy software to a mobile device that can carry out some function, either collect data with available permissions or attempt further exploitation e.g. sandbox escape.
While Android agents can be sideloaded with adb, deploying agents on iOS may require a developer account. Output may be equivalent of a file system acquisition if an exploit is successful. Otherwise data such as contacts would be extracted.
M1176: Ensure log entry type interpretation applies for the software version being examined
Ensure log entry type interpretation applies for the software version being examined
M1064: Verify that salvaged content is renderable using visual inspection of displayed/rendered content
Verify that salvaged content is renderable using visual inspection of displayed/rendered content
M1035: Verification against second tool with known different regex implementation
Verification against second tool with known different regex implementation
M1204: Use live keyword search over broader content of the data source
Use live keyword search over broader content of the data source
W1126: Failure to validate hash properly allowing an incomplete disk image to present as validated
Failure to validate hash properly allowing an incomplete disk image to present as validated
M1126: Use forensic bootable environment to gain access to internal media
Use forensic bootable environment to gain access to internal media
T1024: Cloud data collection via submission of request to service provider
Cloud data collection via submission of request to service provider
T1129: Search for indicators of clock tampering
Vanini, C., Hargreaves, C.J., van Beek, H. and Breitinger, F., 2024. Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction. Forensic Science International: Digital Investigation, 49, p.301759.
Searching for indicators that the system clock has been tampered with
W1094: Attributing a message to the incorrect sender
Attributing a message to the incorrect sender
M1174: Check logging settings to determine expected behaviour
Check logging settings to determine expected behaviour
T1070: Email examination
M1048: Check built-in integrity checks of partition tables where possible
Check built-in integrity checks of partition tables where possible
M1087: Acquire memory from outside of the target system for example using direct memory access (DMA) devices
Acquire memory from outside of the target system for example using direct memory access (DMA) devices
M1209: Ensure that tools used present the uncertainty associated with automated interpretation of data
Ensure that tools used present the uncertainty associated with automated interpretation of data
M1143: Use live logical keyword search
M1195: Also examine browser cache to confirm details about an older web visit when details are recovered using SQL join queries.
Also examine browser cache to confirm details about an older web visit when details are recovered using SQL join queries.
W1243: Missing browser history data as it was conducted outside of configured retention period
Missing browser history data as it was conducted outside of configured retention period
M1071: Thorough testing of write blocker against multiple targets to ensure that writes are not possible.
Thorough testing of write blocker against multiple targets to ensure that writes are not possible.
M1062: Verify semantic integrity of carved content using manual inspection of relevant data
Verify semantic integrity of carved content using manual inspection of relevant data
M1042: Secondary review of flagged items to ensure relevance
Secondary review of flagged items to ensure relevance
T1064: File carving
Basis Technology 2025, PhotoRec Carver Module, https://sleuthkit.org/autopsy/docs/user-docs/4.22.0/photorec_carver_page.html
Grenier (2023) PhotoRec, https://www.cgsecurity.org/wiki/PhotoRec
The process of recovering files from non-allocated space using only the structural properties of files.
File carving should result in not just the file content, but the offset in which it was found and the offset base (i.e. the disk, volume, or offset within another file). This approach uses internal files structural information only - if residual file system metadata is used then the complementary technique T1150 is more applicable.
M1003: Check image size corresponds with drive label
Check image size corresponds with drive label
W1219: Failure to recover metadata associated with an interaction with the AI companion app
Failure to recover metadata associated with an interaction with the AI companion app
T1094: Disclosure
M1178: Ensure timezone handling method for logfile timestamps is understood
Ensure timezone handling method for logfile timestamps is understood
T1158: Configure device to enable a service needed for data extraction
Turn on developer mode to make use of Android Debug Bridge (ADB)
Change a setting on a device such that a service needed for data extraction is enabled. This may require a user PIN that can be obtained using other techniques.
Configure device to enable a service needed for data extraction
M1109: Testing that tool(s) identify file types correctly
Testing that tool(s) identify file types correctly
T1156: Functional-based event reconstruction
Reconstructing the configuration or capabilities of a system at the time of an event
Considering how a system works and what conditions were necessary for an event to be possible, i.e. supporting or refuting if a hypothesis is feasible. This might involve questions such as: - is a program or system capable of performing some action - how was the program or system configured (to determine if an operation was possible)
M1137: Review of logs for any file extraction errors
Review of logs for any file extraction errors
W1089: Recovering a live message with incorrect content
Recovering a live message with incorrect content
M1110: Manual review of files classified as unknown
Manual review of files classified as unknown
M1206: Ensure that tools used clearly separate fact from interpretation
Ensure that tools used clearly separate fact from interpretation
M1107: Manual verification that all bookmarked items in the report are correctly rendered/represented.
Manual verification that all bookmarked items in the report are correctly rendered/represented.
