Find potential digital evidence sources
type: Objective
includes technique: T1005: Conduct a search of a crime scene
includes technique: T1006: Digital sniffer dogs
includes technique: T1007: Use a SyncTriage-based approach to detect existence of devices
includes technique: T1008: Profiling network traffic
includes technique: T1009: Locate cloud account identifiers
objective description: Locate sources of digital evidence that may be relevant to the investigation.
objective name: Find potential digital evidence sources

Prioritize digital evidence sources
type: Objective
includes technique: T1001: Triage
objective description: Rank the evidence sources based on their relevance and potential value to the investigation.
objective name: Prioritize digital evidence sources

Preserve digital evidence
type: Objective
includes technique: T1010: Place device in faraday environment
includes technique: T1011: Store seized devices in evidence bags
includes technique: T1012: Connect storage medium via hardware write blocker
includes technique: T1013: Use software write blockers to provide read only access to storage media
includes technique: T1110: Preserving reference data
objective description: Ensure the integrity and authenticity of digital evidence is maintained.
objective name: Preserve digital evidence

Acquire data
type: Objective
includes technique: T1002: Disk imaging
includes technique: T1003: Memory imaging
includes technique: T1004: Selective file acquisition
includes technique: T1015: Privacy preserving selective extraction
includes technique: T1016: Live data collection
includes technique: T1017: Network packet capture
includes technique: T1018: Remote data collection
includes technique: T1020: Mobile file system extraction
includes technique: T1022: Mobile device screenshot based capture
includes technique: T1023: Cloud data collection to access data via a live web page using credentials
includes technique: T1024: Cloud data collection via submission of request to service provider
includes technique: T1025: Writing data to a forensic image format
includes technique: T1026: Writing data to standard archive format
includes technique: T1028: Chip-off
includes technique: T1029: Access data from a desoldered eMMC via a chip reader
includes technique: T1030: Data read from unmanaged NAND
includes technique: T1104: Collect data using open source intelligence
includes technique: T1111: Recording system clock offset
includes technique: T1112: Physical disk identification and removal
includes technique: T1113: Access internal storage via bootable environment
includes technique: T1114: Memory Acquisition via Cold Boot Attack
includes technique: T1157: Extract device data using exposed service
includes technique: T1159: Extract mobile data via deployed agent
includes technique: T1160: Collect data with 'cloud backup restore' approach
includes technique: T1162: Read data from a device via In-System Programming (ISP)
includes technique: T1163: Automated screenshot-based capture of a mobile device
objective description: Collect data from the identified evidence sources.
objective name: Acquire data

Gain access
type: Objective
includes technique: T1031: Key recovery from memory
includes technique: T1032: Side channel
includes technique: T1033: Extraction of credential from an accessible device
includes technique: T1034: Brute force attack
includes technique: T1035: Dictionary attack
includes technique: T1036: Smudge attack
includes technique: T1037: Obtain password from the device owner
includes technique: T1038: Rainbow table-based password attack
includes technique: T1039: App downgrade
includes technique: T1040: Use mobile device exploit
includes technique: T1041: Pin2Pwn
includes technique: T1158: Configure device to enable a service needed for data extraction
objective description: Attempt to gain access to protected data sources or other restricted data.
objective name: Gain access

Read data from digital evidence storage formats
type: Objective
includes technique: T1042: Disk image hash verification
includes technique: T1043: Decode forensic image format
includes technique: T1044: Mobile backup decoding
includes technique: T1045: Decode standard archive format
includes technique: T1102: Decode data from image from unmanaged NAND
objective description: Access data within digital evidence containers such as disk images, memory dumps, or archive formats.
objective name: Read data from digital evidence storage formats

Reduce data under consideration
type: Objective
includes technique: T1046: Privileged material protection
includes technique: T1047: Hash matching (reduce)
includes technique: T1048: Privacy protection via partial processing
objective description: Filter the data to be considered in the investigation for practical, legal, or privacy protection reasons.
objective name: Reduce data under consideration

Access partitions, volumes and file systems data
type: Objective
includes technique: T1059: Identify partitions
includes technique: T1060: Enumerate allocated files and folders
includes technique: T1061: Recover non-allocated files
includes technique: T1062: Decryption of encrypted file systems/volumes
includes technique: T1063: Identify file types
objective description: Process core data storage structures such as partitions, volumes, and file systems, recovering content and metadata.
objective name: Access partitions, volumes and file systems data

Extract artifacts stored by the operating system
type: Objective
includes technique: T1065: Content indexer examination (OS)
includes technique: T1066: Log file examination (OS)
includes technique: T1067: Cloud synchronisation feature examination (OS)
includes technique: T1068: Recently used file identification (OS)
includes technique: T1083: Memory examination (OS-level)
includes technique: T1096: Run programs identification (OS)
includes technique: T1097: Installed programs identification (OS)
includes technique: T1098: User account analysis (OS)
includes technique: T1116: Determine connected devices
includes technique: T1149: File versioning feature examination
objective description: Process data stored by the operating system to extract digital forensic artifacts.
objective name: Extract artifacts stored by the operating system

Extract artifacts stored by applications
type: Objective
includes technique: T1069: Browser examination
includes technique: T1070: Email examination
includes technique: T1072: Chat app examination
includes technique: T1073: Calendar app examination
includes technique: T1074: Social network app examination
includes technique: T1075: Maps/travel app examination
includes technique: T1077: Photos app examination
includes technique: T1078: Cloud sync app examination
includes technique: T1105: Memory examination (application-level)
includes technique: T1107: Health/Fitness app examination
includes technique: T1108: Reminders app examination
includes technique: T1109: Payment app examination
includes technique: T1133: AI companion app examination
objective description: Process data stored by the applications to extract digital forensic artifacts.
objective name: Extract artifacts stored by applications

Extract artifacts, or content of specific types
type: Objective
includes technique: T1021: Configuration file examination
includes technique: T1052: Timeline generation
includes technique: T1053: Entity extraction
includes technique: T1056: Entity connection enumeration
includes technique: T1071: Database examination
includes technique: T1076: Log file examination
includes technique: T1099: File repair with grafting
includes technique: T1100: EXIF data extraction
includes technique: T1120: Automated artifact extraction
objective description: Process data to extract artifacts or stored content of specific types.
objective name: Extract artifacts, or content of specific types

Locate potentially relevant content
type: Objective
includes technique: T1049: Keyword searching
includes technique: T1050: Hash matching (locate)
includes technique: T1051: Fuzzy hash matching
includes technique: T1086: Timeline analysis
includes technique: T1118: Locate relevant files by path
objective description: Attempt to find digital artifacts relevant to the investigation.
objective name: Locate potentially relevant content

Review content for relevance
type: Objective
includes technique: T1054: Manual content review for relevant material
includes technique: T1055: File system content inspection
includes technique: T1079: Audio content analysis
includes technique: T1080: Video content analysis
includes technique: T1081: Image content analysis
includes technique: T1082: Document content analysis
objective description: Review potentially relevant content to determine its significance or meaning.
objective name: Review content for relevance

Detect anti-forensics and other anomalies
type: Objective
includes technique: T1057: Search for indicators of steganography
includes technique: T1058: Search for mismatched file extensions
includes technique: T1128: Search for indicators of malware
includes technique: T1129: Search for indicators of clock tampering
includes technique: T1130: Search for indicators of encrypted data
includes technique: T1131: Search for indicators of trail obfuscation
includes technique: T1132: Search for indicators of artifact wiping
objective description: Search for indicators of anti-forensic techniques or other anomalies such as malware, which could affect interpretation.
objective name: Detect anti-forensics and other anomalies

Establish identities
type: Objective
includes technique: T1084: Extraction of user accounts
includes technique: T1085: Identify conflation
objective description: Attempt to link data or devices to individuals.
objective name: Establish identities

Create visualizations
type: Objective
includes technique: T1103: Virtualise suspect system for previewing
includes technique: T1115: Visualisation of geolocation information
objective description: Display information using visual representations to assist with analysis.
objective name: Create visualizations

Reconstruct events
type: Objective
includes technique: T1087: Location-based event reconstruction
includes technique: T1088: Relational-based event reconstruction
includes technique: T1117: Time-based event reconstruction
includes technique: T1154: Identity-based event reconstruction
includes technique: T1155: Operation-based event reconstruction
includes technique: T1156: Functional-based event reconstruction
objective description: Use available digital evidence to formulate and test hypotheses about events.
objective name: Reconstruct events

Conduct research
type: Objective
includes technique: T1089: Source code review
includes technique: T1090: Experimentation
includes technique: T1095: Instrumentation
includes technique: T1101: Cell site survey
includes technique: T1119: Automatically scan for artifact changes caused by app updates
objective description: Conduct research to gain additional knowledge to support the acquisition, extraction, or interpretation of digital evidence.
objective name: Conduct research

Produce documentation
type: Objective
includes technique: T1014: Chain of custody documentation
includes technique: T1091: Bookmark artifacts
includes technique: T1092: Produce tag-based automated report
includes technique: T1093: Write expert report
includes technique: T1094: Disclosure
objective description: Create documentation about techniques used and findings.
objective name: Produce documentation

W1150: Misinterpreting events from automated processes as user generated ones
type: Weakness
has reference: Jens-Petter Sandvik, André Årnes, 2018. The reliability of clocks as digital evidence under low voltage conditions. Digital Investigation, 24, pp.S10-S17.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1150
weakness name: Misinterpreting events from automated processes as user generated ones

W1181: Failure to decrypt internal disk using a bootable environment
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1181
weakness name: Failure to decrypt internal disk using a bootable environment

W1182: Bootable environment overwrites relevant data on the target device
type: Weakness
has potential mitigation: M1008: Use software write blocker
has potential mitigation: M1014: Test and document changes made by the tools used
has potential mitigation: M1015: Use tools only if changes made are to locations where relevant evidence is unlikely to be located.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1182
weakness name: Bootable environment overwrites relevant data on the target device

M1001: Review of all triage results that are relied on during the full digital forensic examination
type: Mitigation
mitigation ID: M1001
mitigation name: Review of all triage results that are relied on during the full digital forensic examination

M1012: Clear presentation of the backup and deletion process
type: Mitigation
mitigation ID: M1012
mitigation name: Clear presentation of the backup and deletion process

M1016: Alert user that the data collected is a partial set of data stored on the device
type: Mitigation
mitigation ID: M1016
mitigation name: Alert user that the data collected is a partial set of data stored on the device

M1017: Check for physical presence of SD card
type: Mitigation
mitigation ID: M1017
mitigation name: Check for physical presence of SD card

M1018: Check if presence of SD card is expected
type: Mitigation
mitigation ID: M1018
mitigation name: Check if presence of SD card is expected

M1019: Consider if file system acquisition is possible/permitted
type: Mitigation
links to technique: T1020: Mobile file system extraction
mitigation ID: M1019
mitigation name: Consider if file system acquisition is possible/permitted

M1020: Compare data extracted with full list of installed apps
type: Mitigation
mitigation ID: M1020
mitigation name: Compare data extracted with full list of installed apps

M1021: Verify the disk image integrity with multiple hash algorithms e.g. MD5 and SHA1 (Kessler 2016)
type: Mitigation
mitigation ID: M1021
mitigation name: Verify the disk image integrity with multiple hash algorithms e.g. MD5 and SHA1 (Kessler 2016)

M1024: Validate extracted key against the encrypted material before powering off the machine from which the key was extracted (e.g. Hargreaves & Chivers 2008b)
type: Mitigation
mitigation ID: M1024
mitigation name: Validate extracted key against the encrypted material before powering off the machine from which the key was extracted (e.g. Hargreaves & Chivers 2008b)

M1025: Validation & testing against the encryption system under consideration
type: Mitigation
mitigation ID: M1025
mitigation name: Validation & testing against the encryption system under consideration

M1030: Testing of retrieval of indexed content
type: Mitigation
mitigation ID: M1030
mitigation name: Testing of retrieval of indexed content

M1035: Verification against second tool with known different regex implementation
type: Mitigation
mitigation ID: M1035
mitigation name: Verification against second tool with known different regex implementation

M1036: Testing of regular expression component of tool
type: Mitigation
mitigation ID: M1036
mitigation name: Testing of regular expression component of tool

M1037: The context of relevant keyword results are manually checked
type: Mitigation
mitigation ID: M1037
mitigation name: The context of relevant keyword results are manually checked

M1043: Scan for orphaned EPTs
type: Mitigation
has reference: X-Ways - Provides an option called ‘Scan for Lost Partitions’ which explicitly scans for deleted partitions in unallocated space (X-Ways 2024)
mitigation ID: M1043
mitigation name: Scan for orphaned EPTs

M1044: Scan for Volume Boot Records in unpartitioned space
type: Mitigation
has reference: X-Ways - Provides an option called ‘Scan for Lost Partitions’ which explicitly scans for deleted partitions in unallocated space (X-Ways 2024)
mitigation ID: M1044
mitigation name: Scan for Volume Boot Records in unpartitioned space

M1045: Explicitly detect sector size in use
type: Mitigation
mitigation ID: M1045
mitigation name: Explicitly detect sector size in use

M1046: Check pointer offsets for both 512 and 4096 sectors sizes
type: Mitigation
mitigation ID: M1046
mitigation name: Check pointer offsets for both 512 and 4096 sectors sizes

M1048: Check built-in integrity checks of partition tables where possible
type: Mitigation
mitigation ID: M1048
mitigation name: Check built-in integrity checks of partition tables where possible

M1049: Check consistency between primary and backup partition tables (where possible)
type: Mitigation
mitigation ID: M1049
mitigation name: Check consistency between primary and backup partition tables (where possible)

M1059: Ongoing research and documentation of syncronisation artefacts
type: Mitigation
mitigation ID: M1059
mitigation name: Ongoing research and documentation of syncronisation artefacts

M1060: Repair salvaged content by grafting different reference data onto fragment(s)
type: Mitigation
links to technique: T1099: File repair with grafting
mitigation ID: M1060
mitigation name: Repair salvaged content by grafting different reference data onto fragment(s)

M1061: Use digital stratigraphy to attempt to attribute data within a specific file system
type: Mitigation
has reference: Schneider, J., Eichhorn, M., Dreier, L.M. and Hargreaves, C., 2024. Applying digital stratigraphy to the problem of recycled storage media. Forensic Science International: Digital Investigation, 49, p.301761.
mitigation ID: M1061
mitigation name: Use digital stratigraphy to attempt to attribute data within a specific file system

mitigationM1065
type: Mitigation
label: M1065: Render salvaged content by reconstructing a container around fragment(s) based on detected video frame and audio sample locations and (if available) a reference video file with similar parameters.
mitigation ID: M1065
mitigation name: Render salvaged content by reconstructing a container around fragment(s) based on detected video frame and audio sample locations and (if available) a reference video file with similar parameters.

M1066: Attempt to reconstruct browser activity from other areas of disk
type: Mitigation
has reference: Chivers, H., 2014. Private browsing: A window of forensic opportunity. Digital Investigation, 11(1), pp.20-29.
mitigation ID: M1066
mitigation name: Attempt to reconstruct browser activity from other areas of disk

M1067: Analyze web browser memory for web browsing activity
type: Mitigation
has reference: Chivers, H., 2014. Private browsing: A window of forensic opportunity. Digital Investigation, 11(1), pp.20-29.
links to technique: T1105: Memory examination (application-level)
mitigation ID: M1067
mitigation name: Analyze web browser memory for web browsing activity

M1068: Use digital sniffer dogs to assist in locating evidence
type: Mitigation
has reference: Petersen, S.J. and Schoon, A., 2022. Dogs as Detectors for Hidden Digital Storage Devices: A Pilot Study from the National Police of The Netherlands. In Canines (pp. 535-557). Jenny Stanford Publishing.
links to technique: T1006: Digital sniffer dogs
mitigation ID: M1068
mitigation name: Use digital sniffer dogs to assist in locating evidence

M1069: Use a SyncTriage style approach to determine existence other synchronized devices
type: Mitigation
has reference: Hargreaves, C. and Marshall, A., 2019. SyncTriage: Using synchronisation artefacts to optimise acquisition order. Digital Investigation, 28, pp.S134-S140.
links to technique: T1007: Use a SyncTriage-based approach to detect existence of devices
mitigation ID: M1069
mitigation name: Use a SyncTriage style approach to determine existence other synchronized devices

M1070: Ensure hash algorithm(s) used are resistant to collisions through data manipulation
type: Mitigation
mitigation ID: M1070
mitigation name: Ensure hash algorithm(s) used are resistant to collisions through data manipulation

M1071: Thorough testing of write blocker against multiple targets to ensure that writes are not possible.
type: Mitigation
has reference: Lyle, J.R., 2006. A strategy for testing hardware write block devices. digital investigation, 3, pp.3-9.
mitigation ID: M1071
mitigation name: Thorough testing of write blocker against multiple targets to ensure that writes are not possible.

M1072: Regular checks for hardware write blocker firmware updates.
type: Mitigation
mitigation ID: M1072
mitigation name: Regular checks for hardware write blocker firmware updates.

M1073: Subscription to notifications from write blocker vendor for firmware updates or identified problems.
type: Mitigation
mitigation ID: M1073
mitigation name: Subscription to notifications from write blocker vendor for firmware updates or identified problems.

M1074: Validate image hash against one stored externally to the image in a trusted location.
type: Mitigation
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
mitigation ID: M1074
mitigation name: Validate image hash against one stored externally to the image in a trusted location.

M1076: Testing programme to validate hashes of metadata in images is calculated correctly
type: Mitigation
mitigation ID: M1076
mitigation name: Testing programme to validate hashes of metadata in images is calculated correctly

M1077: Ensure potential secondary locations for stored message content are reviewed.
type: Mitigation
has reference: McGee, J. (2022). An Alternate Location for Deleted SMS/iMessage Data in Apple Devices. DFIR Review. Retrieved from https://dfir.pubpub.org/pub/yp6efc8q
mitigation ID: M1077
mitigation name: Ensure potential secondary locations for stored message content are reviewed.

M1078: Use of multiple carving tools and comparing results
type: Mitigation
mitigation ID: M1078
mitigation name: Use of multiple carving tools and comparing results

M1084: Test that the tool used expresses uncertainty in the classification of file recovery results
type: Mitigation
mitigation ID: M1084
mitigation name: Test that the tool used expresses uncertainty in the classification of file recovery results

M1086: Acquire the parts of memory with interconnected data first, before proceeding with a sequential acquisition.
type: Mitigation
has reference: Pagani, F., Fedorov, O. and Balzarotti, D., 2019. Introducing the temporal dimension to memory forensics. ACM Transactions on Privacy and Security (TOPS), 22(2), 1-21.
mitigation ID: M1086
mitigation name: Acquire the parts of memory with interconnected data first, before proceeding with a sequential acquisition.

M1087: Acquire memory from outside of the target system for example using direct memory access (DMA) devices
type: Mitigation
has reference: Latzo, T., Palutke, R. and Freiling, F., 2019. A universal taxonomy and survey of forensic memory acquisition techniques. Digital Investigation, 28, 56-69.
mitigation ID: M1087
mitigation name: Acquire memory from outside of the target system for example using direct memory access (DMA) devices

mitigationM1088
type: Mitigation
label: M1088: If applicable, leverage hardware virtualization utilities to add a hypervisor to the system, i.e., virtualize the original system. This allows to either freeze the system before the acquisition or, if the system should not be completely frozen, to copy pages before they are modified.
has reference: Case, A. and Richard III, G. G., 2017. Memory forensics: The path forward. Digital investigation, 20, 23-33.
has reference: Martignoni, L., Fattori, A., Paleari, R. and Cavallaro, L., 2010. Live and trustworthy forensic analysis of commodity production systems. In International Workshop on Recent Advances in Intrusion Detection (pp. 297-316). Berlin, Heidelberg: Springer Berlin Heidelberg.
mitigation ID: M1088
mitigation name: If applicable, leverage hardware virtualization utilities to add a hypervisor to the system, i.e., virtualize the original system. This allows to either freeze the system before the acquisition or, if the system should not be completely frozen, to copy pages before they are modified.