M1103: Check that analysis of timestamp accuracy on which event reconstruction is based has been performed
Check that analysis of timestamp accuracy on which event reconstruction is based has been performed
W1017: Files or data that is relevant to the investigation is missed
Files or data that is relevant to the investigation is missed
M1237: Ensure that archive format used can handle sufficiently large files
Wikipedia (2026), ZIP (file format), https://en.wikipedia.org/wiki/ZIP_(file_format)#ZIP64
Ensure that archive format used can handle sufficiently large files
W1097: Failing to recover attachment for a deleted message
Failing to recover attachment for a deleted message
M1052: Use of a second independent tool to compare live file system listing
Use of a second independent tool to compare live file system listing
M1025: Validation & testing against the encryption system under consideration
Validation & testing against the encryption system under consideration
T1160: Collect data with 'cloud backup restore' approach
Geus, J., Gruber, J., Wozar, J. and Freiling, F., 2025. From sync to seizure: A binary instrumentation-based evaluation of the iCloud backup process. Forensic Science International: Digital Investigation, 54, p.301978.
Restore a device's cloud backup to a donor device, then subsequently use a local acquisition approach on that donor device, e.g. T1019/T1020
Collect data with 'cloud backup restore' approach
M1001: Review of all triage results that are relied on during the full digital forensic examination
Review of all triage results that are relied on during the full digital forensic examination
W1044: Failing to extract a decryption key that is present
Failing to extract a decryption key that is present
W1155: Bookmark added by examiner is not recorded
Bookmark added by examiner is not recorded
W1125: Failure to validate hash properly: this could allow errors from earlier to propagate e.g. incorrect sectors
Failure to validate hash properly: this could allow errors from earlier to propagate e.g. incorrect sectors
T1054: Manual content review for relevant material
Manual examination of files or artifacts to determine their relevance to the investigation.
The result of this process is a classification, which may be 'relevant', or could be more specific, e.g. 'contains reference to x'. This technique is likely paired with T1091 (Bookmark artifacts) but they could be recorded in other ways. This manual review could be of the content of files (T1058), or of content extracted from within files e.g. images (T1081), video (T1080), or audio (T1079).
Manual content review for relevant material
M1190: Ensure that the context of recovered URLs is considered during event reconstruction
Ensure that the context of recovered URLs is considered during event reconstruction
M1208: Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered
Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered
T1048: Privacy protection via partial processing
Dickinson (2020) ‘Privacy by design – 10 ways MSAB can help you meet the challenges.’ MSAB Blog. Available at: https://www.msab.com/blog/privacy-by-design-10-ways-msab-can-help-you-meet-the-challenges/
Limiting the scope of file processing based on type, date or other criteria to protect privacy.
The files may still be present in the data set or removed, or made in accessible but the core of the technique to to provide a limited set of artifacts, compared with full processing.
Privacy protection via partial processing
W1099: Assigning an attachment to an incorrect messages
Assigning an attachment to an incorrect messages
M1099: Use a dictionary attack instead
M1177: Ensure resolution or limitations of logfile timestamps are understood
Ensure resolution or limitations of logfile timestamps are understood
M1232: Adopt a systematic search pattern
Fisher & Fisher. 2012, Techniques of Crime Scene Investigation, Eighth Edition, p82
According to Fisher & Fisher (2012): "Criminal investigation texts recommend a variety of search patterns: the strip or lane search, grid search, spiral search, and quadrant search. "
W1033: Data referenced in memory is located within pagefile or swapfile but is not collected
Data referenced in memory is located within pagefile or swapfile but is not collected
W1160: Failure to copy relevant files from the mobile device
Failure to copy relevant files from the mobile device
M1057: Testing of parsing of syncronisation artefacts
Testing of parsing of syncronisation artefacts
T1089: Source code review
T1046: Privileged material protection
T1015: Privacy preserving selective extraction
Odyssey - Allows selective storing of data from mobile devices - https://www.bluelightsdigital.com/odyssey
Cellebrite - Allows filtering by app, data category, and/or by timestamp as to what data is collected.
XRY - Allows filtering by app, data category, and/or by timestamp as to what data is collected.
Previewing a data source and selecting a subset of the data for collection into a container such as a tar/zip file or a forensic image format for the purposes of protecting the privacy of the complainant or witness.
W1100: Failure to display special effects or highlight within a message
Failure to display special effects or highlight within a message
M1226: Testing to determine whether a timestamp is in UTC or local time
Testing to determine whether a timestamp is in UTC or local time
W1274: Inability to enable required service due to locked device
Inability to enable required service due to locked device
T1139: Browser session examination
The examination of sessions and open tabs and their individual histories
M1231: Make use of 'paired searching'
According to Fisher & Fisher (2012): "Indoor crime scene searches are best done with two persons. One easy way of accomplishing a search in a room is to divide it in half. Each investigator searches one half. After they have done a thorough search, they switch halves."
W1184: Presenting devices 'seen' as devices connected
Presenting devices 'seen' as devices connected
M1034: Comparison of index results with live search results
Comparison of index results with live search results
M1211: Test the parsing of split forensic images
Test the parsing of split forensic images
M1108: Preserve hash in secure location of the generated report so intentional or unintentional modifications can be detected.
Preserve hash in secure location of the generated report so intentional or unintentional modifications can be detected.
W1163: Changing relevant file metadata during file system acquisition
Changing relevant file metadata during file system acquisition
W1140: Failing to determine password as it is not in the search space
Failing to determine password as it is not in the search space
M1061: Use digital stratigraphy to attempt to attribute data within a specific file system
Schneider, J., Eichhorn, M., Dreier, L.M. and Hargreaves, C., 2024. Applying digital stratigraphy to the problem of recycled storage media. Forensic Science International: Digital Investigation, 49, p.301761.
Use digital stratigraphy to attempt to attribute data within a specific file system
W1250: Incomplete browser activity extraction due to not considering the browser cache artifacts
Incomplete browser activity extraction due to not considering the browser cache artifacts
M1119: Recover appropriate database table joins from source application reverse engineering
Recover appropriate database table joins from source application reverse engineering
Conduct research
Conduct research to gain additional knowledge to support the acquisition, extraction, or interpretation of digital evidence.
W1020: Content of data collected is incorrect
W1024: Collection process changes metadata of data on target
Collection process changes metadata of data on target
T1051: Fuzzy hash matching
M1086: Acquire the parts of memory with interconnected data first, before proceeding with a sequential acquisition.
Acquire the parts of memory with interconnected data first, before proceeding with a sequential acquisition.
T1143: Browser configuration examination
The examination of a browsers configuration
W1113: Misinterpretation a URL located on disk/memory as a web visit
Misinterpretation a URL located on disk/memory as a web visit
Create visualizations
Display information using visual representations to assist with analysis.
M1215: Test the parsing of split forensic images with a corrupt segment
Test the parsing of split forensic images with a corrupt segment
W1118: Hardware write blocker fails to prevent modifications to the attached device.
Hardware write blocker fails to prevent modifications to the attached device.
M1221: Testing of timestamp decoding within a time anchor
Testing of timestamp decoding within a time anchor
Gain access
Attempt to gain access to protected data sources or other restricted data.
W1002: Use of triage technology results in changes to the target media
Use of triage technology results in changes to the target media
W1104: Incorrect carving of a complete file
M1194: Consider carefully page titles and other details associated with older web history visits when details are recovered using SQL join queries.
Consider carefully page titles and other details associated with older web history visits when details are recovered using SQL join queries.
W1161: Lack of privileges for file system acquisition
Lack of privileges for file system acquisition
M1142: Review of case-specific keyword list by case officer
Review of case-specific keyword list by case officer
M1084: Test that the tool used expresses uncertainty in the classification of file recovery results
Test that the tool used expresses uncertainty in the classification of file recovery results
M1050: Manual verification of relevant data
W1032: Not all memory is acquired
Vömel, S. and Stüttgen, J., 2013. An evaluation platform for forensic memory acquisition software. Digital Investigation, 10, S30-S40.
T1007: Use a SyncTriage-based approach to detect existence of devices
SyncTriage - https://bitbucket.org/chrishargreaves/synctriage
A technique developed in Hargreaves & Marshall (2018) whereby synchronisation artefacts on a device are examined and used to identify the existence of a related device. Also sometimes used to infer activity that occurred on an inaccessible or unavailable device.
Use a SyncTriage-based approach to detect existence of devices
W1159: Presenting a mobile file system acquisition as a bitwise copy of the device
Presenting a mobile file system acquisition as a bitwise copy of the device
W1060: A relevant piece of media was not flagged as relevant
A relevant piece of media was not flagged as relevant
T1122: Keyword search (case-type wordlists)
Example word lists https://www.dfir.training/downloads/search-terms
Searching for case-type specific keywords
This complements case-specific wordlists (T1123) created for the individual case.
W1105: Incorrect reassembly of a file
Locate potentially relevant content
Attempt to find digital artifacts relevant to the investigation.
M1020: Compare data extracted with full list of installed apps
Compare data extracted with full list of installed apps
T1032: Side channel
Preserve digital evidence
Ensure the integrity and authenticity of digital evidence is maintained.
T1162: Read data from a device via In-System Programming (ISP)
Read data from a device via In-System Programming (ISP)
W1171: Failure to recover data stored in database journal files
Failure to recover data stored in database journal files
M1217: Consider multiple time anchors and check if timestamps from multiple external time sources agree
Consider multiple time anchors and check if timestamps from multiple external time sources agree
W1101: Failure to recover message edits if available
Failure to recover message edits if available
W1030: Loading a memory imaging tool makes changes to the data in memory that is being acquired
Campbell, W., 2013. Volatile memory acquisition tools–A comparison across taint and correctness. 11th Australian Digital Forensics Conference. Edith Cowan University, Perth, Western Australia.