M1089: Attempt physical disk repair
type: Mitigation
mitigation ID: M1089
mitigation name: Attempt physical disk repair

M1091: Use a brute force attack instead
type: Mitigation
mitigation ID: M1091
mitigation name: Use a brute force attack instead

M1093: Use mangling rules to generate variants of candidate passwords
type: Mitigation
mitigation ID: M1093
mitigation name: Use mangling rules to generate variants of candidate passwords

M1096: Apply additional resources to dictionary attack
type: Mitigation
mitigation ID: M1096
mitigation name: Apply additional resources to dictionary attack

M1100: Apply additional resources to brute force attack
type: Mitigation
mitigation ID: M1100
mitigation name: Apply additional resources to brute force attack

M1102: Apply techniques to read remapped sectors
type: Mitigation
has reference: Turner, P. The Remapped/Reallocated Sector Conundrum, Presentation at DFRWS US 2024, https://www.dfrws.org/wp-content/uploads/2023/07/turner-remappedsectors.pdf
mitigation ID: M1102
mitigation name: Apply techniques to read remapped sectors

M1103: Check that analysis of timestamp accuracy on which event reconstruction is based has been performed
type: Mitigation
mitigation ID: M1103
mitigation name: Check that analysis of timestamp accuracy on which event reconstruction is based has been performed

M1104: Testing of report generation functionality that all intended bookmarks are included
type: Mitigation
mitigation ID: M1104
mitigation name: Testing of report generation functionality that all intended bookmarks are included

M1105: Manual verification that all intended bookmarks are included in the generated report.
type: Mitigation
mitigation ID: M1105
mitigation name: Manual verification that all intended bookmarks are included in the generated report.

M1106: Testing that generated reports correctly represent/render all expected file types
type: Mitigation
mitigation ID: M1106
mitigation name: Testing that generated reports correctly represent/render all expected file types

M1107: Manual verification that all bookmarked items in the report are correctly rendered/represented.
type: Mitigation
mitigation ID: M1107
mitigation name: Manual verification that all bookmarked items in the report are correctly rendered/represented.

M1108: Preserve hash in secure location of the generated report so intentional or unintentional modifications can be detected.
type: Mitigation
mitigation ID: M1108
mitigation name: Preserve hash in secure location of the generated report so intentional or unintentional modifications can be detected.

M1110: Manual review of files classified as unknown
type: Mitigation
mitigation ID: M1110
mitigation name: Manual review of files classified as unknown

M1113: Use mobile exploit to gain privileged access
type: Mitigation
links to technique: T1040: Use mobile device exploit
mitigation ID: M1113
mitigation name: Use mobile exploit to gain privileged access

M1114: Clear use of language around mobile file system extractions, making the limitations clear and differentiating from a full disk image
type: Mitigation
mitigation ID: M1114
mitigation name: Clear use of language around mobile file system extractions, making the limitations clear and differentiating from a full disk image

M1115: Attempt to brute force user PIN (potentially on device)
type: Mitigation
links to technique: T1034: Brute force attack
mitigation ID: M1115
mitigation name: Attempt to brute force user PIN (potentially on device)

M1116: Attempt to dictionary attack user PIN (potentially on device)
type: Mitigation
links to technique: T1035: Dictionary attack
mitigation ID: M1116
mitigation name: Attempt to dictionary attack user PIN (potentially on device)

M1117: Attempt to obtain user PIN from user
type: Mitigation
links to technique: T1037: Obtain password from the device owner
mitigation ID: M1117
mitigation name: Attempt to obtain user PIN from user

M1118: Recover appropriate database table joins from source application source code
type: Mitigation
mitigation ID: M1118
mitigation name: Recover appropriate database table joins from source application source code

M1119: Recover appropriate database table joins from source application reverse engineering
type: Mitigation
mitigation ID: M1119
mitigation name: Recover appropriate database table joins from source application reverse engineering

M1120: Recover appropriate database table joins from source application developer documentation
type: Mitigation
mitigation ID: M1120
mitigation name: Recover appropriate database table joins from source application developer documentation

M1121: Infer appropriate table joins from extensive experimentation with known ground-truth data
type: Mitigation
links to technique: T1090: Experimentation
mitigation ID: M1121
mitigation name: Infer appropriate table joins from extensive experimentation with known ground-truth data

M1122: Apply non-allocated record recovery to database file(s)
type: Mitigation
has reference: Pereira, M.T., 2009. Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records. Digital Investigation, 5(3-4), pp.93-103.
mitigation ID: M1122
mitigation name: Apply non-allocated record recovery to database file(s)

M1123: Apply system-wide record recovery for non-allocated database record data structures
type: Mitigation
has reference: Pereira, M.T., 2009. Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records. Digital Investigation, 5(3-4), pp.93-103.
mitigation ID: M1123
mitigation name: Apply system-wide record recovery for non-allocated database record data structures

M1124: Examine database contents with and without Write Ahead Log (WAL) files applied
type: Mitigation
has reference: Caithness 2012, The Forensic Implications of SQLite’s Write Ahead Log, https://digitalinvestigation.wordpress.com/2012/05/04/the-forensic-implications-of-sqlites-write-ahead-log/
has reference: Caithness 2024, Time travelling with SQLite Journals and WAL, https://www.cclsolutionsgroup.com/post/time-travelling-with-sqlite-journals-and-wal
mitigation ID: M1124
mitigation name: Examine database contents with and without Write Ahead Log (WAL) files applied

M1125: Examine database journal files
type: Mitigation
has reference: Caithness 2024, Time travelling with SQLite Journals and WAL, https://www.cclsolutionsgroup.com/post/time-travelling-with-sqlite-journals-and-wal
mitigation ID: M1125
mitigation name: Examine database journal files

M1127: Use a similar system to test steps required to interrupt the normal boot process and boot from Trusted Bootable Environment
type: Mitigation
mitigation ID: M1127
mitigation name: Use a similar system to test steps required to interrupt the normal boot process and boot from Trusted Bootable Environment

M1128: Use a Trusted Bootable Environment that is permitted to boot
type: Mitigation
mitigation ID: M1128
mitigation name: Use a Trusted Bootable Environment that is permitted to boot

M1129: Use USB flashdrive version if a CD version is not permitted to boot
type: Mitigation
mitigation ID: M1129
mitigation name: Use USB flashdrive version if a CD version is not permitted to boot

M1130: Disable Secureboot in BIOS to permit bootable environment to load (risks wiping FDE key, requiring ADK).
type: Mitigation
mitigation ID: M1130
mitigation name: Disable Secureboot in BIOS to permit bootable environment to load (risks wiping FDE key, requiring ADK).

M1131: Use a Trusted Bootable Environment that supports accessing the internal disk
type: Mitigation
mitigation ID: M1131
mitigation name: Use a Trusted Bootable Environment that supports accessing the internal disk

M1132: Use a Trusted Bootable Environment that supports decryption of the internal disk
type: Mitigation
has reference: Casey et al (2011) The growing impact of full disk encryption on digital forensics, https://www.sciencedirect.com/science/article/abs/pii/S1742287611000727?via%3Dihub
mitigation ID: M1132
mitigation name: Use a Trusted Bootable Environment that supports decryption of the internal disk

M1133: Acquire the encrypted contents of the internal disk and decrypt the copy within a virtualized environment
type: Mitigation
has reference: Casey et al (2011) The growing impact of full disk encryption on digital forensics, https://www.sciencedirect.com/science/article/abs/pii/S1742287611000727?via%3Dihub
mitigation ID: M1133
mitigation name: Acquire the encrypted contents of the internal disk and decrypt the copy within a virtualized environment

M1134: Testing that connected devices are detected.
type: Mitigation
mitigation ID: M1134
mitigation name: Testing that connected devices are detected.

M1135: Testing that correct metadata/status of connected devices is extracted
type: Mitigation
mitigation ID: M1135
mitigation name: Testing that correct metadata/status of connected devices is extracted

M1136: Testing of archive format parsing
type: Mitigation
mitigation ID: M1136
mitigation name: Testing of archive format parsing

M1137: Review of logs for any file extraction errors
type: Mitigation
mitigation ID: M1137
mitigation name: Review of logs for any file extraction errors

M1138: Testing file name/path pattern matching engine
type: Mitigation
mitigation ID: M1138
mitigation name: Testing file name/path pattern matching engine

M1140: Use automation framework to emulate user actions to generate test data
type: Mitigation
mitigation ID: M1140
mitigation name: Use automation framework to emulate user actions to generate test data

M1141: Careful review of case brief for case-specific keyword list generation
type: Mitigation
mitigation ID: M1141
mitigation name: Careful review of case brief for case-specific keyword list generation

M1145: Apply OCR to files and search or index resulting text
type: Mitigation
mitigation ID: M1145
mitigation name: Apply OCR to files and search or index resulting text

M1146: Ensure keyword indexing settings capture text encodings required during indexing
type: Mitigation
mitigation ID: M1146
mitigation name: Ensure keyword indexing settings capture text encodings required during indexing

M1147: Ensure keyword indexing settings configure text substring handling as required during indexing
type: Mitigation
mitigation ID: M1147
mitigation name: Ensure keyword indexing settings configure text substring handling as required during indexing

M1148: Ensure keyword indexing settings configure case sensitivity for indexing as required
type: Mitigation
mitigation ID: M1148
mitigation name: Ensure keyword indexing settings configure case sensitivity for indexing as required

M1149: Ensure keyword indexing settings mean that decompression will be applied as required during indexing
type: Mitigation
mitigation ID: M1149
mitigation name: Ensure keyword indexing settings mean that decompression will be applied as required during indexing

M1150: Ensure keyword indexing settings mean that file formats will be decoded as required during indexing
type: Mitigation
mitigation ID: M1150
mitigation name: Ensure keyword indexing settings mean that file formats will be decoded as required during indexing

M1151: Check keyword results are part of allocated file, or if not perform detailed analysis to determine if the association between keyword results and file is valid
type: Mitigation
mitigation ID: M1151
mitigation name: Check keyword results are part of allocated file, or if not perform detailed analysis to determine if the association between keyword results and file is valid

M1153: Index data in the case and perform iterative keyword searching using the index
type: Mitigation
links to technique: T1124: Keyword search (indexed)
mitigation ID: M1153
mitigation name: Index data in the case and perform iterative keyword searching using the index

M1156: Testing that message sender and recipient extraction are correct
type: Mitigation
mitigation ID: M1156
mitigation name: Testing that message sender and recipient extraction are correct

M1160: Testing that picture message sender and recipient extraction are correct
type: Mitigation
mitigation ID: M1160
mitigation name: Testing that picture message sender and recipient extraction are correct

M1163: Testing that call record caller and recipient extraction are correct
type: Mitigation
mitigation ID: M1163
mitigation name: Testing that call record caller and recipient extraction are correct

M1165: Ensure data collection prior to any interaction with app
type: Mitigation
mitigation ID: M1165
mitigation name: Ensure data collection prior to any interaction with app

M1166: Remove all network connectivity from device
type: Mitigation
mitigation ID: M1166
mitigation name: Remove all network connectivity from device

M1167: Check time of account access is prior to device seizure time
type: Mitigation
mitigation ID: M1167
mitigation name: Check time of account access is prior to device seizure time

M1168: Request logs of access times from service provider
type: Mitigation
mitigation ID: M1168
mitigation name: Request logs of access times from service provider

M1169: Testing of app settings recovery from AI companion app
type: Mitigation
mitigation ID: M1169
mitigation name: Testing of app settings recovery from AI companion app

M1172: Also examine any older versions of the logs from backups
type: Mitigation
mitigation ID: M1172
mitigation name: Also examine any older versions of the logs from backups

M1173: Check logging settings so the bounds of logging are known
type: Mitigation
has reference: https://www.crowdstrike.com/en-us/guides/syslog-logging/advanced-concepts/
mitigation ID: M1173
mitigation name: Check logging settings so the bounds of logging are known

M1174: Check logging settings to determine expected behaviour
type: Mitigation
mitigation ID: M1174
mitigation name: Check logging settings to determine expected behaviour

M1176: Ensure log entry type interpretation applies for the software version being examined
type: Mitigation
mitigation ID: M1176
mitigation name: Ensure log entry type interpretation applies for the software version being examined

M1177: Ensure resolution or limitations of logfile timestamps are understood
type: Mitigation
mitigation ID: M1177
mitigation name: Ensure resolution or limitations of logfile timestamps are understood

M1178: Ensure timezone handling method for logfile timestamps is understood
type: Mitigation
mitigation ID: M1178
mitigation name: Ensure timezone handling method for logfile timestamps is understood

M1179: If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation
type: Mitigation
mitigation ID: M1179
mitigation name: If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation

M1180: Testing correct extraction of logfile entry timestamps
type: Mitigation
mitigation ID: M1180
mitigation name: Testing correct extraction of logfile entry timestamps

M1181: Testing logfile parsing capability
type: Mitigation
mitigation ID: M1181
mitigation name: Testing logfile parsing capability

M1182: Testing of correct log entry type extraction
type: Mitigation
mitigation ID: M1182
mitigation name: Testing of correct log entry type extraction

M1187: Ensure browser cache data is also considered
type: Mitigation
links to technique: T1138: Browser cache examination
mitigation ID: M1187
mitigation name: Ensure browser cache data is also considered

M1188: Ensure all profiles of the web browser are considered
type: Mitigation
links to technique: T1144: Browser profile enumeration
mitigation ID: M1188
mitigation name: Ensure all profiles of the web browser are considered

M1189: Conduct experiments to determine if content from the page in question is cached only when viewed in the browser
type: Mitigation
has reference: Horsman, G., 2018. I didn't see that! An examination of internet browser cache behaviour following website visits. Digital Investigation, 25, pp.105-113.
mitigation ID: M1189
mitigation name: Conduct experiments to determine if content from the page in question is cached only when viewed in the browser

M1190: Ensure that the context of recovered URLs is considered during event reconstruction
type: Mitigation
mitigation ID: M1190
mitigation name: Ensure that the context of recovered URLs is considered during event reconstruction

M1191: Ensure that profile configuration is examined rather than just folders within the standard profile folder
type: Mitigation
has reference: Mozillazine (2017), Profiles.ini file, https://kb.mozillazine.org/Profiles.ini_file
links to technique: T1143: Browser configuration examination
mitigation ID: M1191
mitigation name: Ensure that profile configuration is examined rather than just folders within the standard profile folder

M1192: Examine browser configuration to determine history retention settings
type: Mitigation
links to technique: T1143: Browser configuration examination
mitigation ID: M1192
mitigation name: Examine browser configuration to determine history retention settings

M1194: Consider carefully page titles and other details associated with older web history visits when details are recovered using SQL join queries.
type: Mitigation
mitigation ID: M1194
mitigation name: Consider carefully page titles and other details associated with older web history visits when details are recovered using SQL join queries.

M1195: Also examine browser cache to confirm details about an older web visit when details are recovered using SQL join queries.
type: Mitigation
links to technique: T1138: Browser cache examination
mitigation ID: M1195
mitigation name: Also examine browser cache to confirm details about an older web visit when details are recovered using SQL join queries.

M1196: Check if file being recovered is smaller than a block
type: Mitigation
mitigation ID: M1196
mitigation name: Check if file being recovered is smaller than a block

M1197: Check if file being recovered is resident (applicable on some file systems)
type: Mitigation
mitigation ID: M1197
mitigation name: Check if file being recovered is resident (applicable on some file systems)

M1198: Check if file system and operating system make use of an 'allocated but unwritten' value e.g. VDL.
type: Mitigation
mitigation ID: M1198
mitigation name: Check if file system and operating system make use of an 'allocated but unwritten' value e.g. VDL.

M1199: Check all relevant file size metadata values when recovering file content
type: Mitigation
mitigation ID: M1199
mitigation name: Check all relevant file size metadata values when recovering file content

M1200: Ensure that inconsistencies between allocated data size and data written size are clearly flagged.
type: Mitigation
mitigation ID: M1200
mitigation name: Ensure that inconsistencies between allocated data size and data written size are clearly flagged.

M1203: Use indexed keyword search over broader content of the data source
type: Mitigation
links to technique: T1124: Keyword search (indexed)
mitigation ID: M1203
mitigation name: Use indexed keyword search over broader content of the data source

M1204: Use live keyword search over broader content of the data source
type: Mitigation
links to technique: T1125: Keyword search (live)
mitigation ID: M1204
mitigation name: Use live keyword search over broader content of the data source

M1206: Ensure that tools used clearly separate fact from interpretation
type: Mitigation
has reference: International Organization for Standardization (ISO) (2015) ISO/IEC 27042:2015 Guidelines for the analysis and interpretation of digital evidence.
mitigation ID: M1206
mitigation name: Ensure that tools used clearly separate fact from interpretation

M1207: Ensure training is in place for tool operators to separate fact from interpretation within the tool used
type: Mitigation
has reference: ISO 21043-5:2025 - Forensic sciences — Part 5: Reporting
has reference: International Organization for Standardization (ISO) (2015) ISO/IEC 27042:2015 Guidelines for the analysis and interpretation of digital evidence.
mitigation ID: M1207
mitigation name: Ensure training is in place for tool operators to separate fact from interpretation within the tool used

M1208: Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered
type: Mitigation
has reference: ISO 21043-5:2025 - Forensic sciences — Part 5: Reporting
has reference: International Organization for Standardization (ISO) (2015) ISO/IEC 27042:2015 Guidelines for the analysis and interpretation of digital evidence.
mitigation ID: M1208
mitigation name: Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered

M1209: Ensure that tools used present the uncertainty associated with automated interpretation of data
type: Mitigation
has reference: ISO 21043-5:2025 - Forensic sciences — Part 5: Reporting
has reference: International Organization for Standardization (ISO) (2015) ISO/IEC 27042:2015 Guidelines for the analysis and interpretation of digital evidence.
mitigation ID: M1209
mitigation name: Ensure that tools used present the uncertainty associated with automated interpretation of data

M1210: Use a forensic image format with internal integrity and continuity metadata
type: Mitigation
has reference: Cohen, M., Garfinkel, S. and Schatz, B., 2009. Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow. digital investigation, 6, pp.S57-S68.
mitigation ID: M1210
mitigation name: Use a forensic image format with internal integrity and continuity metadata

M1211: Test the parsing of split forensic images
type: Mitigation
mitigation ID: M1211
mitigation name: Test the parsing of split forensic images

M1212: Test the parsing of split forensic images with the maximum number of segments possible
type: Mitigation
mitigation ID: M1212
mitigation name: Test the parsing of split forensic images with the maximum number of segments possible

M1213: Test the parsing of split forensic images with missing segments
type: Mitigation
mitigation ID: M1213
mitigation name: Test the parsing of split forensic images with missing segments

M1214: Ensure forensic tool UI clearly warns that there are problems while parsing a split forensic image file
type: Mitigation
mitigation ID: M1214
mitigation name: Ensure forensic tool UI clearly warns that there are problems while parsing a split forensic image file

M1215: Test the parsing of split forensic images with a corrupt segment
type: Mitigation
mitigation ID: M1215
mitigation name: Test the parsing of split forensic images with a corrupt segment

M1216: Check that the assumption is valid that the specific local/external timestamp pair should be correlated
type: Mitigation
mitigation ID: M1216
mitigation name: Check that the assumption is valid that the specific local/external timestamp pair should be correlated

M1217: Consider multiple time anchors and check if timestamps from multiple external time sources agree
type: Mitigation
mitigation ID: M1217
mitigation name: Consider multiple time anchors and check if timestamps from multiple external time sources agree

M1218: Ensure that tools and processes take into account all current knowledge on sources of local/external timestamp pairs (time anchors)
type: Mitigation
mitigation ID: M1218
mitigation name: Ensure that tools and processes take into account all current knowledge on sources of local/external timestamp pairs (time anchors)