Gruhn, M. and Freiling, F.C., 2016. Evaluating atomicity, and integrity of correct memory acquisition methods. Digital Investigation, 16, S1-S10.
Loading a memory imaging tool makes changes to the data in memory that is being acquired
M1129: Use USB flashdrive version if a CD version is not permitted to boot
Use USB flashdrive version if a CD version is not permitted to boot
M1179: If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation
If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation
W1190: Interpretation of app data is incorrect due to app version changes.
Interpretation of app data is incorrect due to app version changes.
T1120: Automated artifact extraction
The use of automation to extract pieces of data that are potentially useful for a digital forensic investigation
Artifacts extracted may be a direct mapping to lower levels of abstraction e.g. a database field 'message content' may map to an artifact 'message content', but in many cases, automated interpretation is applied where a field such as 'flag' containing numeric values, may be mapped to more meaningful text strings in the extracted artifact.
W1003: Triage tool applies a simplification that does not correctly represent the meaning of the digital data
Triage tool applies a simplification that does not correctly represent the meaning of the digital data
W1116: Last wifi connection is overwritten because faraday environment was insufficient.
Last wifi connection is overwritten because faraday environment was insufficient.
W1025: Data relevant to the case is excluded as part of the filtering process
Data relevant to the case is excluded as part of the filtering process
M1049: Check consistency between primary and backup partition tables (where possible)
Check consistency between primary and backup partition tables (where possible)
T1045: Decode standard archive format
Extract files from a common archive format e.g. TAR, RAR, ZIP
W1035: Collecting incorrect information from live system due to compromised machine (e.g. rootkit)
Collecting incorrect information from live system due to compromised machine (e.g. rootkit)
W1071: Failing to recover a complete listing of a live directory
Failing to recover a complete listing of a live directory
W1223: Live access to the device (for extraction) updates last access times for an account
Live access to the device (for extraction) updates last access times for an account
T1137: Browser history examination
The examination of artifacts of webpages visited
These are typically what are displayed in the address bar, with data typically stored within a locally stored database.
T1061: Recover non-allocated files
The recovery of files from non-allocated space
W1001: Excluding a device that contains relevant information
Excluding a device that contains relevant information
M1081: Check if recovered content matches with size in metadata e.g. file footer at expected location.
Check if recovered content matches with size in metadata e.g. file footer at expected location.
M1065: Render salvaged content by reconstructing a container around fragment(s) based on detected video frame and audio sample locations and (if available) a reference video file with similar parameters.
Render salvaged content by reconstructing a container around fragment(s) based on detected video frame and audio sample locations and (if available) a reference video file with similar parameters.
T1076: Log file examination
Examination of a file that was designed for incremental logging from a piece of software (e.g. an application or operating system feature)
These could be in a variety of formats e.g. plain text, JSON, XML, binary, etc.
T1138: Browser cache examination
The examination of the content saved locally by browsers to improve performance
W1120: Hardware write blocker hides the existence of an DCO.
Hardware write blocker hides the existence of an DCO.
W1269: Failure to apply time offset to a timeline entry
Failure to apply time offset to a timeline entry
M1132: Use a Trusted Bootable Environment that supports decryption of the internal disk
Casey et al (2011) The growing impact of full disk encryption on digital forensics, https://www.sciencedirect.com/science/article/abs/pii/S1742287611000727?via%3Dihub
Use a Trusted Bootable Environment that supports decryption of the internal disk
T1057: Search for indicators of steganography
Searching for the presence of current or historical steganography software on a system
W1218: Presenting a call to the AI companion app as from the AI companion app, or vice versa
Presenting a call to the AI companion app as from the AI companion app, or vice versa
W1150: Misinterpreting events from automated processes as user generated ones
Jens-Petter Sandvik, André Årnes, 2018. The reliability of clocks as digital evidence under low voltage conditions. Digital Investigation, 24, pp.S10-S17.
Misinterpreting events from automated processes as user generated ones
M1200: Ensure that inconsistencies between allocated data size and data written size are clearly flagged.
Ensure that inconsistencies between allocated data size and data written size are clearly flagged.
W1205: Presenting a message to the AI chat app as from the AI companion app, or vice versa
Presenting a message to the AI chat app as from the AI companion app, or vice versa
W1028: Due to the use of time based filters data extracted may be presented out of context
Due to the use of time based filters data extracted may be presented out of context
W1013: Acquisition includes extra bytes
W1187: Failure to match file name/path pattern due to mismatch of search term used and pattern match engine.
Failure to match file name/path pattern due to mismatch of search term used and pattern match engine.
W1004: Acquisition does not include all sectors from LBA0 to LBA max
Acquisition does not include all sectors from LBA0 to LBA max
M1091: Use a brute force attack instead
T1065: Content indexer examination (OS)
Metz (2011), Windows Search forensics, https://www.forensicfocus.com/articles/windows-search-forensics/
The Zeitgeist Project (2021) https://zeitgeist.freedesktop.org
Examine information from operating system artifacts relating to content indexing and search capabilities e.g. Windows Desktop Search
For example the Windows Search database '...contains vast amount of values about various of artifacts found on a Windows system, e.g. files and directories, emails, appointments, attachments, images, audio and video' (Metz 2011)
T1127: Keyword search (live) (logical)
Searching for keywords over the raw data, without an index of text content, but on a file by file basis
This approach can include decoding the individual file formats and content. It can also overcome limitations associated with compressed data or data split due to file fragmentation.
T1105: Memory examination (application-level)
W1157: Use of mobile exploit changes/overwrites data that was relevant to the investigation
Elcomsoft 2021, Forensically Sound checkm8 Based Extraction of iPhone 5s, 6, 6s and SE, https://blog.elcomsoft.com/2021/05/checkm8-based-extraction-of-iphone-5s-6-6s-and-se/
Use of mobile exploit changes/overwrites data that was relevant to the investigation
T1042: Disk image hash verification
Kessler, G.C., 2016. The impact of MD5 file hash collisions on digital forensic imaging. Journal of digital forensics, security and law, 11(4), p.9.
Kessler GC. The impact of SHA-1 file hash collisions on digital forensic imaging: A follow-up experiment. Journal of Digital Forensics, Security and Law. 2016;11(4):10.
Lyle, J., 2002. Testing disk imaging tools. DFRWS USA 2002, https://dfrws.org/wp-content/uploads/2019/06/2002_USA_paper-testing_disk_imaging_tools.pdf
Computing the hash function of the entire contents of a disk, recording it, and then subsequently computing the hash over any disk image created to detect if any content is different (adapted from Lyle 2002)
W1072: Recovering incorrect contents of a live file
Recovering incorrect contents of a live file
W1276: Relevant data is overwritten by deploying an agent to a mobile device
Relevant data is overwritten by deploying an agent to a mobile device
T1016: Live data collection
Waits, C., Akinyele, J.A., Nolan, R. and Rogers, L., 2008. Computer forensics: results of live response inquiry vs. memory image analysis. CERT program, CMU/SEI-2008-TN-017.
Kent, K., Chevalier, S., Grance, T. & Dang, H. (2006) Guide to Integrating Forensic Techniques into Incident Response. NIST Special Publication 800‑86. National Institute of Standards and Technology (NIST). Available at: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf
Running commands on a live system to collect specific pieces of information e.g. running processes or open ports
Prior to collecting data from the system, pre-stages are described in (Waits et al 2008) as: - Establish trusted command shell - Establish method for transmitting and storing the information
M1013: Consider memory acquisition and offline analysis instead
Hargreaves, C.J., 2009. Assessing the reliability of digital evidence from live investigations involving encryption. Chapter 6
Consider memory acquisition and offline analysis instead
T1113: Access internal storage via bootable environment
WinFE - Windows Forensic Environment, is forensically sound, bootable Windows operation system that can be burned into USB and plug the USB into suspected device. Then, after changing boot order, booting to the USB to create forensic images from the tested Windows, MacOS and Linux systems.
PALADIN Forensic - is a modified “live” Linux distribution based on Ubuntu that simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox.
Paladin Forensic Suite, https://sumuri.com/software/paladin/
Booting the suspected computer device into forensically-sound bootable software-write blocked operating system in order to image the disks.
Access internal storage via bootable environment
W1018: Data is collected that is not relevant to the investigation
Data is collected that is not relevant to the investigation
T1082: Document content analysis
W1131: Missing recognition of multiple file types: reporting a file as a limited set of types, or a single type, when it can be interpreted as having more than one, such as a GIF and Java Jar
Magazinius, J., Rios, B.K. and Sabelfeld, A., 2013, November. Polyglots: crossing origins by crossing formats. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security (pp. 753-764).
Missing recognition of multiple file types: reporting a file as a limited set of types, or a single type, when it can be interpreted as having more than one, such as a GIF and Java Jar
T1109: Payment app examination
W1129: File type is incorrectly identified
T1140: Browser autofill examination
The examination of data that is stored to autocomplete entries in forms
T1121: Keyword indexing
Extracting strings from a data source and adding them to an index for subsequent searching
M1150: Ensure keyword indexing settings mean that file formats will be decoded as required during indexing
Ensure keyword indexing settings mean that file formats will be decoded as required during indexing
W1095: Attributing a message to the incorrect thread
Attributing a message to the incorrect thread
T1050: Hash matching (locate)
W1192: Relevant results not captured by the case-specific keywords used
Relevant results not captured by the case-specific keywords used
W1244: Missing browser history data as it was cleared by user
Oh, J., Lee, S. and Lee, S., 2011. Advanced evidence collection and analysis of web browser activity. Digital investigation, 8, pp.S62-S70., section 3.6
Missing browser history data as it was cleared by user
M1210: Use a forensic image format with internal integrity and continuity metadata
Use a forensic image format with internal integrity and continuity metadata
T1163: Automated screenshot-based capture of a mobile device
Programmatically controlling a mobile device while capturing screenshots of the display.