M1219: Manual verification of timestamp decoding within a time anchor
type: Mitigation
mitigation ID: M1219
mitigation name: Manual verification of timestamp decoding within a time anchor

M1220: Periodically keep records of time offsets of significant external servers
type: Mitigation
links to technique: T1110: Preserving reference data
mitigation ID: M1220
mitigation name: Periodically keep records of time offsets of significant external servers

M1221: Testing of timestamp decoding within a time anchor
type: Mitigation
mitigation ID: M1221
mitigation name: Testing of timestamp decoding within a time anchor

M1222: Testing to ensure that tooling is able to extract local/external timestamp pairs (time anchors)
type: Mitigation
mitigation ID: M1222
mitigation name: Testing to ensure that tooling is able to extract local/external timestamp pairs (time anchors)

M1223: Apply time zone based offsets only to UTC stored timestamps
type: Mitigation
mitigation ID: M1223
mitigation name: Apply time zone based offsets only to UTC stored timestamps

M1226: Testing to determine whether a timestamp is in UTC or local time
type: Mitigation
mitigation ID: M1226
mitigation name: Testing to determine whether a timestamp is in UTC or local time

M1227: Search for indicators of clock tampering
type: Mitigation
links to technique: T1129: Search for indicators of clock tampering
mitigation ID: M1227
mitigation name: Search for indicators of clock tampering

M1228: Record system clock offset
type: Mitigation
links to technique: T1111: Recording system clock offset
mitigation ID: M1228
mitigation name: Record system clock offset

M1229: Determine last timezone used on system
type: Mitigation
mitigation ID: M1229
mitigation name: Determine last timezone used on system

M1230: Ensure that daylight savings offsets that are applied to timestamps are correct
type: Mitigation
mitigation ID: M1230
mitigation name: Ensure that daylight savings offsets that are applied to timestamps are correct

M1237: Ensure that archive format used can handle sufficiently large files
type: Mitigation
has reference: Wikipedia (2026), ZIP (file format), https://en.wikipedia.org/wiki/ZIP_(file_format)#ZIP64
mitigation ID: M1237
mitigation name: Ensure that archive format used can handle sufficiently large files

M1238: Configure device to enable required service
type: Mitigation
has reference: Android (2025), Android Debug Bridge (adb), https://developer.android.com/tools/adb
has reference: Android (2025), How to Enable Android Developer Settings: Unlock your Device’s Hidden Potential, https://www.android.com/intl/en_uk/articles/enable-android-developer-settings/
links to technique: T1158: Configure device to enable a service needed for data extraction
mitigation ID: M1238
mitigation name: Configure device to enable required service

M1239: Obtain possible passwords/PIN codes from other devices with limited security
type: Mitigation
links to technique: T1033: Extraction of credential from an accessible device
mitigation ID: M1239
mitigation name: Obtain possible passwords/PIN codes from other devices with limited security

T1001: Triage
type: Technique
has CASE input class: https://ontology.solveit-df.org/solveit/observable/DeviceSet
has CASE output class: https://ontology.solveit-df.org/solveit/observable/PrioritizedDeviceSet
has potential weakness: W1001: Excluding a device that contains relevant information
has potential weakness: W1002: Use of triage technology results in changes to the target media
has potential weakness: W1003: Triage tool applies a simplification that does not correctly represent the meaning of the digital data
has reference: Roussev, V., Quates, C. and Martell, R., 2013. Real-time digital forensics and triage. Digital Investigation, 10(2), pp.158-167.
has reference: Wilson-Kovacs, D., 2020. Effective resource management in digital forensics: An exploratory analysis of triage practices in four English constabularies. Policing: an international journal, 43(1), pp.77-90.
technique description: Digital forensic triage is a partial forensic examination conducted under (significant) time and resource constraints. (Roussev et al 2013).
technique details: Involves the ranking of apprehended digital items in terms of their importance to a case and likelihood that the contain the data require (Wilson-Kovacs 2020). It can involve multiple techniques to identify devices of most interest such as keyword searching, hash matching, media review etc.
technique ID: T1001
technique name: Triage

T1002: Disk imaging
type: Technique
has CASE input class: https://ontology.solveit-df.org/solveit/observable/DeviceInterface
has CASE input class: https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface
has CASE output class: https://ontology.solveit-df.org/solveit/observable/BitstreamData
has example: FTK Imager
has example: Magnet ACQUIRE
has example: dcfldd
has potential weakness: W1004: Acquisition does not include all sectors from LBA0 to LBA max
has potential weakness: W1006: Acquistion does not include data in HPA
has potential weakness: W1007: Acquistion does not include data in DCO
has potential weakness: W1013: Acquisition includes extra bytes
has potential weakness: W1014: Imaging process changes original data
has potential weakness: W1015: Powering on SSD results in sectors being wiped by TRIM operation
has potential weakness: W1016: Data copied from sectors on source device are stored incorrectly
has potential weakness: W1136: Not recovering data from a failed hard drive
has potential weakness: W1143: Acquisition method does not read remapped sectors e.g. G-Lists
has reference: Nikkel, B., 2016. Practical forensic imaging: securing digital evidence with Linux tools. No Starch Press, Chapter 6, “Forensic Image Acquisition
technique description: Copying of sectors from a storage media, typically LBA~0~ to LBA~max~ to a bitstream that can be stored in a image format (T1025).
technique details: The process could be applied to a traditional hard disk, SSD, USB stick, or data from an eMMC chip that has been desoldered and placed in a reader. This data needs to be stored as a container file (T1025). Logs would also usually be created recording the details of the imaging process and any errors that occured.
technique ID: T1002
technique name: Disk imaging

T1003: Memory imaging
type: Technique
has CASE input class: https://ontology.unifiedcyberontology.org/uco/observable/Memory
has CASE output class: https://ontology.solveit-df.org/solveit/observable/RawImageFile
has CASE output class: https://ontology.solveit-df.org/solveit/observable/RawImageInfoFile
has example: FTK Imager
has potential weakness: W1029: Memory smearing may result in pointers being inconsistent within the memory image
has potential weakness: W1030: Loading a memory imaging tool makes changes to the data in memory that is being acquired
has potential weakness: W1031: Loading a memory imaging tool overwrites relevant data within memory
has potential weakness: W1032: Not all memory is acquired
has potential weakness: W1033: Data referenced in memory is located within pagefile or swapfile but is not collected
has reference: Case, A. and Richard III, G. G., 2017. Memory forensics: The path forward. Digital investigation, 20, 23-33.
has reference: Kornblum, J.D., 2007. Using every part of the buffalo in Windows memory analysis. Digital Investigation, 4(1), pp.24-29.
has reference: Latzo, T., Palutke, R. and Freiling, F., 2019. A universal taxonomy and survey of forensic memory acquisition techniques. Digital Investigation, 28, 56-69.
has synonym: RAM dump
has synonym: RAM imaging
has synonym: memory dump
technique description: Involves creating a copy of the live memory data of a running system
technique details: Collection of Pagefile may also be useful (Kornblum 2007).
technique ID: T1003
technique name: Memory imaging

T1004: Selective file acquisition
type: Technique
has CASE input class: https://ontology.unifiedcyberontology.org/uco/observable/FileSystem
has CASE output class: https://ontology.solveit-df.org/solveit/observable/FilteredFileSet
has CASE output class: https://ontology.solveit-df.org/solveit/observable/ForensicImageContainer
has example: FTK Imager - allows an AD1 logical container to be created of a selected subset of files within a previewed data source.
has potential weakness: W1017: Files or data that is relevant to the investigation is missed
has potential weakness: W1018: Data is collected that is not relevant to the investigation
has potential weakness: W1019: Data is collected and assigned to incorrect device
has potential weakness: W1020: Content of data collected is incorrect
has potential weakness: W1021: Metadata of data collected is missing
has potential weakness: W1022: Metadata of data collected is incorrect
has potential weakness: W1023: Collection process changes content of data on target
has potential weakness: W1024: Collection process changes metadata of data on target
has synonym: Logical imaging
technique description: Previewing a data source and selecting a subset of the files for extraction into a container such as a tar/zip file or a forensic image format.
technique ID: T1004
technique name: Selective file acquisition

T1005: Conduct a search of a crime scene
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/DeviceSet
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Device
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/location
has potential weakness: W1114: Failure to locate a relevant device at a physical crime scene
has reference: Birzer, M.L., 2018. Crime Scene Search. Introduction to Criminal Investigation, p.35.
has reference: Forensic Science Regulator (2025) Incident scene examination (FSR-GUI-0006). GOV.UK. Available at: https://www.gov.uk/government/publications/incident-scene-examination-fsr-gui-0006
has synonym: Crime scene examination
has synonym: Crime scene investigation
has synonym: Crime scene processing
has synonym: Incident scene examination
has synonym: Scene search
technique description: The process of 'carefully documenting the conditions at a crime scene and identifying all relevant physical evidence.' (Birzer 2018).
technique details: The UK's Forensic Science Regulator (FSR) guidance refers to "Incident scene examination" which takes a holistic approach and considers an incident scene in conjunction with the requirements of an investigation and the criminal justice system. The aim of incident scene examination is to identify and locate, or note the absence of, physical material which has relevance and significance to inform the investigation including, where relevant, the reconstruction of past events.
technique ID: T1005
technique name: Conduct a search of a crime scene

T1008: Profiling network traffic
type: Technique
technique ID: T1008
technique name: Profiling network traffic

T1009: Locate cloud account identifiers
type: Technique
technique ID: T1009
technique name: Locate cloud account identifiers

T1010: Place device in faraday environment
type: Technique
has potential weakness: W1115: Device is remote wiped because faraday environment was insufficient.
has potential weakness: W1116: Last wifi connection is overwritten because faraday environment was insufficient.
has potential weakness: W1117: Calls, messages or other data was received and overwrote relevant data because faraday environment was insufficient.
has reference: Lennox-Steele, A., & Nisbet, A. (2016). A forensic examination of several mobile device Faraday bags & materials to test their effectiveness. In Valli, C. (Ed.). (2016). The Proceedings of 14th Australian Digital Forensics Conference, 5-6 December 2016, Edith Cowan University, Perth, Australia. (pp 34-41).
technique description: Place a device in an environment designed to shield a mobile phone or small digital device from radio waves entering the environment and reaching the device, and to stop radio waves escaping from the environment (adapted from Lennox-Steele & Nisbet (2016))
technique details: Environment should block: mobile network, Wi-Fi, and Bluetooth and all other RF.
technique ID: T1010
technique name: Place device in faraday environment

T1011: Store seized devices in evidence bags
type: Technique
technique ID: T1011
technique name: Store seized devices in evidence bags

T1014: Chain of custody documentation
type: Technique
has reference: todo
technique ID: T1014
technique name: Chain of custody documentation

T1015: Privacy preserving selective extraction
type: Technique
has example: Cellebrite - Allows filtering by app, data category, and/or by timestamp as to what data is collected.
has example: Odyssey - Allows selective storing of data from mobile devices - https://www.bluelightsdigital.com/odyssey
has example: XRY - Allows filtering by app, data category, and/or by timestamp as to what data is collected.
has potential weakness: W1025: Data relevant to the case is excluded as part of the filtering process
has potential weakness: W1026: Selective extraction of a backup implies partial collection when it is in reality a full collection followed by deletion.
has potential weakness: W1027: Including data that was meant to be excluded with the selected filters
has potential weakness: W1028: Due to the use of time based filters data extracted may be presented out of context
has reference: todo
technique description: Previewing a data source and selecting a subset of the data for collection into a container such as a tar/zip file or a forensic image format for the purposes of protecting the privacy of the complainant or witness.
technique ID: T1015
technique name: Privacy preserving selective extraction

T1016: Live data collection
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/IPAddress
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/MACAddress
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/NetworkConnection
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Process
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/UserAccount
has example: ipconfig
has example: netstat
has example: procdump
has example: pslist
has example: psloggedon
has potential weakness: W1034: Missing data from the live system due to compromised machine (e.g. rootkit)
has potential weakness: W1035: Collecting incorrect information from live system due to compromised machine (e.g. rootkit)
has potential weakness: W1036: Overwriting relevant data with changes caused by running the live tools
has reference: Kent, K., Chevalier, S., Grance, T. & Dang, H. (2006) Guide to Integrating Forensic Techniques into Incident Response. NIST Special Publication 800‑86. National Institute of Standards and Technology (NIST). Available at: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf
has reference: Waits, C., Akinyele, J.A., Nolan, R. and Rogers, L., 2008. Computer forensics: results of live response inquiry vs. memory image analysis. CERT program, CMU/SEI-2008-TN-017.
has synonym: Live response data collection
has synonym: Volatile data collection
technique description: Running commands on a live system to collect specific pieces of information e.g. running processes or open ports
technique details: Prior to collecting data from the system, pre-stages are described in (Waits et al 2008) as: - Establish trusted command shell - Establish method for transmitting and storing the information
technique ID: T1016
technique name: Live data collection

T1017: Network packet capture
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/NetworkPacketCapture
technique ID: T1017
technique name: Network packet capture

T1018: Remote data collection
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Image
has reference: todo
technique ID: T1018
technique name: Remote data collection

T1019: Mobile backup extraction
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile
has example: Extraction of an iOS backup
has example: Use of ADB to generate an Android backup
has potential weakness: W1037: Presenting data as complete, that is in reality a partial set
has potential weakness: W1038: Backup process returns an incomplete set of backup data
has potential weakness: W1039: Backup data collection overwrites important data
has potential weakness: W1040: Not considering SD Card acquisition in addition to other extractions performed
has potential weakness: W1041: Not considering file system acquisition as alternative
has potential weakness: W1270: Inability to create a device backup due to locked device
technique description: Using the backup capability of a device to extract a subset of its contents
technique ID: T1019
technique name: Mobile backup extraction

T1021: Configuration file examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
has CASE output class: https://ontology.unifiedcyberontology.org/uco/configuration/ConfigurationEntry
has example: prefs.js from Firefox
technique description: Examination of a file that was designed for storing configuration information for a piece of software (e.g. an application or operating system feature)
technique ID: T1021
technique name: Configuration file examination

T1022: Mobile device screenshot based capture
type: Technique
has reference: Fukami, A., Stoykova, R. and Geradts, Z., 2021. A new model for forensic data extraction from encrypted mobile devices. Forensic Science International: Digital Investigation, 38, p.301169.
technique description: An examiner directly manipulates the target mobile device using the device's input interface (i.e., keypads and buttons), and records the content shown on the display of the device. (Fukami et al 2021)
technique ID: T1022
technique name: Mobile device screenshot based capture

T1023: Cloud data collection to access data via a live web page using credentials
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile
technique ID: T1023
technique name: Cloud data collection to access data via a live web page using credentials

T1024: Cloud data collection via submission of request to service provider
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile
technique ID: T1024
technique name: Cloud data collection via submission of request to service provider

T1025: Writing data to a forensic image format
type: Technique
has CASE input class: https://ontology.solveit-df.org/solveit/observable/BitstreamData
has CASE input class: https://ontology.solveit-df.org/solveit/observable/FileSet
has CASE output class: https://ontology.solveit-df.org/solveit/observable/ForensicImageContainer
has CASE output class: https://ontology.solveit-df.org/solveit/observable/RawImageFile
has example: 2009 M57-Jean - Data is supplied as a ‘multi-volume Expert Witness file’ - i.e. split EnCase E01 & E02 image files (https://digitalcorpora.org/corpora/scenarios/m57-jean/)
has example: FTK Imager: This tool can be used to acquire data from block devices in various image formats including RAW, EWF, and AFF
has example: Magnet Acquire: This tool can be used to acquire data from block devices in various image formats including RAW and EWF.
has example: libewf: This open source library allows access to the EWF format. The accompanying ewftools proves tools to verify, inspect and create EWF images.
has potential weakness: W1043: Data is written to forensic format that does not preserve the original raw data
has synonym: Disk image container
has synonym: image file
technique description: Storage of data recovered from a digital device in various formats which might include bitstream data or a logical set of files
technique details: Bitstream data that would result from disk imaging would be stored in formats such as: RAW, EWF, AFF4. For sets of files that are extracted there are proprietary logical formats from tool vendors. The imaged data may be split into several linked container formats. e.g. e01, e02 e03 etc.
technique ID: T1025
technique name: Writing data to a forensic image format

T1026: Writing data to standard archive format
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile
has potential weakness: W1165: Failure to preserve original timestamps from the data source in an archive
has potential weakness: W1275: Failure to store data due to size limitations of archive format used
technique description: Storing acquired data in a standard archive format such as rar, tar or zip
technique ID: T1026
technique name: Writing data to standard archive format

T1027: Data read using JTAG
type: Technique
has reference: todo
technique ID: T1027
technique name: Data read using JTAG

T1028: Chip-off
type: Technique
has reference: todo
technique ID: T1028
technique name: Chip-off

T1029: Access data from a desoldered eMMC via a chip reader
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/BitstreamData
technique ID: T1029
technique name: Access data from a desoldered eMMC via a chip reader

T1030: Data read from unmanaged NAND
type: Technique
has reference: todo
technique ID: T1030
technique name: Data read from unmanaged NAND

T1031: Key recovery from memory
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/DecryptionKey
has example: Bulk Extractor - of the many scanners within bulk extractor, one of which attempts to locate AES keys.
has example: Volatility - the plug in ‘trucryptmaster’ attempts to recover Truecrypt 7.1a master keys.
has potential weakness: W1044: Failing to extract a decryption key that is present
has potential weakness: W1045: Extracting an incorrect decryption key
has reference: Halderman, J.A., Schoen, S.D., Heninger, N., Clarkson, W., Paul, W., Calandrino, J.A., Feldman, A.J., Appelbaum, J. and Felten, E.W., 2009. Lest we remember: cold-boot attacks on encryption keys. Communications of the ACM, 52(5), pp.91-98.
has reference: Hargreaves & Chivers 2008b. Avoiding Live Imaging of Large Encrypted Volumes by Recovering Keys from Memory, Proceedings from 3rd Advances in Computer Security and Forensics
has reference: Hargreaves, C. and Chivers, H., 2008, March. Recovery of encryption keys from memory using a linear scan. In 2008 Third International Conference on Availability, Reliability and Security (pp. 1369-1376). IEEE.
technique description: This describes the technique whereby an attempt is made to extract key material from memory, or a memory acquisition of a running system to fascinate the decryption of some data
technique ID: T1031
technique name: Key recovery from memory

T1032: Side channel
type: Technique
has reference: todo
technique ID: T1032
technique name: Side channel

T1036: Smudge attack
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/UnlockPattern
technique ID: T1036
technique name: Smudge attack

T1038: Rainbow table-based password attack
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/password
has reference: todo
technique ID: T1038
technique name: Rainbow table-based password attack

T1039: App downgrade
type: Technique
has reference: https://support.mobiledit.com/portal/en/kb/articles/app-downgrade
has reference: https://www.oxygenforensics.com/en/resources/downgrade-method-what-should-be-known-before-the-procedure/
technique description: Downgrading an app to a version in which data is available e.g. via a backup method
technique ID: T1039
technique name: App downgrade

T1041: Pin2Pwn
type: Technique
has reference: todo
technique ID: T1041
technique name: Pin2Pwn

T1043: Decode forensic image format
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Image
has example: Advanced Forensic Format (AFF)
has example: Expert Witness Format (EWF)
has potential weakness: W1121: Image format parsing fails to to present all blocks from within a forensic container image in their ‘flat’ (dd) representation
has potential weakness: W1122: Image format parsing presents incorrect data within sectors of the image
has potential weakness: W1123: Image format parsing presents incorrect forensic image metadata
has potential weakness: W1259: Image format parsing fails to identify or assemble split forensic images
has reference: Cohen, M., Garfinkel, S. and Schatz, B., 2009. Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow. digital investigation, 6, pp.S57-S68.
has reference: Im, S., Park, H., Joun, J., Lee, S. and Park, J., 2024. Revisiting logical image formats for future digital forensics: A comprehensive analysis on L01 and AFF4-L. Forensic Science International: Digital Investigation, 50
has synonym: Read forensic format
has synonym: Read forensic image
technique description: The decoding of a forensic format such as EWF such that the raw sectors can be accessed by a forensic tool (typically performed on-the-fly internally in a tool.)
technique details: For example a EWF (Expert Witness Format) needs to be processed to expose the equivalent RAW image sectors. Therefore both the input and output types here are [https://ontology.unifiedcyberontology.org/uco/observable/Image]. This technique would not need to be used when working with a RAW image format directly. This also includes decoding logical formats such as L01, AD1, CTR, or AFF4-L. The output here is not an image file but rather a set of files and their metadata
technique ID: T1043
technique name: Decode forensic image format

T1044: Mobile backup decoding
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/filePath
has potential weakness: W1046: File not recovered from the stored backup
has potential weakness: W1047: File recovered from backup that did not exist
has potential weakness: W1048: File recovered from backup but presented in the wrong location
has potential weakness: W1049: File content recovered incorrectly from backup
has potential weakness: W1050: Failure to highlight that there are other apps present for which data is not available
has potential weakness: W1051: Failure to highlight that not all app data may be present in a backup
has reference: todo
technique ID: T1044
technique name: Mobile backup decoding

T1045: Decode standard archive format
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has potential weakness: W1185: Failure to enumerate all files in a standard archive format
technique description: Extract files from a common archive format e.g. TAR, RAR, ZIP
technique ID: T1045
technique name: Decode standard archive format

T1046: Privileged material protection
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/RedactedArtifactSet
has CASE output class: https://ontology.solveit-df.org/solveit/observable/RedactedFileSet
technique ID: T1046
technique name: Privileged material protection

T1047: Hash matching (reduce)
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/RedactedFileSet
has CASE output class: https://ontology.unifiedcyberontology.org/uco/analysis/classification
has potential weakness: W1132: Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation
has reference: todo
technique ID: T1047
technique name: Hash matching (reduce)

T1048: Privacy protection via partial processing
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/RedactedArtifactSet
has reference: Dickinson (2020) ‘Privacy by design – 10 ways MSAB can help you meet the challenges.’ MSAB Blog. Available at: https://www.msab.com/blog/privacy-by-design-10-ways-msab-can-help-you-meet-the-challenges/
technique description: Limiting the scope of file processing based on type, date or other criteria to protect privacy.
technique details: The files may still be present in the data set or removed, or made in accessible but the core of the technique to to provide a limited set of artifacts, compared with full processing.
technique ID: T1048
technique name: Privacy protection via partial processing

T1049: Keyword searching
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResult
has potential weakness: W1053: Incorrect parsing of a supplied regular expression used for keyword searching
has potential weakness: W1058: Results appear in an ‘artefact’ or ‘result’ but the context, source or provenance of result is unclear
has potential weakness: W1059: Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical
has potential weakness: W1196: One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image
has reference: Beebe, N.L. and Clark, J.G., 2007. Digital forensic text string searching: Improving information retrieval effectiveness by thematically clustering search results. Digital investigation, 4, pp.49-54.
has reference: Beebe, N.L. and Liu, L., 2014. Ranking algorithms for digital forensic string search hits. Digital Investigation, 11, pp.S124-S132.
has reference: NIST, 2025. Computer forensics tools & techniques catalog: string search, https://toolcatalog.nist.gov/taxonomy/index.php?ff_id=31
has subtechnique: T1121: Keyword indexing
has subtechnique: T1122: Keyword search (case-type wordlists)
has subtechnique: T1123: Keyword search (case-specific wordlists)
has subtechnique: T1124: Keyword search (indexed)
has subtechnique: T1125: Keyword search (live)
has subtechnique: T1126: Keyword search (live) (physical)
has subtechnique: T1127: Keyword search (live) (logical)
has subtechnique: T1151: Keyword search (over extracted artifacts)
has synonym: string search
technique description: This technique involves searching data in the case for specific strings
technique details: This search may be conducted live, directly over the data, or from a generated index of strings extracted from the data. The words searched for may be either case-specific, or sometimes case-type specific.
technique ID: T1049
technique name: Keyword searching

T1050: Hash matching (locate)
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/analysis/classification
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has potential weakness: W1132: Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation
has reference: todo
technique ID: T1050
technique name: Hash matching (locate)

T1051: Fuzzy hash matching
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/analysis/classification
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has reference: todo
technique ID: T1051
technique name: Fuzzy hash matching

T1052: Timeline generation
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/Timeline
has CASE output class: https://ontology.solveit-df.org/solveit/observable/TimelineEntry
has example: plaso
has potential weakness: W1144: Failure to identify timestamps in a data source
has potential weakness: W1145: Failure to extract timestamps from a data source
has potential weakness: W1146: Failure to consider non-timestamp based timing information
has potential weakness: W1147: Failure to normalise timestamps correctly during timeline generation
has potential weakness: W1151: Incorrectly decoding a timestamp from a data source
has potential weakness: W1269: Failure to apply time offset to a timeline entry
has reference: Dreier, L.M., Vanini, C., Hargreaves, C.J., Breitinger, F. and Freiling, F., 2024. Beyond timestamps: Integrating implicit timing information into digital forensic timelines. Forensic Science International: Digital Investigation, 49, p.301755.
has reference: Hargreaves, C. and Patterson, J., 2012. An automated timeline reconstruction approach for digital forensic investigations. Digital Investigation, 9, pp.S69-S79.
has subtechnique: T1153: Apply offset to a timestamp
has synonym: timelining
technique description: The extraction and normalisation of timestamps from a data source into a set of timeline entries
technique ID: T1052
technique name: Timeline generation

T1053: Entity extraction
type: Technique
has reference: todo
technique ID: T1053
technique name: Entity extraction

T1054: Manual content review for relevant material
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/path
has potential weakness: W1060: A relevant piece of media was not flagged as relevant
has potential weakness: W1061: An irrelevant piece of media was flagged as relevant
has potential weakness: W1062: The grade or specific tag given to item is incorrect
technique description: Manual examination of files or artifacts to determine their relevance to the investigation.
technique details: The result of this process is a classification, which may be 'relevant', or could be more specific, e.g. 'contains reference to x'. This technique is likely paired with T1091 (Bookmark artifacts) but they could be recorded in other ways. This manual review could be of the content of files (T1058), or of content extracted from within files e.g. images (T1081), video (T1080), or audio (T1079).
technique ID: T1054
technique name: Manual content review for relevant material

T1055: File system content inspection
type: Technique
has reference: todo
technique ID: T1055
technique name: File system content inspection

T1056: Entity connection enumeration
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ObservableRelationship
has reference: todo
technique ID: T1056
technique name: Entity connection enumeration

T1057: Search for indicators of steganography
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/path
has reference: Kessler, G.C., 2007. Anti-forensics and the digital investigator.
technique description: Searching for the presence of current or historical steganography software on a system
technique ID: T1057
technique name: Search for indicators of steganography

T1058: Search for mismatched file extensions
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/extension
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/filePath
has reference: Basis Technology (2015), Extension Mismatch Detector Module, https://sleuthkit.org/autopsy/docs/user-docs/3.1/extension_mismatch_detector_page.html
technique description: Checking the content of a file against its file extension to identify mismatches.
technique details: This results in a file path of an identified file, but also highlights the extension that the file has, and the file extension(s) that are expected
technique ID: T1058
technique name: Search for mismatched file extensions

T1059: Identify partitions
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/DiskPartition
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/partitionLength
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/partitionOffset
has example: Hargreaves, Nelson and Casey (2024) provides a dataset with a deleted but recoverable partition that can be used for tool evaluation.
has potential weakness: W1063: Incorrectly parsing the partitions table(s)
has potential weakness: W1064: Making incorrect assumptions about sector size e.g. 512 rather than 4096
has potential weakness: W1065: Failing to correctly parse start sector pointers from partition tables
has potential weakness: W1066: Missing deleted but recoverable partitions from unpartitioned space
has potential weakness: W1067: Failure to check the integrity of partition table (where possible e.g. GPT)
has reference: Carrier, B., 2005. File system forensic analysis. Addison-Wesley Professional.
has reference: Nikkel, B., 2009. Forensic analysis of GPT disks and GUID partition tables. Digital Investigation, 6(1-2), pp.39-47.
has synonym: media management analysis
technique description: Partitions are defined as ‘allocated contiguous sets of sectors from storage media’. This involves recovering the list of partitions that exist on a storage media.
technique details: Partitions schemes include: MBR, GPT, APM. Some schemes such as GPT have records of the partitions in a single area (plus a backup partition table), others such as MBR make use of Extended Partition Tables (EPTs) that are scattered throughout the disk. Partitions can also be deleted but may be recoverable if the start sectors of the volumes contained within them can be identified.
technique ID: T1059
technique name: Identify partitions

T1060: Enumerate allocated files and folders
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Directory
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/accessedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/allocationStatus
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/creationTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/extInodeID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/fileName
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/filePath
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/metadataChangeTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameAccessedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameCreatedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameModifiedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameRecordChangeTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftRecordChangeTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/modifiedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ntfsOwnerID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ntfsOwnerSID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ownerSID
has example: The Sleuth Kit - allows parsing of file system structures
has example: X-Ways Forensics - allows parsing of file system structures
has potential weakness: W1068: Failing to identify the existence of a live file
has potential weakness: W1069: Failing to identify the existence of a live directory
has potential weakness: W1070: Failing to recover the complete contents of a live file
has potential weakness: W1071: Failing to recover a complete listing of a live directory
has potential weakness: W1072: Recovering incorrect contents of a live file
has potential weakness: W1073: Recovering an incorrect listing of a live directory
has potential weakness: W1074: Attributing a file to the wrong directory
has potential weakness: W1075: Presenting a file that does not exist
has potential weakness: W1076: Presenting a directory that does not exist
has potential weakness: W1077: Presenting a deleted file as a live file
has potential weakness: W1078: Presenting a live file as deleted
has potential weakness: W1079: Recovering incorrect metadata about a file
has potential weakness: W1080: Recovering incorrect metadata about a directory
has potential weakness: W1081: Failing to recover file system metadata
has potential weakness: W1082: Recovering file system metadata incorrectly
has potential weakness: W1083: Failure to recover additional specialised file system specific content e.g. Alternate Data Streams
has potential weakness: W1084: Failure to correctly recover specialised file system specific content e.g. Alternate Data Streams
has reference: Carrier, B., 2005. File system forensic analysis. Addison-Wesley Professional.
has reference: Casey, E., Nelson, A. and Hyde, J., 2019. Standardization of file recovery classification and authentication. Digital Investigation, 31, p.100873.
has synonym: file system parsing
technique description: This involves parsing the live file system data structures and reconstructing the file system of the target media or device.
technique ID: T1060
technique name: Enumerate allocated files and folders

T1061: Recover non-allocated files
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/confidence
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Directory
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/accessedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/allocationStatus
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/creationTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/extInodeID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/fileName
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/filePath
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/metadataChangeTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameAccessedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameCreatedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameModifiedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameRecordChangeTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftRecordChangeTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/modifiedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ntfsOwnerID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ntfsOwnerSID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ownerSID
has potential weakness: W1133: Tool fails to express uncertainty in the classification of file recovery results, e.g., where content may be partly overwritten.
has reference: Casey, E., Nelson, A. and Hyde, J., 2019. Standardization of file recovery classification and authentication. Digital Investigation, 31, p.100873.
has subtechnique: T1064: File carving
has subtechnique: T1150: Recover non-allocated files using residual file metadata
has synonym: Deleted data recovery
has synonym: Deleted file recovery
technique description: The recovery of files from non-allocated space
technique ID: T1061
technique name: Recover non-allocated files

T1062: Decryption of encrypted file systems/volumes
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Image
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Volume
has reference: todo
technique description: The process of decrypting an encrypted file system/volume to make its contents accessible for analysis.
technique details: The output of this process will vary depending on the encryption implementation in place. If encryption is at the sector level then it would result in a decrypted forensic image, but if it uses file-based encryption then the process would result in an equivalent volume but with the file content/metadata decrypted.
technique ID: T1062
technique name: Decryption of encrypted file systems/volumes

T1063: Identify file types
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mimeType
has potential weakness: W1129: File type is incorrectly identified
has potential weakness: W1130: Missing assignment of a file type: reporting a file as unknown when it has a known type within the digital forensic science body of knowledge
has potential weakness: W1131: Missing recognition of multiple file types: reporting a file as a limited set of types, or a single type, when it can be interpreted as having more than one, such as a GIF and Java Jar
has reference: Dubettier, A., Gernot, T., Giguet, E. and Rosenberger, C., 2023. File type identification tools for digital investigations. Forensic Science International: Digital Investigation, 46, p.301574.
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
technique description: Applying a process that identifies the types of files.
technique details: This could be via extension, although files may have been renamed, and so this is unreliable, so other means such as examining a file signature or other techniques are used (Dubettier et al 2023)
technique ID: T1063
technique name: Identify file types

T1064: File carving
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/confidence
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/rangeOffset
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/rangeOffsetType
has example: Photorec (Grenier 2023)
has example: foremost
has example: scalpel
has potential weakness: W1103: Failure to carve salvageable content
has potential weakness: W1104: Incorrect carving of a complete file
has potential weakness: W1105: Incorrect reassembly of a file
has potential weakness: W1106: Incorrect attribution of salvaged content to a current file system rather than a previous one
has potential weakness: W1107: Failure to repair a content fragment
has reference: Basis Technology 2025, PhotoRec Carver Module, https://sleuthkit.org/autopsy/docs/user-docs/4.22.0/photorec_carver_page.html
has reference: Grenier (2023) PhotoRec, https://www.cgsecurity.org/wiki/PhotoRec
technique description: The process of recovering files from non-allocated space using only the structural properties of files.
technique details: File carving should result in not just the file content, but the offset in which it was found and the offset base (i.e. the disk, volume, or offset within another file). This approach uses internal files structural information only - if residual file system metadata is used then the complementary technique T1150 is more applicable.
technique ID: T1064
technique name: File carving

T1065: Content indexer examination (OS)
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/fileName
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/filePath
has example: Spotlight
has example: Windows Search
has example: Zeitgeist
has reference: Metz (2011), Windows Search forensics, https://www.forensicfocus.com/articles/windows-search-forensics/
has reference: The Zeitgeist Project (2021) https://zeitgeist.freedesktop.org
technique description: Examine information from operating system artifacts relating to content indexing and search capabilities e.g. Windows Desktop Search
technique details: For example the Windows Search database '...contains vast amount of values about various of artifacts found on a Windows system, e.g. files and directories, emails, appointments, attachments, images, audio and video' (Metz 2011)
technique ID: T1065
technique name: Content indexer examination (OS)

T1066: Log file examination (OS)
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/EventLog
has reference: todo
technique ID: T1066
technique name: Log file examination (OS)

T1067: Cloud synchronisation feature examination (OS)
type: Technique
has reference: todo
technique ID: T1067
technique name: Cloud synchronisation feature examination (OS)

T1068: Recently used file identification (OS)
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/accessedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/filePath
has reference: todo
technique description: The process of examining operating system files to extract artifacts that may indicate file accesses.
technique details: While this technique may result in file paths and timestamps, to evaluate a hypothesis that a file was accessed requires use of T1155 to evaluate if this access occurred, and optionally T1117 if the time of access is relevant.
technique ID: T1068
technique name: Recently used file identification (OS)

T1069: Browser examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/BrowserBookmark
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/BrowserCookie
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/CookieHistory
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/URLHistory
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/URLHistoryEntry
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/URLVisit
has potential weakness: W1113: Misinterpretation a URL located on disk/memory as a web visit
has potential weakness: W1250: Incomplete browser activity extraction due to not considering the browser cache artifacts
has potential weakness: W1251: Incomplete browser activity extraction due to failure to consider multiple profiles
has reference: Digital Detective Knowledgebase https://kb.digital-detective.net/display/BF
has reference: Oh, J., Lee, S. and Lee, S., 2011. Advanced evidence collection and analysis of web browser activity. Digital investigation, 8, pp.S62-S70.
has subtechnique: T1137: Browser history examination
has subtechnique: T1138: Browser cache examination
has subtechnique: T1139: Browser session examination
has subtechnique: T1140: Browser autofill examination
has subtechnique: T1141: Browser bookmarks examination
has subtechnique: T1142: Browser downloads examination
has subtechnique: T1143: Browser configuration examination
has subtechnique: T1144: Browser profile enumeration
has subtechnique: T1145: Browser extensions examination
has subtechnique: T1146: Browser synchronization feature examination
has subtechnique: T1147: Browser cookie examination
has subtechnique: T1148: Browser web storage examination
technique description: Recovery of information left from web browsing activity (derived from Oh et al (2011))
technique details: This may involve: history, cached items, bookmarks, cookies, saved passwords, form data.
technique ID: T1069
technique name: Browser examination

T1070: Email examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/EmailAccount
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/EmailMessage
technique ID: T1070
technique name: Email examination

T1071: Database examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/SQLiteBlob
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/recordFieldName
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/recordFieldValue
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/recordRowID
has example: sqlite-forensic-corpus (2018), https://faui1-files.cs.fau.de/public/sqlite-forensic-corpus/
has potential weakness: W1166: Consideration of live database content only
has potential weakness: W1167: Combining data from multiple tables that should not be joined
has potential weakness: W1168: Data extracted from a table is assigned an incorrect interpretation
has potential weakness: W1169: Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value
has potential weakness: W1170: Failure to recover data stored in Write Ahead Log (WAL) files
has potential weakness: W1171: Failure to recover data stored in database journal files
has reference: Nemetz, S., Schmitt, S. and Freiling, F., 2018. A standardized corpus for SQLite database forensics. Digital Investigation, 24, pp.S121-S130.
has synonym: database forensics
technique description: Examination of a database file(s) to extract information from within
technique ID: T1071
technique name: Database examination

T1072: Chat app examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Message
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/SMSMessage
has potential weakness: W1085: Missing messages from the live set of messages
has potential weakness: W1086: Failing to recover deleted but recoverable messages
has potential weakness: W1087: Presenting a live message that did not exist
has potential weakness: W1088: Presenting a deleted message that did not exist
has potential weakness: W1089: Recovering a live message with incorrect content
has potential weakness: W1090: Recovering a live message with incorrect metadata
has potential weakness: W1091: Recovering a deleted message with incorrect content
has potential weakness: W1092: Recovering a deleted message with incorrect metadata
has potential weakness: W1093: Presenting a deleted message as live
has potential weakness: W1094: Attributing a message to the incorrect sender
has potential weakness: W1095: Attributing a message to the incorrect thread
has potential weakness: W1096: Failing to recover attachments for a live message
has potential weakness: W1097: Failing to recover attachment for a deleted message
has potential weakness: W1098: Assigning incorrect metadata to a message attachment
has potential weakness: W1099: Assigning an attachment to an incorrect messages
has potential weakness: W1100: Failure to display special effects or highlight within a message
has potential weakness: W1101: Failure to recover message edits if available
has potential weakness: W1102: Failure to display that a message had a previous state
has synonym: Messenger app analysis
technique description: Analysis of the files that provide the backing store for a chat or messenger application
technique details: Messenger apps include: iOS Messenger WhatApp Telegram Signal Facebook Messenger …
technique ID: T1072
technique name: Chat app examination

T1073: Calendar app examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Calendar
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/CalendarEntry
technique ID: T1073
technique name: Calendar app examination

T1074: Social network app examination
type: Technique
technique ID: T1074
technique name: Social network app examination

T1075: Maps/travel app examination
type: Technique
technique ID: T1075
technique name: Maps/travel app examination