Automated screenshot-based capture of a mobile device
T1104: Collect data using open source intelligence
Collect data using open source intelligence
Reduce data under consideration
Filter the data to be considered in the investigation for practical, legal, or privacy protection reasons.
W1135: Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected
Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected
M1218: Ensure that tools and processes take into account all current knowledge on sources of local/external timestamp pairs (time anchors)
Ensure that tools and processes take into account all current knowledge on sources of local/external timestamp pairs (time anchors)
T1021: Configuration file examination
Examination of a file that was designed for storing configuration information for a piece of software (e.g. an application or operating system feature)
W1217: Presenting a deleted call to the AI companion app as a live one, or vice versa
Presenting a deleted call to the AI companion app as a live one, or vice versa
T1157: Extract device data using exposed service
Android Debug Bridge (ADB) provides command line access when USB debugging is enabled on Android devices
Extraction of data by querying Content Providers on Android (via ADB)
Use an exposed service on a device to extract data. This represents several of the mobile data extraction methods e.g. Query content providers (android), AFC (iOS).
Extract device data using exposed service
W1196: One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image
One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image
W1137: Failing to determine password as it is not in the dictionary used
Failing to determine password as it is not in the dictionary used
T1134: Use time anchors to estimate clock offset
Browser caches often contain local timestamps and those derived from external servers
Records in web browser history databases contain local timestamps and, in some cases, timestamps from external servers, embedded in URLs
Email headers often record timestamps derived from external mail servers as well as timestamps generated by the local system time
Missed call or voicemail notification messages often include a timestamp derived from an external time source, e.g., missed call from XX on 2018-06-06 at 01:32:49 pm, which can be compared to the local file system time the message was received
Correlate timestamps from the system clock and an external trusted time source (Time Anchoring)
Correlate timestamps from the system clock and an external trusted source of time contained in the same artifact, allowing an offset to be estimated *for the point in time the timestamp was recorded*
Use time anchors to estimate clock offset
M1230: Ensure that daylight savings offsets that are applied to timestamps are correct
Ensure that daylight savings offsets that are applied to timestamps are correct
W1167: Combining data from multiple tables that should not be joined
Combining data from multiple tables that should not be joined
W1213: Failure to display an image to or from the AI companion app in the context of other messages
Failure to display an image to or from the AI companion app in the context of other messages
M1125: Examine database journal files
T1146: Browser synchronization feature examination
The examination of the settings and artifacts resulting from a browser synchronization feature
Browser synchronization feature examination
W1107: Failure to repair a content fragment
M1073: Subscription to notifications from write blocker vendor for firmware updates or identified problems.
Subscription to notifications from write blocker vendor for firmware updates or identified problems.
W1115: Device is remote wiped because faraday environment was insufficient.
Device is remote wiped because faraday environment was insufficient.
W1234: Event time presented incorrectly due to incorrect timezone handling
Event time presented incorrectly due to incorrect timezone handling
W1200: Failure to conduct iterative keyword searching due to excessive time taken per search
Failure to conduct iterative keyword searching due to excessive time taken per search
W1275: Failure to store data due to size limitations of archive format used
Failure to store data due to size limitations of archive format used
W1170: Failure to recover data stored in Write Ahead Log (WAL) files
Failure to recover data stored in Write Ahead Log (WAL) files
W1051: Failure to highlight that not all app data may be present in a backup
Failure to highlight that not all app data may be present in a backup
T1002: Disk imaging
Nikkel, B., 2016. Practical forensic imaging: securing digital evidence with Linux tools. No Starch Press, Chapter 6, “Forensic Image Acquisition
Copying of sectors from a storage media, typically LBA~0~ to LBA~max~ to a bitstream that can be stored in a image format (T1025).
The process could be applied to a traditional hard disk, SSD, USB stick, or data from an eMMC chip that has been desoldered and placed in a reader. This data needs to be stored as a container file (T1025). Logs would also usually be created recording the details of the imaging process and any errors that occured.
Produce documentation
Create documentation about techniques used and findings.
M1106: Testing that generated reports correctly represent/render all expected file types
Testing that generated reports correctly represent/render all expected file types
T1085: Identify conflation
T1059: Identify partitions
Hargreaves, Nelson and Casey (2024) provides a dataset with a deleted but recoverable partition that can be used for tool evaluation.
Nikkel, B., 2009. Forensic analysis of GPT disks and GUID partition tables. Digital Investigation, 6(1-2), pp.39-47.