T1076: Log file examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/eventType
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/EventLog
has example: Examination of setupapi.dev.log
has example: Examination of syslog
has potential weakness: W1228: Log entry missing due to incorrect parsing of logfile
has potential weakness: W1229: Log entry missing due to being stored in archived copies of logs
has potential weakness: W1230: Log entry missing due to rotation size or timing
has potential weakness: W1231: Interpreting log entry absence as evidence of deletion rather than logging configuration
has potential weakness: W1232: Failure to extract log entry timestamp
has potential weakness: W1233: Failure to communicate imprecision in log entry timestamp
has potential weakness: W1234: Event time presented incorrectly due to incorrect timezone handling
has potential weakness: W1235: Failure to extract log entry type
has potential weakness: W1236: Incorrectly interpreting a log entry type based on a different version of the generating software or operating system
technique description: Examination of a file that was designed for incremental logging from a piece of software (e.g. an application or operating system feature)
technique details: These could be in a variety of formats e.g. plain text, JSON, XML, binary, etc.
technique ID: T1076
technique name: Log file examination

T1077: Photos app examination
type: Technique
technique ID: T1077
technique name: Photos app examination

T1078: Cloud sync app examination
type: Technique
technique ID: T1078
technique name: Cloud sync app examination

T1079: Audio content analysis
type: Technique
has reference: todo
technique ID: T1079
technique name: Audio content analysis

T1080: Video content analysis
type: Technique
has reference: todo
has subtechnique: T1106: Deep fake detection (video)
technique ID: T1080
technique name: Video content analysis

T1081: Image content analysis
type: Technique
has reference: todo
technique ID: T1081
technique name: Image content analysis

T1082: Document content analysis
type: Technique
has reference: todo
technique ID: T1082
technique name: Document content analysis

T1083: Memory examination (OS-level)
type: Technique
technique ID: T1083
technique name: Memory examination (OS-level)

T1084: Extraction of user accounts
type: Technique
has reference: todo
technique ID: T1084
technique name: Extraction of user accounts

T1085: Identify conflation
type: Technique
has reference: todo
technique ID: T1085
technique name: Identify conflation

T1086: Timeline analysis
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/Timeline
has CASE output class: https://ontology.solveit-df.org/solveit/observable/TimelineEntry
has example: PyDFT (Hargreaves & Patterson 2012)
has example: TimeSketch (Berggren et al. 2014)
has potential weakness: W1148: Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock
has potential weakness: W1266: Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings
has reference: Berggren at al. (2014) TimeSketch, https://timesketch.org
has reference: Breitinger, F., Studiawan, H. and Hargreaves, C., 2025. SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges.
has reference: Casey, E., 2011. Digital evidence and computer crime: Forensic science, computers, and the internet. Academic press, Section 8.1.2
has reference: Hargreaves, C. and Patterson, J., 2012. An automated timeline reconstruction approach for digital forensic investigations. Digital Investigation, 9, pp.S69-S79.
has subtechnique: T1134: Use time anchors to estimate clock offset
has synonym: Temporal Analysis
technique description: The process of searching, filtering, sorting, highlighting, or aggregating timeline entries to determine which are relevant for event reconstruction, or to identify times of interest (adapted from Breitinger et al. 2025)
technique details: This can involve refinement approaches such as: filtering irrelevant entries, highlighting key entries, or aggregating entries into more meaningful events. This may result in a filtered timeline, or a set of highlighted timeline entries
technique ID: T1086
technique name: Timeline analysis

T1087: Location-based event reconstruction
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/analysis/HypothesisedEvent
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/confidence
has CASE output class: https://ontology.unifiedcyberontology.org/uco/location/Location
technique description: The process of assigning location properties to a reconstructed event
technique ID: T1087
technique name: Location-based event reconstruction

T1088: Relational-based event reconstruction
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/Relationship
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/confidence
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/kindOfRelationship
has reference: Casey, E., 2011. Digital evidence and computer crime: Forensic science, computers, and the internet. Academic press, Section 8.1.3
has synonym: Connection-based event reconstruction
has synonym: Relational analysis
technique description: The process of determining the existence and nature of relationships between entities during event reconstruction
technique ID: T1088
technique name: Relational-based event reconstruction

T1089: Source code review
type: Technique
has reference: todo
technique ID: T1089
technique name: Source code review

T1091: Bookmark artifacts
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/Annotation
has potential weakness: W1155: Bookmark added by examiner is not recorded
has potential weakness: W1156: Bookmark added by examiner is is recorded with incorrect tag/label/category
has synonym: Bookmarking
has synonym: Tagging
technique description: Make a record of selected files or pieces of data so they can be accessed easily, or used for generating automated reports.
technique ID: T1091
technique name: Bookmark artifacts

T1092: Produce tag-based automated report
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/analysis/ForensicToolTagBasedReport
has potential weakness: W1152: Generated report does not include all bookmarks
has potential weakness: W1153: Report generated from bookmarks does not render all content (e.g. previews, string extracts) correctly
has potential weakness: W1154: Report generated from bookmarks stored in manner that does not prevent tampering or corruption
has reference: Basis Technology 2019, Reporting, https://sleuthkit.org/autopsy/docs/user-docs/4.12.0/reporting_page.html
has reference: Basis Technology 2019, Tagging, https://sleuthkit.org/autopsy/docs/user-docs/4.12.0/tagging_page.html
has synonym: Produce bookmark-based automated report
technique description: Generate a report in PDF, HTML or other format that compiles tagged (or bookmarked) items from a case into a package that can be reviewed.
technique ID: T1092
technique name: Produce tag-based automated report

T1093: Write expert report
type: Technique
has CASE output class: https://cacontology.projectvic.org/case-management#ExpertReport
technique ID: T1093
technique name: Write expert report

T1094: Disclosure
type: Technique
has reference: todo
technique ID: T1094
technique name: Disclosure

T1095: Instrumentation
type: Technique
has reference: todo
technique ID: T1095
technique name: Instrumentation

T1096: Run programs identification (OS)
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/execProgramHashes
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/execProgramPath
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/timesExecuted
has reference: todo
technique description: The process of examining operating system files to extract artifacts that may indicate a program has been run.
technique details: While this technique may result in executable or script paths and timestamps, to evaluate a hypothesis that a program was run requires use of T1155 to evaluate if this occurred, and optionally T1117 if the time of access is relevant.
technique ID: T1096
technique name: Run programs identification (OS)

T1097: Installed programs identification (OS)
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Application
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ApplicationVersion
has reference: todo
technique description: Extraction and analysis of information that allows programs installed on an OS to be identified.
technique ID: T1097
technique name: Installed programs identification (OS)

T1098: User account analysis (OS)
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/UserAccount
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/accountType
has reference: todo
technique description: Examination of information related to user account creation and logins
technique ID: T1098
technique name: User account analysis (OS)

T1100: EXIF data extraction
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/exifData
has reference: todo
technique ID: T1100
technique name: EXIF data extraction

T1101: Cell site survey
type: Technique
has reference: Hoy, J., 2023. Forensic radio survey techniques for cell site analysis. John Wiley & Sons.
has reference: Tart, M., Brodie, I., Gleed, N. and Matthews, J., 2012. Historic cell site analysis–Overview of principles and survey methodologies. Digital Investigation, 8(3-4), pp.185-193.
technique description: Taking measurements to assess which cells actually provide service at a specific location (adapted from Tart et al 2012).
technique details: Can involve: spot sample, location survey, area survey, cell survey (Tart et al 2012)
technique ID: T1101
technique name: Cell site survey

T1102: Decode data from image from unmanaged NAND
type: Technique
technique ID: T1102
technique name: Decode data from image from unmanaged NAND

T1103: Virtualise suspect system for previewing
type: Technique
technique description: A suspect disk image can be configured to boot as a virtual machine, which allows screenshots to be taken showing how the user's desktop looked for example.
technique ID: T1103
technique name: Virtualise suspect system for previewing

T1104: Collect data using open source intelligence
type: Technique
technique ID: T1104
technique name: Collect data using open source intelligence

T1106: Deep fake detection (video)
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
has CASE output class: https://ontology.unifiedcyberontology.org/uco/analysis/classificationConfidence
technique ID: T1106
technique name: Deep fake detection (video)

T1107: Health/Fitness app examination
type: Technique
technique ID: T1107
technique name: Health/Fitness app examination

T1108: Reminders app examination
type: Technique
technique ID: T1108
technique name: Reminders app examination

T1109: Payment app examination
type: Technique
technique ID: T1109
technique name: Payment app examination

T1112: Physical disk identification and removal
type: Technique
has CASE input class: https://ontology.unifiedcyberontology.org/uco/observable/Computer
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/StorageMedium
has potential weakness: W1174: Failure to find internal attached storage media
has potential weakness: W1175: Failure to find internal unattached storage media
has potential weakness: W1176: Unable to physically remove/detach internal storage media
technique description: Identifying physical storage media within devices and removing them
technique ID: T1112
technique name: Physical disk identification and removal

T1114: Memory Acquisition via Cold Boot Attack
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Image
has potential weakness: W1032: Not all memory is acquired
has reference: Halderman, J.A., Schoen, S.D., Heninger, N., Clarkson, W., Paul, W., Calandrino, J.A., Feldman, A.J., Appelbaum, J. and Felten, E.W., 2009. Lest we remember: cold-boot attacks on encryption keys. Communications of the ACM, 52(5), pp.91-98.
has synonym: Cold Boot Attack
has synonym: Extracting RAM data using Cold Boot Attack
technique description: Extracting volatile memory (RAM) from a powered-off system by quickly rebooting or transferring the memory module to another system before residual data fades. Cooling the memory modules can significantly slow down data decay, preserving critical data such as encryption keys or passwords.
technique details: An examiner freezes a computer’s RAM by spraying it with liquid nitrogen or even using inverted canned air, then powering off the live system without proper shutdown, and then booting into an external plugged USB, and try capturing the residual RAM content with encryption keys that might still be stored there
technique ID: T1114
technique name: Memory Acquisition via Cold Boot Attack

T1115: Visualisation of geolocation information
type: Technique
has example: Autopsy Geolocation view (Basis Technology 2020)
has example: Magnet Axiom 'World map view' (Magnet 2020)
has reference: Basis Technology 2020, Autopsy User Documentation: Geolocation Overview, https://sleuthkit.org/autopsy/docs/user-docs/4.13.0/geolocation_page.html
has reference: Magnet 2020, Using the Geolocation Data Filter in Magnet AXIOM & AXIOM Cyber, https://www.magnetforensics.com/blog/using-the-geolocation-data-filter-in-magnet-axiom-axiom-cyber/
has reference: Magnet 2024, Moving in the right direction with Animated maps, https://www.magnetforensics.com/blog/moving-in-the-right-direction-with-animated-maps/
technique description: Presenting points or paths visually using extracted data, typically on a map
technique ID: T1115
technique name: Visualisation of geolocation information

T1116: Determine connected devices
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Computer
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Device
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/SmartDevice
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/WearableDevice
has example: ADB connected hosts
has example: USB connected devices
has example: iOS Backups from a computer
has potential weakness: W1011: Suggesting the existence of a device that does not exist
has potential weakness: W1183: Failure to identify the existence of a connected device
has potential weakness: W1184: Presenting devices 'seen' as devices connected
has reference: ALEAPP abd_hots.py, https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/adb_hosts.py
technique description: Examine artifacts and extract indicators of devices that have been connected to the target device.
technique ID: T1116
technique name: Determine connected devices

T1117: Time-based event reconstruction
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/confidence
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/endTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/startTime
has potential weakness: W1148: Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock
has potential weakness: W1149: Failure to consider timestamp inaccuracy at time of inferred event
has potential weakness: W1266: Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings
has synonym: Temporal-based event reconstruction
technique description: The process of assigning a time component to a reconstructed event
technique ID: T1117
technique name: Time-based event reconstruction

T1118: Locate relevant files by path
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has example: Autopsy Interesting Files module
has example: Pattern matching in ALEAPP/iLEAPP to trigger specific plugins
has potential weakness: W1186: Missing files with file name/path-based pattern matching due to renaming
has potential weakness: W1187: Failure to match file name/path pattern due to mismatch of search term used and pattern match engine.
has potential weakness: W1188: Failure to match file name/path pattern due to implementation error in matching engine.
has reference: Autopsy Interesting File module, https://sleuthkit.org/autopsy/docs/user-docs/3.1/interesting_page.html
technique description: Use the path of file name to determine potential relevance of artefact
technique ID: T1118
technique name: Locate relevant files by path

T1120: Automated artifact extraction
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult
has example: Axiom
has example: Hansken
has example: aLEAPP
has example: iLEAPP
has potential weakness: W1189: Artifact extraction is incomplete due to app version changes.
has potential weakness: W1190: Interpretation of app data is incorrect due to app version changes.
has potential weakness: W1258: Failure to present uncertainty associated with automated interpretation of data into artifacts
has synonym: Automated trace extraction
technique description: The use of automation to extract pieces of data that are potentially useful for a digital forensic investigation
technique details: Artifacts extracted may be a direct mapping to lower levels of abstraction e.g. a database field 'message content' may map to an artifact 'message content', but in many cases, automated interpretation is applied where a field such as 'flag' containing numeric values, may be mapped to more meaningful text strings in the extracted artifact.
technique ID: T1120
technique name: Automated artifact extraction

T1121: Keyword indexing
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/KeywordIndex
has CASE output class: https://ontology.solveit-df.org/solveit/observable/KeywordIndexingConfiguration
has potential weakness: W1054: Data not indexed for keyword searching due to text encoding
has potential weakness: W1055: Data not indexed for keyword searching due to missing substring feature
has potential weakness: W1056: Data not indexed for keyword searching due to case sensitivity problem
has potential weakness: W1197: Data not indexed for keyword searching due to compression
has potential weakness: W1198: Data not indexed for keyword searching due to file or content encoding
technique description: Extracting strings from a data source and adding them to an index for subsequent searching
technique ID: T1121
technique name: Keyword indexing

T1122: Keyword search (case-type wordlists)
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResult
has example: Example word lists https://www.dfir.training/downloads/search-terms
has potential weakness: W1057: Relevant keyword results not captured by the case-type keyword list used
has potential weakness: W1059: Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical
technique description: Searching for case-type specific keywords
technique details: This complements case-specific wordlists (T1123) created for the individual case.
technique ID: T1122
technique name: Keyword search (case-type wordlists)

T1123: Keyword search (case-specific wordlists)
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResult
has potential weakness: W1192: Relevant results not captured by the case-specific keywords used
has potential weakness: W1199: Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical
technique description: Searching for case-specific keywords, e.g. people's names, places etc.
technique details: This complements case-type wordlists (T1122) using words typical to specific offenses.
technique ID: T1123
technique name: Keyword search (case-specific wordlists)

T1126: Keyword search (live) (physical)
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResult
has potential weakness: W1193: Keyword results missed since relevant keyword is split over a sector or cluster boundary
has potential weakness: W1194: Keyword results missed since relevant keyword is inside compressed or encoded data
has potential weakness: W1195: Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file
has reference: NIST, 2025. Computer forensics tools & techniques catalog: string search, https://toolcatalog.nist.gov/taxonomy/index.php?ff_id=31
has reference: X-Ways (2025), X-Ways Manual: Simultaneous Search (section 5.10), https://www.x-ways.net/winhex/manual.pdf
has synonym: live search
technique description: Searching for keywords over the raw data on a sector by sector basis
technique ID: T1126
technique name: Keyword search (live) (physical)

T1128: Search for indicators of malware
type: Technique
has synonym: malware scan
has synonym: virus scan
technique description: Searching for the presence of current or historical malware on a system
technique details: This can involve searching for malware itself or other indicators e.g. persistence mechanisms, delivery method etc.
technique ID: T1128
technique name: Search for indicators of malware

T1130: Search for indicators of encrypted data
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Application
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
technique description: Searching for the presence of current or historical encrypted data on a system
technique details: This can include encryption software itself, or encrypted files.
technique ID: T1130
technique name: Search for indicators of encrypted data

T1131: Search for indicators of trail obfuscation
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Application
has reference: Kessler, G.C., 2007. Anti-forensics and the digital investigator.
technique description: Searching for the presence of current or historical trail obfuscation on a system
technique ID: T1131
technique name: Search for indicators of trail obfuscation

T1132: Search for indicators of artifact wiping
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Application
has reference: Kessler, G.C., 2007. Anti-forensics and the digital investigator.
has synonym: artifact scrubbing
technique description: Searching for the presence of current or historical artifact wiping
technique ID: T1132
technique name: Search for indicators of artifact wiping

T1133: AI companion app examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Account
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Call
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Message
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/callType
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/emailAddress
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/messageType
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/phoneNumber
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/receivedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/sentTime
has example: See Hargreaves & Drury (2025)
has potential weakness: W1201: Failure to recover live messages to or from the AI companion app
has potential weakness: W1202: Failure to recover deleted but recoverable messages to or from the AI companion app
has potential weakness: W1203: Presenting a message from the user or AI companion app that did not exist
has potential weakness: W1204: Presenting a deleted message to the AI companion app as a live one, or vice versa
has potential weakness: W1205: Presenting a message to the AI chat app as from the AI companion app, or vice versa
has potential weakness: W1206: Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app
has potential weakness: W1207: Failure to display a message to or from the AI companion app in the context of other messages
has potential weakness: W1208: Failure to recover live images sent to or from the AI companion app
has potential weakness: W1209: Failure to recover deleted but recoverable images sent to or from the AI companion app
has potential weakness: W1210: Presenting an image sent from the user or AI companion app that did not exist
has potential weakness: W1211: Presenting a deleted image sent to the AI companion app as a live one, or vice versa
has potential weakness: W1212: Presenting an image sent to the AI chat app as from the AI companion app, or vice versa
has potential weakness: W1213: Failure to display an image to or from the AI companion app in the context of other messages
has potential weakness: W1214: Failure to recover live records of calls to or from the AI companion app
has potential weakness: W1215: Failure to recover deleted but recoverable records of calls to or from the AI companion app
has potential weakness: W1216: Presenting a call to or from the AI companion app that did not exist
has potential weakness: W1217: Presenting a deleted call to the AI companion app as a live one, or vice versa
has potential weakness: W1218: Presenting a call to the AI companion app as from the AI companion app, or vice versa
has potential weakness: W1219: Failure to recover metadata associated with an interaction with the AI companion app
has potential weakness: W1220: Presenting an incorrect timestamp associated with an interaction with the AI companion app
has potential weakness: W1221: Failure to recover account details from the AI app data
has potential weakness: W1222: Presenting account details that did not exist
has potential weakness: W1223: Live access to the device (for extraction) updates last access times for an account
has potential weakness: W1224: Presenting a deleted account as live, or vice versa
has potential weakness: W1225: Failure to recover relevant app settings
has potential weakness: W1226: Failure to recover relevant AI bot settings
has potential weakness: W1227: Associating a configured bot with the wrong account
has reference: Bayor, L., Weinert, C., Maier, C. and Weitzel, T., 2025. Social-Oriented Communication with AI Companions: Benefits, Costs, and Contextual Patterns. Business & Information Systems Engineering, pp.1-19.
has reference: Hargreaves & Drury, 2025, Forensic Analysis of AI Applications: A Replika "AI Companion" example, WSDF 2025
technique description: The forensic examination of the artifacts describing the configuration or the interaction with an AI companion app or service.
technique details: An AI companion is defined as "a type of generative AI-based conversational agent (CA) explicitly designed for companionship and friendship with a human user (Strohmann et al. 2022; Pentina et al. 2023)" (Bayor et al 2025).
technique ID: T1133
technique name: AI companion app examination

T1137: Browser history examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/URLHistory
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/URLHistoryEntry
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/URLVisit
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/visitTime
has potential weakness: W1108: Failure to recover history resulting from private browsing
has potential weakness: W1109: Incorrect recovery of information regarding a web visit from allocated data
has potential weakness: W1110: Failure to recover browser history from live data
has potential weakness: W1111: Incorrect recovery of information regarding a web visit from non-allocated data
has potential weakness: W1112: Failure to recover browser history from non-allocated data
has potential weakness: W1243: Missing browser history data as it was conducted outside of configured retention period
has potential weakness: W1244: Missing browser history data as it was cleared by user
has potential weakness: W1245: Relying on times stored in browser history that are not representative of exact web page visit time
has potential weakness: W1246: Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database
has synonym: internet history examination
has synonym: web history examination
technique description: The examination of artifacts of webpages visited
technique details: These are typically what are displayed in the address bar, with data typically stored within a locally stored database.
technique ID: T1137
technique name: Browser history examination

T1139: Browser session examination
type: Technique
technique description: The examination of sessions and open tabs and their individual histories
technique ID: T1139
technique name: Browser session examination

T1140: Browser autofill examination
type: Technique
technique description: The examination of data that is stored to autocomplete entries in forms
technique ID: T1140
technique name: Browser autofill examination

T1141: Browser bookmarks examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/BrowserBookmark
has potential weakness: W1247: Attributing saved browser bookmarks to a user but they were bundled with the browser installation
technique description: The examination of the links saved within a browser to facilitate quick access
technique ID: T1141
technique name: Browser bookmarks examination

T1142: Browser downloads examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/URL
has potential weakness: W1248: Missing browser downloads as the files were saved to a non-standard location
technique description: The examination of records of files downloaded with a browser
technique ID: T1142
technique name: Browser downloads examination

T1145: Browser extensions examination
type: Technique
technique description: The examination of the extensions installed within a browser
technique ID: T1145
technique name: Browser extensions examination

T1146: Browser synchronization feature examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
technique description: The examination of the settings and artifacts resulting from a browser synchronization feature
technique ID: T1146
technique name: Browser synchronization feature examination

T1147: Browser cookie examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/BrowserCookie
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/CookieHistory
technique description: The examination of stored browser cookies
technique ID: T1147
technique name: Browser cookie examination

T1148: Browser web storage examination
type: Technique
has reference: Mendoza, A., Kumar, A., Midcap, D., Cho, H. and Varol, C., 2015. BrowStEx: A tool to aggregate browser storage artifacts for forensic analysis. Digital investigation, 14, pp.63-75.
has synonym: HTML5 storage examination
has synonym: browser storage examination
has synonym: local storage examination
has synonym: web storage examination
technique description: The examination of
technique details: Web storage is a browser-based API bundled in HTML5 specifications that allow persistent client-side storage for web applications. (Mendoza 2015)
technique ID: T1148
technique name: Browser web storage examination

T1149: File versioning feature examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/modifiedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/version
has example: MacOS "Revert to" feature
has example: Volume Shadow Service (VSS)
has reference: Apple (2025) View and restore past versions of documents on Mac https://support.apple.com/en-gb/guide/mac-help/mh40710/mac
has reference: Hargreaves, C., Chivers, H. and Titheridge, D., 2008. Windows Vista and digital investigations. Digital Investigation, 5(1-2), pp.34-48.
has reference: Leschke, T.R. and Nicholas, C., 2013, October. Change-link 2.0: a digital forensic tool for visualizing changes to shadow volume data. In Proceedings of the Tenth Workshop on Visualization for Cyber Security (pp. 17-24).
has reference: Sreeja, S.C. and Balan, C., 2016, October. Forensic analysis of volume shadow copy in windows 7. In 2016 International Conference on Emerging Technological Trends (ICETT) (pp. 1-6). IEEE.
has synonym: 'Revert to...' feature examination
has synonym: macOS 'Versions' examination
has synonym: previous versions
has synonym: shadow copy examination
technique description: Extraction of data from the versioning system used by an operating system to store older versions of files.
technique details: Operating systems often maintain versioning systems that preserve older versions of files, either for backup purposes or to enable users to restore previous states. These systems create snapshots or shadow copies at regular intervals or when significant changes occur. Digital forensic examination of these versioning features can reveal files that have been modified or deleted, providing valuable evidence of system activity and user behavior. The examination process involves identifying the versioning mechanism used by the operating system, locating the stored versions, and extracting relevant data for analysis.
technique ID: T1149
technique name: File versioning feature examination

T1150: Recover non-allocated files using residual file metadata
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/confidence
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Directory
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/accessedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/allocationStatus
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/creationTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/extInodeID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/fileName
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/filePath
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/metadataChangeTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameAccessedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameCreatedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameModifiedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftFileNameRecordChangeTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/mftRecordChangeTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/modifiedTime
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ntfsOwnerID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ntfsOwnerSID
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ownerSID
has potential weakness: W1134: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected
has potential weakness: W1135: Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected
has potential weakness: W1253: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information
has potential weakness: W1254: Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information
has potential weakness: W1255: Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL)
has potential weakness: W1256: Incorrect attribution of metadata to file content that was the result of 'file tunnelling'
has reference: Carrier, B., 2005. File system forensic analysis. Addison-Wesley Professional.
has reference: Casey, E., Nelson, A. and Hyde, J., 2019. Standardization of file recovery classification and authentication. Digital Investigation, 31, p.100873.
technique description: Use metadata that remains in the file system to recover non-allocated files
technique ID: T1150
technique name: Recover non-allocated files using residual file metadata

T1151: Keyword search (over extracted artifacts)
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResult
has example: Using Keywords with Magnet AXIOM (McQuaid 2017)
has potential weakness: W1257: Missing content that is relevant to a keyword search but it has not been extracted as 'artifacts'
has reference: McQuaid, J. (2017) Using Keywords with Magnet AXIOM, Magnet Forensics, https://www.magnetforensics.com/blog/using-keywords-with-magnet-axiom/
has synonym: search artifacts only
technique description: Keyword searching only applied over extracted artifacts
technique details: This limited scope search may be performed within tools themselves e.g. McQuaid (2017), or within an exported packaged report.
technique ID: T1151
technique name: Keyword search (over extracted artifacts)

T1154: Identity-based event reconstruction
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/confidence
has CASE output class: https://ontology.unifiedcyberontology.org/uco/identity/Person
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Account
has reference: Casey, E. and Jaquet-Chiffelle, D.O., 2019. Do identities matter?. Policing: A Journal of Policy and Practice, 13(1), pp.21-34.
has reference: Spichiger, H., 2025. Please mind the gap: A taxonomy for addressing the issue of linking person, account and device. Science & Justice, p.101314.
has synonym: Resolving the person-account gap,
has synonym: Resolving the person-device gap
technique description: The process of attempting to link an identity (account, person etc.) to a reconstructed event
technique ID: T1154
technique name: Identity-based event reconstruction

T1155: Operation-based event reconstruction
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/confidence
has synonym: Action-based event reconstruction
has synonym: Activity-based event reconstruction
technique description: The process of reconstructing that an operation occurred on a digital system
technique details: While some event reconstruction needs a time component, there are some questions that are simply explaining what happened, or if something happened. The time component may need to investigated later, or may be learned as a byproduct of reconstructing the event, but isn't intrinsic to the question being asked. e.g. Was this file opened? How many times was this file opened? What data has been exfiltrated?
technique ID: T1155
technique name: Operation-based event reconstruction

T1156: Functional-based event reconstruction
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
has CASE output class: https://ontology.unifiedcyberontology.org/uco/configuration/dependencies
has CASE output class: https://ontology.unifiedcyberontology.org/uco/core/confidence
technique description: Reconstructing the configuration or capabilities of a system at the time of an event
technique details: Considering how a system works and what conditions were necessary for an event to be possible, i.e. supporting or refuting if a hypothesis is feasible. This might involve questions such as: - is a program or system capable of performing some action - how was the program or system configured (to determine if an operation was possible)
technique ID: T1156
technique name: Functional-based event reconstruction

T1157: Extract device data using exposed service
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Call
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Contact
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/SMSMessage
has example: Android Debug Bridge (ADB) provides command line access when USB debugging is enabled on Android devices
has example: Extraction of data by querying Content Providers on Android (via ADB)
has example: Extraction of data using AFC on iOS
has example: Media Transfer Protocol (MTP)
has potential weakness: W1037: Presenting data as complete, that is in reality a partial set
has potential weakness: W1040: Not considering SD Card acquisition in addition to other extractions performed
has potential weakness: W1041: Not considering file system acquisition as alternative
has potential weakness: W1271: Inability to access required service as it is not enabled
has potential weakness: W1272: Failure to preserve all relevant timestamps of files obtained using exposed services on a device
has potential weakness: W1273: Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device
has subtechnique: T1019: Mobile backup extraction
technique description: Use an exposed service on a device to extract data. This represents several of the mobile data extraction methods e.g. Query content providers (android), AFC (iOS).
technique ID: T1157
technique name: Extract device data using exposed service

T1159: Extract mobile data via deployed agent
type: Technique
has example: Belkasoft
has example: Elcomsoft
has potential weakness: W1276: Relevant data is overwritten by deploying an agent to a mobile device
has reference: Belkasoft https://belkasoft.com/agent_based_ios_acquisition
has reference: Elcomsoft 20203 https://blog.elcomsoft.com/2023/07/ios-device-acquisition-installing-the-extraction-agent/
technique description: Deploy software to a mobile device that can carry out some function, either collect data with available permissions or attempt further exploitation e.g. sandbox escape.
technique details: While Android agents can be sideloaded with adb, deploying agents on iOS may require a developer account. Output may be equivalent of a file system acquisition if an exploit is successful. Otherwise data such as contacts would be extracted.
technique ID: T1159
technique name: Extract mobile data via deployed agent

T1160: Collect data with 'cloud backup restore' approach
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/SmartDevice
has reference: Geus, J., Gruber, J., Wozar, J. and Freiling, F., 2025. From sync to seizure: A binary instrumentation-based evaluation of the iCloud backup process. Forensic Science International: Digital Investigation, 54, p.301978.
technique description: Restore a device's cloud backup to a donor device, then subsequently use a local acquisition approach on that donor device, e.g. T1019/T1020
technique ID: T1160
technique name: Collect data with 'cloud backup restore' approach

T1162: Read data from a device via In-System Programming (ISP)
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Image
has reference: https://en.wikipedia.org/wiki/In-system_programming
has subtechnique: T1027: Data read using JTAG
has synonym: ISCP
has synonym: In-circuit serial Programming
technique ID: T1162
technique name: Read data from a device via In-System Programming (ISP)

T1163: Automated screenshot-based capture of a mobile device
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/DeviceScreenshot
has reference: https://github.com/prosch88/ALEX
has reference: https://github.com/prosch88/UFADE
technique description: Programmatically controlling a mobile device while capturing screenshots of the display.
technique ID: T1163
technique name: Automated screenshot-based capture of a mobile device

W1001: Excluding a device that contains relevant information
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1001
weakness name: Excluding a device that contains relevant information

W1002: Use of triage technology results in changes to the target media
type: Weakness
has potential mitigation: M1007: Use hardware write blocker
has potential mitigation: M1008: Use software write blocker
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1002
weakness name: Use of triage technology results in changes to the target media

W1003: Triage tool applies a simplification that does not correctly represent the meaning of the digital data
type: Weakness
has potential mitigation: M1001: Review of all triage results that are relied on during the full digital forensic examination
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1003
weakness name: Triage tool applies a simplification that does not correctly represent the meaning of the digital data

W1004: Acquisition does not include all sectors from LBA0 to LBA max
type: Weakness
has potential mitigation: M1003: Check image size corresponds with drive label
has potential mitigation: M1004: Check hash of image matches hash of source device
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1004
weakness name: Acquisition does not include all sectors from LBA0 to LBA max

W1005: Dogs fail to find a digital device
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1005
weakness name: Dogs fail to find a digital device

W1006: Acquistion does not include data in HPA
type: Weakness
has potential mitigation: M1005: Testing to ensure software and hardware setup detects HPAs
has reference: Gupta, M.R., Hoeschele, M.D. and Rogers, M.K., 2006. Hidden disk areas: HPA and DCO. International Journal of Digital Evidence, 5(1), pp.1-8.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1006
weakness name: Acquistion does not include data in HPA

W1007: Acquistion does not include data in DCO
type: Weakness
has potential mitigation: M1006: Testing to ensure software and hardware setup detects DCOs
has reference: Gupta, M.R., Hoeschele, M.D. and Rogers, M.K., 2006. Hidden disk areas: HPA and DCO. International Journal of Digital Evidence, 5(1), pp.1-8.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1007
weakness name: Acquistion does not include data in DCO

W1008: Missing the existence of a device by missing synchronisation artefacts
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1057: Testing of parsing of syncronisation artefacts
has potential mitigation: M1059: Ongoing research and documentation of syncronisation artefacts
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1008
weakness name: Missing the existence of a device by missing synchronisation artefacts

W1009: Missing the existence of a device by incorrectly parsing synchronisation artefacts
type: Weakness
has potential mitigation: M1057: Testing of parsing of syncronisation artefacts
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1009
weakness name: Missing the existence of a device by incorrectly parsing synchronisation artefacts

W1010: Misattributing activity to the wrong device
type: Weakness
has potential mitigation: M1058: Checking for other confirmatory indicators of the inferred device's existence.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1010
weakness name: Misattributing activity to the wrong device

W1012: Interaction with the target devices to read synronisation artefacts causes changes
type: Weakness
has potential mitigation: M1007: Use hardware write blocker
has potential mitigation: M1008: Use software write blocker
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1012
weakness name: Interaction with the target devices to read synronisation artefacts causes changes

W1013: Acquisition includes extra bytes
type: Weakness
has potential mitigation: M1003: Check image size corresponds with drive label
has potential mitigation: M1004: Check hash of image matches hash of source device
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1013
weakness name: Acquisition includes extra bytes

W1014: Imaging process changes original data
type: Weakness
has potential mitigation: M1007: Use hardware write blocker
has potential mitigation: M1008: Use software write blocker
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1014
weakness name: Imaging process changes original data

W1015: Powering on SSD results in sectors being wiped by TRIM operation
type: Weakness
has reference: DSTL Digital Forensics Bulletin, TRIM & Garbage Collection on SSDs, Edition 27, July 2024 DSTL/PUB160897, https://mailchi.mp/3b5bda81ff5f/digital-forensic-bulletin-edition27-trim-and-garbage-collection-on-ssds9445401
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1015
weakness name: Powering on SSD results in sectors being wiped by TRIM operation

W1016: Data copied from sectors on source device are stored incorrectly
type: Weakness
has potential mitigation: M1004: Check hash of image matches hash of source device
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1016
weakness name: Data copied from sectors on source device are stored incorrectly

W1017: Files or data that is relevant to the investigation is missed
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1017
weakness name: Files or data that is relevant to the investigation is missed

W1018: Data is collected that is not relevant to the investigation
type: Weakness
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1018
weakness name: Data is collected that is not relevant to the investigation

W1019: Data is collected and assigned to incorrect device
type: Weakness
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1019
weakness name: Data is collected and assigned to incorrect device

W1020: Content of data collected is incorrect
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1020
weakness name: Content of data collected is incorrect

W1021: Metadata of data collected is missing
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1021
weakness name: Metadata of data collected is missing

W1022: Metadata of data collected is incorrect
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1022
weakness name: Metadata of data collected is incorrect

W1023: Collection process changes content of data on target
type: Weakness
has potential mitigation: M1007: Use hardware write blocker
has potential mitigation: M1008: Use software write blocker
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1023
weakness name: Collection process changes content of data on target

W1024: Collection process changes metadata of data on target
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1024
weakness name: Collection process changes metadata of data on target

W1025: Data relevant to the case is excluded as part of the filtering process
type: Weakness
has potential mitigation: M1010: Perform full extraction instead of selective
has potential mitigation: M1011: Perform full extraction instead of selective, followed by partial processing
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1025
weakness name: Data relevant to the case is excluded as part of the filtering process

W1026: Selective extraction of a backup implies partial collection when it is in reality a full collection followed by deletion.
type: Weakness
has potential mitigation: M1012: Clear presentation of the backup and deletion process
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1026
weakness name: Selective extraction of a backup implies partial collection when it is in reality a full collection followed by deletion.

W1027: Including data that was meant to be excluded with the selected filters
type: Weakness
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1027
weakness name: Including data that was meant to be excluded with the selected filters

W1028: Due to the use of time based filters data extracted may be presented out of context
type: Weakness
has potential mitigation: M1010: Perform full extraction instead of selective
has potential mitigation: M1011: Perform full extraction instead of selective, followed by partial processing
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1028
weakness name: Due to the use of time based filters data extracted may be presented out of context

W1029: Memory smearing may result in pointers being inconsistent within the memory image
type: Weakness
has potential mitigation: M1086: Acquire the parts of memory with interconnected data first, before proceeding with a sequential acquisition.
has potential mitigation: mitigationM1088
has reference: Jenny Ottmann, Üsame Cengiz, Frank Breitinger, and Felix Freiling, 2023. As if Time Had Stopped – Checking Memory Dumps for Quasi-Instantaneous Consistency. In Proceedings of the Digital Forensics Research Conference USA (DFRWS USA), Baltimore, MD, July 2023.
has reference: Ottmann, J., Breitinger, F. and Freiling, F., 2024. An experimental assessment of inconsistencies in memory forensics. ACM Transactions on Privacy and Security (TOPS). 27, 2:1–2:29.
has reference: Pagani, F., Fedorov, O. and Balzarotti, D., 2019. Introducing the temporal dimension to memory forensics. ACM Transactions on Privacy and Security (TOPS), 22(2), 1-21.
has reference: Rzepka, L., Ottmann, J., Freiling, F. and Baier, H., 2024. Causal Inconsistencies are Normal in Windows Memory Dumps (too). Digital Threats: Research and Practice.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1029
weakness name: Memory smearing may result in pointers being inconsistent within the memory image

W1030: Loading a memory imaging tool makes changes to the data in memory that is being acquired
type: Weakness
has potential mitigation: M1087: Acquire memory from outside of the target system for example using direct memory access (DMA) devices
has reference: Campbell, W., 2013. Volatile memory acquisition tools–A comparison across taint and correctness. 11th Australian Digital Forensics Conference. Edith Cowan University, Perth, Western Australia.
has reference: Gruhn, M. and Freiling, F.C., 2016. Evaluating atomicity, and integrity of correct memory acquisition methods. Digital Investigation, 16, S1-S10.
has reference: Vömel, S. and Stüttgen, J., 2013. An evaluation platform for forensic memory acquisition software. Digital Investigation, 10, S30-S40.
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1030
weakness name: Loading a memory imaging tool makes changes to the data in memory that is being acquired

W1031: Loading a memory imaging tool overwrites relevant data within memory
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1031
weakness name: Loading a memory imaging tool overwrites relevant data within memory

W1033: Data referenced in memory is located within pagefile or swapfile but is not collected
type: Weakness
has reference: Case, A. and Richard III, G. G., 2017. Memory forensics: The path forward. Digital investigation, 20, 23-33.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1033
weakness name: Data referenced in memory is located within pagefile or swapfile but is not collected

W1034: Missing data from the live system due to compromised machine (e.g. rootkit)
type: Weakness
has potential mitigation: M1013: Consider memory acquisition and offline analysis instead
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1034
weakness name: Missing data from the live system due to compromised machine (e.g. rootkit)

W1035: Collecting incorrect information from live system due to compromised machine (e.g. rootkit)
type: Weakness
has potential mitigation: M1013: Consider memory acquisition and offline analysis instead
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: true
may result in INAC EX: true
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1035
weakness name: Collecting incorrect information from live system due to compromised machine (e.g. rootkit)

W1036: Overwriting relevant data with changes caused by running the live tools
type: Weakness
has potential mitigation: M1014: Test and document changes made by the tools used
has potential mitigation: M1015: Use tools only if changes made are to locations where relevant evidence is unlikely to be located.
has reference: Hargreaves, C.J., 2009. Assessing the reliability of digital evidence from live investigations involving encryption. Chapter 5
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1036
weakness name: Overwriting relevant data with changes caused by running the live tools

W1038: Backup process returns an incomplete set of backup data
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1038
weakness name: Backup process returns an incomplete set of backup data

W1039: Backup data collection overwrites important data
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1039
weakness name: Backup data collection overwrites important data