Partitions are defined as ‘allocated contiguous sets of sectors from storage media’. This involves recovering the list of partitions that exist on a storage media.
Partitions schemes include: MBR, GPT, APM. Some schemes such as GPT have records of the partitions in a single area (plus a backup partition table), others such as MBR make use of Extended Partition Tables (EPTs) that are scattered throughout the disk. Partitions can also be deleted but may be recoverable if the start sectors of the volumes contained within them can be identified.
T1001: Triage
Roussev, V., Quates, C. and Martell, R., 2013. Real-time digital forensics and triage. Digital Investigation, 10(2), pp.158-167.
Wilson-Kovacs, D., 2020. Effective resource management in digital forensics: An exploratory analysis of triage practices in four English constabularies. Policing: an international journal, 43(1), pp.77-90.
Digital forensic triage is a partial forensic examination conducted under (significant) time and resource constraints. (Roussev et al 2013).
Involves the ranking of apprehended digital items in terms of their importance to a case and likelihood that the contain the data require (Wilson-Kovacs 2020). It can involve multiple techniques to identify devices of most interest such as keyword searching, hash matching, media review etc.
W1057: Relevant keyword results not captured by the case-type keyword list used
Relevant keyword results not captured by the case-type keyword list used
M1191: Ensure that profile configuration is examined rather than just folders within the standard profile folder
Mozillazine (2017), Profiles.ini file, https://kb.mozillazine.org/Profiles.ini_file
Ensure that profile configuration is examined rather than just folders within the standard profile folder
W1121: Image format parsing fails to to present all blocks from within a forensic container image in their ‘flat’ (dd) representation
Image format parsing fails to to present all blocks from within a forensic container image in their ‘flat’ (dd) representation
W1221: Failure to recover account details from the AI app data
Failure to recover account details from the AI app data
M1173: Check logging settings so the bounds of logging are known
Check logging settings so the bounds of logging are known
W1045: Extracting an incorrect decryption key
W1036: Overwriting relevant data with changes caused by running the live tools
Overwriting relevant data with changes caused by running the live tools
T1149: File versioning feature examination
Apple (2025) View and restore past versions of documents on Mac https://support.apple.com/en-gb/guide/mac-help/mh40710/mac
Hargreaves, C., Chivers, H. and Titheridge, D., 2008. Windows Vista and digital investigations. Digital Investigation, 5(1-2), pp.34-48.
Leschke, T.R. and Nicholas, C., 2013, October. Change-link 2.0: a digital forensic tool for visualizing changes to shadow volume data. In Proceedings of the Tenth Workshop on Visualization for Cyber Security (pp. 17-24).
Sreeja, S.C. and Balan, C., 2016, October. Forensic analysis of volume shadow copy in windows 7. In 2016 International Conference on Emerging Technological Trends (ICETT) (pp. 1-6). IEEE.
Extraction of data from the versioning system used by an operating system to store older versions of files.
Operating systems often maintain versioning systems that preserve older versions of files, either for backup purposes or to enable users to restore previous states. These systems create snapshots or shadow copies at regular intervals or when significant changes occur. Digital forensic examination of these versioning features can reveal files that have been modified or deleted, providing valuable evidence of system activity and user behavior. The examination process involves identifying the versioning mechanism used by the operating system, locating the stored versions, and extracting relevant data for analysis.
T1155: Operation-based event reconstruction
The process of reconstructing that an operation occurred on a digital system
While some event reconstruction needs a time component, there are some questions that are simply explaining what happened, or if something happened. The time component may need to investigated later, or may be learned as a byproduct of reconstructing the event, but isn't intrinsic to the question being asked. e.g. Was this file opened? How many times was this file opened? What data has been exfiltrated?
W1067: Failure to check the integrity of partition table (where possible e.g. GPT)
Failure to check the integrity of partition table (where possible e.g. GPT)
T1101: Cell site survey
Tart, M., Brodie, I., Gleed, N. and Matthews, J., 2012. Historic cell site analysis–Overview of principles and survey methodologies. Digital Investigation, 8(3-4), pp.185-193.
Hoy, J., 2023. Forensic radio survey techniques for cell site analysis. John Wiley & Sons.
Taking measurements to assess which cells actually provide service at a specific location (adapted from Tart et al 2012).
Can involve: spot sample, location survey, area survey, cell survey (Tart et al 2012)
W1091: Recovering a deleted message with incorrect content
Recovering a deleted message with incorrect content
T1034: Brute force attack
Kanta, A., Coray, S., Coisel, I. and Scanlon, M., 2021. How viable is password cracking in digital forensic investigation? Analyzing the guessability of over 3.9 billion real-world accounts. Forensic Science International: Digital Investigation, 37, p.301186.
A brute force attack, or exhaustive search is a password cracking approach where every combination of characters is tested until the correct one is found. This method is "guaranteed to work" given infinite time and resources which in a real-life scenario is not feasible.