W1042: Disk image was tampered with, but manipulated to have a collision with original hash
type: Weakness
has potential mitigation: M1021: Verify the disk image integrity with multiple hash algorithms e.g. MD5 and SHA1 (Kessler 2016)
has potential mitigation: M1022: Restrict access to stored disk images
has potential mitigation: M1023: Ensure and check logs of access to stored disk images
has potential mitigation: M1070: Ensure hash algorithm(s) used are resistant to collisions through data manipulation
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1042
weakness name: Disk image was tampered with, but manipulated to have a collision with original hash

W1043: Data is written to forensic format that does not preserve the original raw data
type: Weakness
has potential mitigation: M1009: Check hash of image matches hash of source material
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1043
weakness name: Data is written to forensic format that does not preserve the original raw data

W1044: Failing to extract a decryption key that is present
type: Weakness
has potential mitigation: M1025: Validation & testing against the encryption system under consideration
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1044
weakness name: Failing to extract a decryption key that is present

W1045: Extracting an incorrect decryption key
type: Weakness
has potential mitigation: M1024: Validate extracted key against the encrypted material before powering off the machine from which the key was extracted (e.g. Hargreaves & Chivers 2008b)
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1045
weakness name: Extracting an incorrect decryption key

W1046: File not recovered from the stored backup
type: Weakness
has potential mitigation: M1026: Testing of backup parsing method
has potential mitigation: M1027: Dual tool verification
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1046
weakness name: File not recovered from the stored backup

W1047: File recovered from backup that did not exist
type: Weakness
has potential mitigation: M1026: Testing of backup parsing method
has potential mitigation: M1027: Dual tool verification
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1047
weakness name: File recovered from backup that did not exist

W1048: File recovered from backup but presented in the wrong location
type: Weakness
has potential mitigation: M1026: Testing of backup parsing method
has potential mitigation: M1027: Dual tool verification
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1048
weakness name: File recovered from backup but presented in the wrong location

W1049: File content recovered incorrectly from backup
type: Weakness
has potential mitigation: M1026: Testing of backup parsing method
has potential mitigation: M1027: Dual tool verification
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1049
weakness name: File content recovered incorrectly from backup

W1050: Failure to highlight that there are other apps present for which data is not available
type: Weakness
has potential mitigation: M1028: Parse app lists if available and highlight missing data
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1050
weakness name: Failure to highlight that there are other apps present for which data is not available

W1051: Failure to highlight that not all app data may be present in a backup
type: Weakness
has potential mitigation: M1028: Parse app lists if available and highlight missing data
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1051
weakness name: Failure to highlight that not all app data may be present in a backup

W1052: Incorrect retrieval of results from an index
type: Weakness
has potential mitigation: M1030: Testing of retrieval of indexed content
has potential mitigation: M1034: Comparison of index results with live search results
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1052
weakness name: Incorrect retrieval of results from an index

W1053: Incorrect parsing of a supplied regular expression used for keyword searching
type: Weakness
has potential mitigation: M1035: Verification against second tool with known different regex implementation
has potential mitigation: M1036: Testing of regular expression component of tool
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1053
weakness name: Incorrect parsing of a supplied regular expression used for keyword searching

W1054: Data not indexed for keyword searching due to text encoding
type: Weakness
has potential mitigation: M1029: Testing of keyword indexing component of tool
has potential mitigation: M1034: Comparison of index results with live search results
has potential mitigation: M1146: Ensure keyword indexing settings capture text encodings required during indexing
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1054
weakness name: Data not indexed for keyword searching due to text encoding

W1055: Data not indexed for keyword searching due to missing substring feature
type: Weakness
has potential mitigation: M1029: Testing of keyword indexing component of tool
has potential mitigation: M1034: Comparison of index results with live search results
has potential mitigation: M1147: Ensure keyword indexing settings configure text substring handling as required during indexing
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1055
weakness name: Data not indexed for keyword searching due to missing substring feature

W1056: Data not indexed for keyword searching due to case sensitivity problem
type: Weakness
has potential mitigation: M1029: Testing of keyword indexing component of tool
has potential mitigation: M1034: Comparison of index results with live search results
has potential mitigation: M1148: Ensure keyword indexing settings configure case sensitivity for indexing as required
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1056
weakness name: Data not indexed for keyword searching due to case sensitivity problem

W1057: Relevant keyword results not captured by the case-type keyword list used
type: Weakness
has potential mitigation: M1031: Also using synonyms for terms used
has potential mitigation: M1032: Evaluation of the effectiveness of wordlist used for case-type searching
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1057
weakness name: Relevant keyword results not captured by the case-type keyword list used

W1058: Results appear in an ‘artefact’ or ‘result’ but the context, source or provenance of result is unclear
type: Weakness
has potential mitigation: M1037: The context of relevant keyword results are manually checked
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1058
weakness name: Results appear in an ‘artefact’ or ‘result’ but the context, source or provenance of result is unclear

W1060: A relevant piece of media was not flagged as relevant
type: Weakness
has potential mitigation: M1039: Hash matching to reduce need for manual review
has potential mitigation: M1040: Use of AI to flag potentially relevant content to reduce need for manual review
has potential mitigation: M1041: Regular breaks to minimise investigator fatigue
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1060
weakness name: A relevant piece of media was not flagged as relevant

W1061: An irrelevant piece of media was flagged as relevant
type: Weakness
has potential mitigation: M1039: Hash matching to reduce need for manual review
has potential mitigation: M1040: Use of AI to flag potentially relevant content to reduce need for manual review
has potential mitigation: M1041: Regular breaks to minimise investigator fatigue
has potential mitigation: M1042: Secondary review of flagged items to ensure relevance
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1061
weakness name: An irrelevant piece of media was flagged as relevant

W1062: The grade or specific tag given to item is incorrect
type: Weakness
has potential mitigation: M1039: Hash matching to reduce need for manual review
has potential mitigation: M1040: Use of AI to flag potentially relevant content to reduce need for manual review
has potential mitigation: M1041: Regular breaks to minimise investigator fatigue
has potential mitigation: M1042: Secondary review of flagged items to ensure relevance
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1062
weakness name: The grade or specific tag given to item is incorrect

W1063: Incorrectly parsing the partitions table(s)
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1047: Testing partition table parsing on standard and non-standard configurations
has potential mitigation: M1050: Manual verification of relevant data
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1063
weakness name: Incorrectly parsing the partitions table(s)

W1064: Making incorrect assumptions about sector size e.g. 512 rather than 4096
type: Weakness
has potential mitigation: M1045: Explicitly detect sector size in use
has potential mitigation: M1046: Check pointer offsets for both 512 and 4096 sectors sizes
has reference: V, Kethareswaran; Khurana, Surinder Singh; Singh, Parvinder (2021), “File Carving based Digital Forensic Tools Testing Data Sets (Contiguous Files)”, Mendeley Data, V3, doi: 10.17632/2kh2bdsp5b.3
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1064
weakness name: Making incorrect assumptions about sector size e.g. 512 rather than 4096

W1065: Failing to correctly parse start sector pointers from partition tables
type: Weakness
has potential mitigation: M1047: Testing partition table parsing on standard and non-standard configurations
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1065
weakness name: Failing to correctly parse start sector pointers from partition tables

W1066: Missing deleted but recoverable partitions from unpartitioned space
type: Weakness
has potential mitigation: M1043: Scan for orphaned EPTs
has potential mitigation: M1044: Scan for Volume Boot Records in unpartitioned space
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
has reference: Hargreaves, C., Repository for 'An abstract model for digital forensic analysis tools - A foundation for systematic error mitigation analysis', https://github.com/chrishargreaves/digital-forensic-tool-abstractions/tree/main
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1066
weakness name: Missing deleted but recoverable partitions from unpartitioned space

W1067: Failure to check the integrity of partition table (where possible e.g. GPT)
type: Weakness
has potential mitigation: M1048: Check built-in integrity checks of partition tables where possible
has potential mitigation: M1049: Check consistency between primary and backup partition tables (where possible)
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1067
weakness name: Failure to check the integrity of partition table (where possible e.g. GPT)

W1068: Failing to identify the existence of a live file
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1068
weakness name: Failing to identify the existence of a live file

W1069: Failing to identify the existence of a live directory
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1069
weakness name: Failing to identify the existence of a live directory

W1070: Failing to recover the complete contents of a live file
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1070
weakness name: Failing to recover the complete contents of a live file

W1071: Failing to recover a complete listing of a live directory
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1071
weakness name: Failing to recover a complete listing of a live directory

W1072: Recovering incorrect contents of a live file
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1072
weakness name: Recovering incorrect contents of a live file

W1073: Recovering an incorrect listing of a live directory
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1073
weakness name: Recovering an incorrect listing of a live directory

W1074: Attributing a file to the wrong directory
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1074
weakness name: Attributing a file to the wrong directory

W1075: Presenting a file that does not exist
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1075
weakness name: Presenting a file that does not exist

W1076: Presenting a directory that does not exist
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1076
weakness name: Presenting a directory that does not exist

W1077: Presenting a deleted file as a live file
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1077
weakness name: Presenting a deleted file as a live file

W1078: Presenting a live file as deleted
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1078
weakness name: Presenting a live file as deleted

W1079: Recovering incorrect metadata about a file
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1079
weakness name: Recovering incorrect metadata about a file

W1080: Recovering incorrect metadata about a directory
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1080
weakness name: Recovering incorrect metadata about a directory

W1081: Failing to recover file system metadata
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1081
weakness name: Failing to recover file system metadata

W1082: Recovering file system metadata incorrectly
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1082
weakness name: Recovering file system metadata incorrectly

W1083: Failure to recover additional specialised file system specific content e.g. Alternate Data Streams
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1083
weakness name: Failure to recover additional specialised file system specific content e.g. Alternate Data Streams

W1084: Failure to correctly recover specialised file system specific content e.g. Alternate Data Streams
type: Weakness
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1051: Validation of specific file system parsing operation for the file system under consideration
has potential mitigation: M1052: Use of a second independent tool to compare live file system listing
has potential mitigation: M1053: Verification of the file system specification used as the basis for the tool development
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1084
weakness name: Failure to correctly recover specialised file system specific content e.g. Alternate Data Streams

W1085: Missing messages from the live set of messages
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1054: Testing of message extraction and parsing features
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1056: Correlation of message data from third party data (another participant in message thread)
has reference: New msgstore – Who ‘Dis? A Look At An Updated WhatsApp On Android, https://thebinaryhick.blog/2022/06/09/new-msgstore-who-dis-a-look-at-an-updated-whatsapp-on-android/
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1085
weakness name: Missing messages from the live set of messages

W1086: Failing to recover deleted but recoverable messages
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1054: Testing of message extraction and parsing features
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1056: Correlation of message data from third party data (another participant in message thread)
has potential mitigation: M1077: Ensure potential secondary locations for stored message content are reviewed.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1086
weakness name: Failing to recover deleted but recoverable messages

W1087: Presenting a live message that did not exist
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1087
weakness name: Presenting a live message that did not exist

W1088: Presenting a deleted message that did not exist
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1088
weakness name: Presenting a deleted message that did not exist

W1089: Recovering a live message with incorrect content
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1056: Correlation of message data from third party data (another participant in message thread)
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1089
weakness name: Recovering a live message with incorrect content

W1090: Recovering a live message with incorrect metadata
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1056: Correlation of message data from third party data (another participant in message thread)
has reference: Time is not on our side when it comes to Messages in iOS 11, https://smarterforensics.com/2017/09/time-is-not-on-our-side-when-it-comes-to-messages-in-ios-11/
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1090
weakness name: Recovering a live message with incorrect metadata

W1091: Recovering a deleted message with incorrect content
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1056: Correlation of message data from third party data (another participant in message thread)
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1091
weakness name: Recovering a deleted message with incorrect content

W1092: Recovering a deleted message with incorrect metadata
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1056: Correlation of message data from third party data (another participant in message thread)
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1092
weakness name: Recovering a deleted message with incorrect metadata

W1093: Presenting a deleted message as live
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1093
weakness name: Presenting a deleted message as live

W1094: Attributing a message to the incorrect sender
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1094
weakness name: Attributing a message to the incorrect sender

W1095: Attributing a message to the incorrect thread
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1095
weakness name: Attributing a message to the incorrect thread

W1096: Failing to recover attachments for a live message
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1054: Testing of message extraction and parsing features
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1056: Correlation of message data from third party data (another participant in message thread)
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1096
weakness name: Failing to recover attachments for a live message

W1097: Failing to recover attachment for a deleted message
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1054: Testing of message extraction and parsing features
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1056: Correlation of message data from third party data (another participant in message thread)
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1097
weakness name: Failing to recover attachment for a deleted message

W1098: Assigning incorrect metadata to a message attachment
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1098
weakness name: Assigning incorrect metadata to a message attachment

W1099: Assigning an attachment to an incorrect messages
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1099
weakness name: Assigning an attachment to an incorrect messages

W1100: Failure to display special effects or highlight within a message
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1100
weakness name: Failure to display special effects or highlight within a message

W1101: Failure to recover message edits if available
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1101
weakness name: Failure to recover message edits if available

W1102: Failure to display that a message had a previous state
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1054: Testing of message extraction and parsing features
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: true
weakness ID: W1102
weakness name: Failure to display that a message had a previous state

W1103: Failure to carve salvageable content
type: Weakness
has potential mitigation: M1078: Use of multiple carving tools and comparing results
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1103
weakness name: Failure to carve salvageable content

W1104: Incorrect carving of a complete file
type: Weakness
has potential mitigation: M1062: Verify semantic integrity of carved content using manual inspection of relevant data
has potential mitigation: M1063: Verify semantic integrity of carved content using an automated tool
has potential mitigation: M1064: Verify that salvaged content is renderable using visual inspection of displayed/rendered content
has potential mitigation: M1090: Compare carved results against known files (e.g. from another source)
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1104
weakness name: Incorrect carving of a complete file

W1105: Incorrect reassembly of a file
type: Weakness
has potential mitigation: M1062: Verify semantic integrity of carved content using manual inspection of relevant data
has potential mitigation: M1063: Verify semantic integrity of carved content using an automated tool
has potential mitigation: M1064: Verify that salvaged content is renderable using visual inspection of displayed/rendered content
has potential mitigation: M1090: Compare carved results against known files (e.g. from another source)
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1105
weakness name: Incorrect reassembly of a file

W1106: Incorrect attribution of salvaged content to a current file system rather than a previous one
type: Weakness
has potential mitigation: M1061: Use digital stratigraphy to attempt to attribute data within a specific file system
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1106
weakness name: Incorrect attribution of salvaged content to a current file system rather than a previous one

W1107: Failure to repair a content fragment
type: Weakness
has potential mitigation: M1060: Repair salvaged content by grafting different reference data onto fragment(s)
has potential mitigation: mitigationM1065
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1107
weakness name: Failure to repair a content fragment

W1108: Failure to recover history resulting from private browsing
type: Weakness
has potential mitigation: M1066: Attempt to reconstruct browser activity from other areas of disk
has potential mitigation: M1067: Analyze web browser memory for web browsing activity
has reference: Horsman, G., 2020. The challenge of identifying historic ‘private browsing’sessions on suspect devices. Forensic Science International: Digital Investigation, 34, p.300980.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1108
weakness name: Failure to recover history resulting from private browsing

W1109: Incorrect recovery of information regarding a web visit from allocated data
type: Weakness
may result in INAC ALT: true
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1109
weakness name: Incorrect recovery of information regarding a web visit from allocated data

W1110: Failure to recover browser history from live data
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1110
weakness name: Failure to recover browser history from live data

W1111: Incorrect recovery of information regarding a web visit from non-allocated data
type: Weakness
may result in INAC ALT: true
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1111
weakness name: Incorrect recovery of information regarding a web visit from non-allocated data

W1112: Failure to recover browser history from non-allocated data
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1112
weakness name: Failure to recover browser history from non-allocated data

W1113: Misinterpretation a URL located on disk/memory as a web visit
type: Weakness
has potential mitigation: M1190: Ensure that the context of recovered URLs is considered during event reconstruction
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1113
weakness name: Misinterpretation a URL located on disk/memory as a web visit

W1114: Failure to locate a relevant device at a physical crime scene
type: Weakness
has potential mitigation: M1068: Use digital sniffer dogs to assist in locating evidence
has potential mitigation: M1069: Use a SyncTriage style approach to determine existence other synchronized devices
has potential mitigation: M1231: Make use of 'paired searching'
has potential mitigation: M1232: Adopt a systematic search pattern
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1114
weakness name: Failure to locate a relevant device at a physical crime scene

W1115: Device is remote wiped because faraday environment was insufficient.
type: Weakness
has potential mitigation: M1002: Testing of the faraday environment to be used
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1115
weakness name: Device is remote wiped because faraday environment was insufficient.

W1116: Last wifi connection is overwritten because faraday environment was insufficient.
type: Weakness
has potential mitigation: M1002: Testing of the faraday environment to be used
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1116
weakness name: Last wifi connection is overwritten because faraday environment was insufficient.

W1117: Calls, messages or other data was received and overwrote relevant data because faraday environment was insufficient.
type: Weakness
has potential mitigation: M1002: Testing of the faraday environment to be used
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1117
weakness name: Calls, messages or other data was received and overwrote relevant data because faraday environment was insufficient.

W1118: Hardware write blocker fails to prevent modifications to the attached device.
type: Weakness
has potential mitigation: M1071: Thorough testing of write blocker against multiple targets to ensure that writes are not possible.
has potential mitigation: M1072: Regular checks for hardware write blocker firmware updates.
has potential mitigation: M1073: Subscription to notifications from write blocker vendor for firmware updates or identified problems.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1118
weakness name: Hardware write blocker fails to prevent modifications to the attached device.

W1119: Hardware write blocker hides the existence of an HPA.
type: Weakness
has potential mitigation: M1005: Testing to ensure software and hardware setup detects HPAs
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1119
weakness name: Hardware write blocker hides the existence of an HPA.

W1120: Hardware write blocker hides the existence of an DCO.
type: Weakness
has potential mitigation: M1006: Testing to ensure software and hardware setup detects DCOs
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1120
weakness name: Hardware write blocker hides the existence of an DCO.