Brute force attack involves trying every possible combination in a defined search space to find the correct value. The search space could be limited to just numbers, for example in the case of a 4-digit PIN number, or alphanumerical values or even the full ASCII character set. The larger the search space, the longer it takes to complete a brute force attack.
W1087: Presenting a live message that did not exist
Presenting a live message that did not exist
W1132: Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation
Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation
W1106: Incorrect attribution of salvaged content to a current file system rather than a previous one
Incorrect attribution of salvaged content to a current file system rather than a previous one
T1145: Browser extensions examination
The examination of the extensions installed within a browser
W1139: System locks after X failed dictionary attempts
System locks after X failed dictionary attempts
W1130: Missing assignment of a file type: reporting a file as unknown when it has a known type within the digital forensic science body of knowledge
Missing assignment of a file type: reporting a file as unknown when it has a known type within the digital forensic science body of knowledge
W1082: Recovering file system metadata incorrectly
Recovering file system metadata incorrectly
T1063: Identify file types
Dubettier, A., Gernot, T., Giguet, E. and Rosenberger, C., 2023. File type identification tools for digital investigations. Forensic Science International: Digital Investigation, 46, p.301574.
Applying a process that identifies the types of files.
This could be via extension, although files may have been renamed, and so this is unreliable, so other means such as examining a file signature or other techniques are used (Dubettier et al 2023)
T1052: Timeline generation
The extraction and normalisation of timestamps from a data source into a set of timeline entries
W1203: Presenting a message from the user or AI companion app that did not exist
Presenting a message from the user or AI companion app that did not exist
W1245: Relying on times stored in browser history that are not representative of exact web page visit time
Groß, T., Dirauf, R. and Freiling, F., 2020, May. Systematic analysis of browser history evidence. In 2020 13th International Conference on Systematic Approaches to Digital Forensic Engineering (SADFE) (pp. 1-12). IEEE.
Relying on times stored in browser history that are not representative of exact web page visit time
M1198: Check if file system and operating system make use of an 'allocated but unwritten' value e.g. VDL.
Check if file system and operating system make use of an 'allocated but unwritten' value e.g. VDL.
W1185: Failure to enumerate all files in a standard archive format
Failure to enumerate all files in a standard archive format
M1018: Check if presence of SD card is expected
Check if presence of SD card is expected
W1031: Loading a memory imaging tool overwrites relevant data within memory
Loading a memory imaging tool overwrites relevant data within memory
W1169: Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value
Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value
T1084: Extraction of user accounts
M1140: Use automation framework to emulate user actions to generate test data
Use automation framework to emulate user actions to generate test data
W1022: Metadata of data collected is incorrect
M1089: Attempt physical disk repair
W1173: Trusted time source is incorrect
T1107: Health/Fitness app examination
W1181: Failure to decrypt internal disk using a bootable environment
Failure to decrypt internal disk using a bootable environment
W1257: Missing content that is relevant to a keyword search but it has not been extracted as 'artifacts'
Missing content that is relevant to a keyword search but it has not been extracted as 'artifacts'
M1133: Acquire the encrypted contents of the internal disk and decrypt the copy within a virtualized environment
Acquire the encrypted contents of the internal disk and decrypt the copy within a virtualized environment
Acquire data
Collect data from the identified evidence sources.
W1062: The grade or specific tag given to item is incorrect
The grade or specific tag given to item is incorrect
W1255: Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL)
Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL)
W1256: Incorrect attribution of metadata to file content that was the result of 'file tunnelling'
Incorrect attribution of metadata to file content that was the result of 'file tunnelling'
M1079: Analyse file content to detect incompatibility between the content and the recovered file system metadata
Analyse file content to detect incompatibility between the content and the recovered file system metadata
W1006: Acquistion does not include data in HPA
M1026: Testing of backup parsing method
M1007: Use hardware write blocker
M1014: Test and document changes made by the tools used
Test and document changes made by the tools used
W1065: Failing to correctly parse start sector pointers from partition tables
Failing to correctly parse start sector pointers from partition tables
W1049: File content recovered incorrectly from backup
File content recovered incorrectly from backup
W1232: Failure to extract log entry timestamp
W1040: Not considering SD Card acquisition in addition to other extractions performed
Not considering SD Card acquisition in addition to other extractions performed
M1121: Infer appropriate table joins from extensive experimentation with known ground-truth data
Infer appropriate table joins from extensive experimentation with known ground-truth data
T1026: Writing data to standard archive format
Storing acquired data in a standard archive format such as rar, tar or zip
M1203: Use indexed keyword search over broader content of the data source
Use indexed keyword search over broader content of the data source
T1010: Place device in faraday environment
Place a device in an environment designed to shield a mobile phone or small digital device from radio waves entering the environment and reaching the device, and to stop radio waves escaping from the environment (adapted from Lennox-Steele & Nisbet (2016))
Environment should block: mobile network, Wi-Fi, and Bluetooth and all other RF.