W1121: Image format parsing fails to to present all blocks from within a forensic container image in their ‘flat’ (dd) representation
type: Weakness
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1121
weakness name: Image format parsing fails to to present all blocks from within a forensic container image in their ‘flat’ (dd) representation

W1122: Image format parsing presents incorrect data within sectors of the image
type: Weakness
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1122
weakness name: Image format parsing presents incorrect data within sectors of the image

W1123: Image format parsing presents incorrect forensic image metadata
type: Weakness
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1123
weakness name: Image format parsing presents incorrect forensic image metadata

W1124: Failure to compute hash correctly: this could result in a message indicating corrupt evidence, thus stopping or delaying further investigation
type: Weakness
has potential mitigation: M1075: Testing programme to validate hashes of data in images is calculated correctly
has potential mitigation: M1085: Use of multiple tools to verify disk image hash
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1124
weakness name: Failure to compute hash correctly: this could result in a message indicating corrupt evidence, thus stopping or delaying further investigation

W1125: Failure to validate hash properly: this could allow errors from earlier to propagate e.g. incorrect sectors
type: Weakness
has potential mitigation: M1075: Testing programme to validate hashes of data in images is calculated correctly
has potential mitigation: M1085: Use of multiple tools to verify disk image hash
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1125
weakness name: Failure to validate hash properly: this could allow errors from earlier to propagate e.g. incorrect sectors

W1126: Failure to validate hash properly allowing an incomplete disk image to present as validated
type: Weakness
has potential mitigation: M1075: Testing programme to validate hashes of data in images is calculated correctly
has potential mitigation: M1085: Use of multiple tools to verify disk image hash
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1126
weakness name: Failure to validate hash properly allowing an incomplete disk image to present as validated

W1127: Failure to validate metadata: this could allow details such as acquisition date to be changed
type: Weakness
has potential mitigation: M1076: Testing programme to validate hashes of metadata in images is calculated correctly
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1127
weakness name: Failure to validate metadata: this could allow details such as acquisition date to be changed

W1128: Image replaced with tampered version along with updated stored hash
type: Weakness
has potential mitigation: M1022: Restrict access to stored disk images
has potential mitigation: M1023: Ensure and check logs of access to stored disk images
has potential mitigation: M1074: Validate image hash against one stored externally to the image in a trusted location.
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
has reference: Kemmerich, T., Junge, F., Kuntze, N., Rudolph, C., Endicott-Popovsky, B. and Großkopf, L., 2014. Generation and handling of hard drive duplicates as piece of evidence.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1128
weakness name: Image replaced with tampered version along with updated stored hash

W1129: File type is incorrectly identified
type: Weakness
has potential mitigation: M1109: Testing that tool(s) identify file types correctly
has potential mitigation: M1111: Use of multiple tools to classify file types
has potential mitigation: M1112: Use of AI to classify files in addition to standard programmatic methods
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1129
weakness name: File type is incorrectly identified

W1130: Missing assignment of a file type: reporting a file as unknown when it has a known type within the digital forensic science body of knowledge
type: Weakness
has potential mitigation: M1109: Testing that tool(s) identify file types correctly
has potential mitigation: M1110: Manual review of files classified as unknown
has potential mitigation: M1111: Use of multiple tools to classify file types
has potential mitigation: M1112: Use of AI to classify files in addition to standard programmatic methods
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1130
weakness name: Missing assignment of a file type: reporting a file as unknown when it has a known type within the digital forensic science body of knowledge

W1131: Missing recognition of multiple file types: reporting a file as a limited set of types, or a single type, when it can be interpreted as having more than one, such as a GIF and Java Jar
type: Weakness
has potential mitigation: M1109: Testing that tool(s) identify file types correctly
has potential mitigation: M1111: Use of multiple tools to classify file types
has potential mitigation: M1112: Use of AI to classify files in addition to standard programmatic methods
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
has reference: Magazinius, J., Rios, B.K. and Sabelfeld, A., 2013, November. Polyglots: crossing origins by crossing formats. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security (pp. 753-764).
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1131
weakness name: Missing recognition of multiple file types: reporting a file as a limited set of types, or a single type, when it can be interpreted as having more than one, such as a GIF and Java Jar

W1133: Tool fails to express uncertainty in the classification of file recovery results, e.g., where content may be partly overwritten.
type: Weakness
has potential mitigation: M1084: Test that the tool used expresses uncertainty in the classification of file recovery results
has reference: Casey, E., Nelson, A. and Hyde, J., 2019. Standardization of file recovery classification and authentication. Digital Investigation, 31, p.100873.
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1133
weakness name: Tool fails to express uncertainty in the classification of file recovery results, e.g., where content may be partly overwritten.

W1134: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected
type: Weakness
has potential mitigation: M1079: Analyse file content to detect incompatibility between the content and the recovered file system metadata
has potential mitigation: M1080: Use a hashset of known files to detect that recovered content does not match the expected file content
has potential mitigation: M1081: Check if recovered content matches with size in metadata e.g. file footer at expected location.
has potential mitigation: M1082: Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file
has potential mitigation: M1083: Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)
has reference: Casey, E., Nelson, A. and Hyde, J., 2019. Standardization of file recovery classification and authentication. Digital Investigation, 31, p.100873.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1134
weakness name: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected

W1135: Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected
type: Weakness
has potential mitigation: M1079: Analyse file content to detect incompatibility between the content and the recovered file system metadata
has potential mitigation: M1080: Use a hashset of known files to detect that recovered content does not match the expected file content
has potential mitigation: M1081: Check if recovered content matches with size in metadata e.g. file footer at expected location.
has potential mitigation: M1082: Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file
has potential mitigation: M1083: Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)
has reference: Casey, E., Nelson, A. and Hyde, J., 2019. Standardization of file recovery classification and authentication. Digital Investigation, 31, p.100873.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1135
weakness name: Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected

W1136: Not recovering data from a failed hard drive
type: Weakness
has potential mitigation: M1089: Attempt physical disk repair
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1136
weakness name: Not recovering data from a failed hard drive

W1137: Failing to determine password as it is not in the dictionary used
type: Weakness
has potential mitigation: M1091: Use a brute force attack instead
has potential mitigation: M1092: Optimise dictionary
has potential mitigation: M1093: Use mangling rules to generate variants of candidate passwords
has potential mitigation: M1094: Include contextual information when assembling the dictionary
has potential mitigation: M1205: Use wordlist generator with case data
has potential mitigation: M1231: Make use of 'paired searching'
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1137
weakness name: Failing to determine password as it is not in the dictionary used

W1138: Failing to identify password in the time available
type: Weakness
has potential mitigation: M1092: Optimise dictionary
has potential mitigation: M1095: Order dictionary to test the most likely candidates first
has potential mitigation: M1096: Apply additional resources to dictionary attack
has potential mitigation: M1097: Attempt to obtain password/passcode from the device owner
has potential mitigation: M1205: Use wordlist generator with case data
has potential mitigation: M1231: Make use of 'paired searching'
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1138
weakness name: Failing to identify password in the time available

W1139: System locks after X failed dictionary attempts
type: Weakness
has potential mitigation: M1094: Include contextual information when assembling the dictionary
has potential mitigation: M1095: Order dictionary to test the most likely candidates first
has potential mitigation: M1097: Attempt to obtain password/passcode from the device owner
has potential mitigation: M1231: Make use of 'paired searching'
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1139
weakness name: System locks after X failed dictionary attempts

W1140: Failing to determine password as it is not in the search space
type: Weakness
has potential mitigation: M1097: Attempt to obtain password/passcode from the device owner
has potential mitigation: M1098: Optimise the brute force search space
has potential mitigation: M1099: Use a dictionary attack instead
has potential mitigation: M1231: Make use of 'paired searching'
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1140
weakness name: Failing to determine password as it is not in the search space

W1141: Failing to determine password via brute force in the time available
type: Weakness
has potential mitigation: M1097: Attempt to obtain password/passcode from the device owner
has potential mitigation: M1098: Optimise the brute force search space
has potential mitigation: M1099: Use a dictionary attack instead
has potential mitigation: M1100: Apply additional resources to brute force attack
has potential mitigation: M1231: Make use of 'paired searching'
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1141
weakness name: Failing to determine password via brute force in the time available

W1142: System locks after X failed brute force attempts
type: Weakness
has potential mitigation: M1097: Attempt to obtain password/passcode from the device owner
has potential mitigation: M1098: Optimise the brute force search space
has potential mitigation: M1099: Use a dictionary attack instead
has potential mitigation: M1231: Make use of 'paired searching'
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1142
weakness name: System locks after X failed brute force attempts

W1143: Acquisition method does not read remapped sectors e.g. G-Lists
type: Weakness
has potential mitigation: M1102: Apply techniques to read remapped sectors
has reference: Turner, P. The Remapped/Reallocated Sector Conundrum, Presentation at DFRWS US 2024, https://www.dfrws.org/wp-content/uploads/2023/07/turner-remappedsectors.pdf
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1143
weakness name: Acquisition method does not read remapped sectors e.g. G-Lists

W1144: Failure to identify timestamps in a data source
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1144
weakness name: Failure to identify timestamps in a data source

W1145: Failure to extract timestamps from a data source
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1145
weakness name: Failure to extract timestamps from a data source

W1146: Failure to consider non-timestamp based timing information
type: Weakness
has reference: Dreier, L.M., Vanini, C., Hargreaves, C.J., Breitinger, F. and Freiling, F., 2024. Beyond timestamps: Integrating implicit timing information into digital forensic timelines. Forensic Science International: Digital Investigation, 49, p.301755.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1146
weakness name: Failure to consider non-timestamp based timing information

W1147: Failure to normalise timestamps correctly during timeline generation
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1147
weakness name: Failure to normalise timestamps correctly during timeline generation

W1149: Failure to consider timestamp inaccuracy at time of inferred event
type: Weakness
has potential mitigation: M1103: Check that analysis of timestamp accuracy on which event reconstruction is based has been performed
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: true
may result in MISINT: true
weakness ID: W1149
weakness name: Failure to consider timestamp inaccuracy at time of inferred event

W1151: Incorrectly decoding a timestamp from a data source
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1151
weakness name: Incorrectly decoding a timestamp from a data source

W1152: Generated report does not include all bookmarks
type: Weakness
has potential mitigation: M1104: Testing of report generation functionality that all intended bookmarks are included
has potential mitigation: M1105: Manual verification that all intended bookmarks are included in the generated report.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1152
weakness name: Generated report does not include all bookmarks

W1153: Report generated from bookmarks does not render all content (e.g. previews, string extracts) correctly
type: Weakness
has potential mitigation: M1106: Testing that generated reports correctly represent/render all expected file types
has potential mitigation: M1107: Manual verification that all bookmarked items in the report are correctly rendered/represented.
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1153
weakness name: Report generated from bookmarks does not render all content (e.g. previews, string extracts) correctly

W1154: Report generated from bookmarks stored in manner that does not prevent tampering or corruption
type: Weakness
has potential mitigation: M1108: Preserve hash in secure location of the generated report so intentional or unintentional modifications can be detected.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1154
weakness name: Report generated from bookmarks stored in manner that does not prevent tampering or corruption

W1155: Bookmark added by examiner is not recorded
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1155
weakness name: Bookmark added by examiner is not recorded

W1156: Bookmark added by examiner is is recorded with incorrect tag/label/category
type: Weakness
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1156
weakness name: Bookmark added by examiner is is recorded with incorrect tag/label/category

W1157: Use of mobile exploit changes/overwrites data that was relevant to the investigation
type: Weakness
has reference: Elcomsoft 2021, Forensically Sound checkm8 Based Extraction of iPhone 5s, 6, 6s and SE, https://blog.elcomsoft.com/2021/05/checkm8-based-extraction-of-iphone-5s-6-6s-and-se/
has reference: Grover, J., 2013. Android forensics: Automated data collection and reporting from a mobile device. Digital Investigation, 10, pp.S12-S20.
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1157
weakness name: Use of mobile exploit changes/overwrites data that was relevant to the investigation

W1158: Use of mobile exploit renders device unusable or 'bricked'
type: Weakness
has reference: Tyler, J., 2012 p50. XDA Developers' Android Hacker's Toolkit: The Complete Guide to Rooting, ROMs and Theming. John Wiley & Sons
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1158
weakness name: Use of mobile exploit renders device unusable or 'bricked'

W1159: Presenting a mobile file system acquisition as a bitwise copy of the device
type: Weakness
has potential mitigation: M1114: Clear use of language around mobile file system extractions, making the limitations clear and differentiating from a full disk image
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1159
weakness name: Presenting a mobile file system acquisition as a bitwise copy of the device

W1160: Failure to copy relevant files from the mobile device
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1160
weakness name: Failure to copy relevant files from the mobile device

W1161: Lack of privileges for file system acquisition
type: Weakness
has potential mitigation: M1113: Use mobile exploit to gain privileged access
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1161
weakness name: Lack of privileges for file system acquisition

W1162: Changing relevant files during file system acquisition
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1162
weakness name: Changing relevant files during file system acquisition

W1163: Changing relevant file metadata during file system acquisition
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1163
weakness name: Changing relevant file metadata during file system acquisition

W1164: Files are still encrypted using file-based encryption so inaccessible
type: Weakness
has potential mitigation: M1115: Attempt to brute force user PIN (potentially on device)
has potential mitigation: M1116: Attempt to dictionary attack user PIN (potentially on device)
has potential mitigation: M1117: Attempt to obtain user PIN from user
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1164
weakness name: Files are still encrypted using file-based encryption so inaccessible

W1165: Failure to preserve original timestamps from the data source in an archive
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: true
weakness ID: W1165
weakness name: Failure to preserve original timestamps from the data source in an archive

W1166: Consideration of live database content only
type: Weakness
has potential mitigation: M1122: Apply non-allocated record recovery to database file(s)
has potential mitigation: M1123: Apply system-wide record recovery for non-allocated database record data structures
has reference: Pereira, M.T., 2009. Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records. Digital Investigation, 5(3-4), pp.93-103.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1166
weakness name: Consideration of live database content only

W1167: Combining data from multiple tables that should not be joined
type: Weakness
has potential mitigation: M1118: Recover appropriate database table joins from source application source code
has potential mitigation: M1119: Recover appropriate database table joins from source application reverse engineering
has potential mitigation: M1120: Recover appropriate database table joins from source application developer documentation
has potential mitigation: M1121: Infer appropriate table joins from extensive experimentation with known ground-truth data
may result in INAC ALT: true
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1167
weakness name: Combining data from multiple tables that should not be joined

W1168: Data extracted from a table is assigned an incorrect interpretation
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1168
weakness name: Data extracted from a table is assigned an incorrect interpretation

W1169: Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value
type: Weakness
may result in INAC ALT: true
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1169
weakness name: Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value

W1170: Failure to recover data stored in Write Ahead Log (WAL) files
type: Weakness
has potential mitigation: M1124: Examine database contents with and without Write Ahead Log (WAL) files applied
has reference: Caithness 2012, The Forensic Implications of SQLite’s Write Ahead Log, https://digitalinvestigation.wordpress.com/2012/05/04/the-forensic-implications-of-sqlites-write-ahead-log/
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1170
weakness name: Failure to recover data stored in Write Ahead Log (WAL) files

W1171: Failure to recover data stored in database journal files
type: Weakness
has potential mitigation: M1125: Examine database journal files
has reference: Caithness 2012, The Forensic Implications of SQLite’s Write Ahead Log, https://digitalinvestigation.wordpress.com/2012/05/04/the-forensic-implications-of-sqlites-write-ahead-log/
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1171
weakness name: Failure to recover data stored in database journal files

W1172: Relevant reference data missed as its necessity was not known at time of preservation
type: Weakness
has potential mitigation: M1139: Use automated software monitoring to detect app artefact changes
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1172
weakness name: Relevant reference data missed as its necessity was not known at time of preservation

W1173: Trusted time source is incorrect
type: Weakness
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1173
weakness name: Trusted time source is incorrect

W1174: Failure to find internal attached storage media
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1174
weakness name: Failure to find internal attached storage media

W1175: Failure to find internal unattached storage media
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1175
weakness name: Failure to find internal unattached storage media

W1176: Unable to physically remove/detach internal storage media
type: Weakness
has potential mitigation: M1126: Use forensic bootable environment to gain access to internal media
has reference: Interpol (2021), Guidelines for digital forensics first responders v7, Ch5 Specific Procedures p34, https://www.interpol.int/content/download/16243/file/Guidelines_to_Digital_Forensics_First_Responders_V7.pdf
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1176
weakness name: Unable to physically remove/detach internal storage media

W1177: Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence
type: Weakness
has potential mitigation: M1126: Use forensic bootable environment to gain access to internal media
has potential mitigation: M1127: Use a similar system to test steps required to interrupt the normal boot process and boot from Trusted Bootable Environment
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1177
weakness name: Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence

W1178: Inability to load the forensic bootable environment due to system configuration
type: Weakness
has potential mitigation: M1128: Use a Trusted Bootable Environment that is permitted to boot
has potential mitigation: M1129: Use USB flashdrive version if a CD version is not permitted to boot
has potential mitigation: M1130: Disable Secureboot in BIOS to permit bootable environment to load (risks wiping FDE key, requiring ADK).
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1178
weakness name: Inability to load the forensic bootable environment due to system configuration

W1179: Failure to detect internal disk from bootable environment
type: Weakness
has potential mitigation: M1131: Use a Trusted Bootable Environment that supports accessing the internal disk
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1179
weakness name: Failure to detect internal disk from bootable environment

W1180: Failing to decrypt internal disk using the bootable environment
type: Weakness
has potential mitigation: M1132: Use a Trusted Bootable Environment that supports decryption of the internal disk
has potential mitigation: M1133: Acquire the encrypted contents of the internal disk and decrypt the copy within a virtualized environment
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1180
weakness name: Failing to decrypt internal disk using the bootable environment

W1183: Failure to identify the existence of a connected device
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1134: Testing that connected devices are detected.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1183
weakness name: Failure to identify the existence of a connected device

W1184: Presenting devices 'seen' as devices connected
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1135: Testing that correct metadata/status of connected devices is extracted
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1184
weakness name: Presenting devices 'seen' as devices connected

W1185: Failure to enumerate all files in a standard archive format
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1136: Testing of archive format parsing
has potential mitigation: M1137: Review of logs for any file extraction errors
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1185
weakness name: Failure to enumerate all files in a standard archive format

W1186: Missing files with file name/path-based pattern matching due to renaming
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1186
weakness name: Missing files with file name/path-based pattern matching due to renaming

W1187: Failure to match file name/path pattern due to mismatch of search term used and pattern match engine.
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1187
weakness name: Failure to match file name/path pattern due to mismatch of search term used and pattern match engine.

W1188: Failure to match file name/path pattern due to implementation error in matching engine.
type: Weakness
has potential mitigation: M1138: Testing file name/path pattern matching engine
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1188
weakness name: Failure to match file name/path pattern due to implementation error in matching engine.

W1189: Artifact extraction is incomplete due to app version changes.
type: Weakness
has potential mitigation: M1139: Use automated software monitoring to detect app artefact changes
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1189
weakness name: Artifact extraction is incomplete due to app version changes.

W1190: Interpretation of app data is incorrect due to app version changes.
type: Weakness
has potential mitigation: M1139: Use automated software monitoring to detect app artefact changes
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1190
weakness name: Interpretation of app data is incorrect due to app version changes.

W1191: Missing changes in app artifacts during research since app interaction is needed to cause changes
type: Weakness
has potential mitigation: M1140: Use automation framework to emulate user actions to generate test data
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1191
weakness name: Missing changes in app artifacts during research since app interaction is needed to cause changes

W1192: Relevant results not captured by the case-specific keywords used
type: Weakness
has potential mitigation: M1031: Also using synonyms for terms used
has potential mitigation: M1141: Careful review of case brief for case-specific keyword list generation
has potential mitigation: M1142: Review of case-specific keyword list by case officer
has potential mitigation: M1152: Peer review of case-specific keyword list created
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1192
weakness name: Relevant results not captured by the case-specific keywords used

W1193: Keyword results missed since relevant keyword is split over a sector or cluster boundary
type: Weakness
has potential mitigation: M1143: Use live logical keyword search
has potential mitigation: M1144: Use indexed keyword search
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1193
weakness name: Keyword results missed since relevant keyword is split over a sector or cluster boundary

W1194: Keyword results missed since relevant keyword is inside compressed or encoded data
type: Weakness
has potential mitigation: M1143: Use live logical keyword search
has potential mitigation: M1144: Use indexed keyword search
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1194
weakness name: Keyword results missed since relevant keyword is inside compressed or encoded data

W1196: One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image
type: Weakness
has potential mitigation: M1145: Apply OCR to files and search or index resulting text
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1196
weakness name: One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image

W1197: Data not indexed for keyword searching due to compression
type: Weakness
has potential mitigation: M1029: Testing of keyword indexing component of tool
has potential mitigation: M1034: Comparison of index results with live search results
has potential mitigation: M1149: Ensure keyword indexing settings mean that decompression will be applied as required during indexing
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1197
weakness name: Data not indexed for keyword searching due to compression

W1198: Data not indexed for keyword searching due to file or content encoding
type: Weakness
has potential mitigation: M1029: Testing of keyword indexing component of tool
has potential mitigation: M1034: Comparison of index results with live search results
has potential mitigation: M1150: Ensure keyword indexing settings mean that file formats will be decoded as required during indexing
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1198
weakness name: Data not indexed for keyword searching due to file or content encoding

W1199: Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical
type: Weakness
has potential mitigation: M1033: Prioritization of search results based on context
has potential mitigation: M1038: Word list selected such that a practically reviewable number of results are returned
has potential mitigation: M1142: Review of case-specific keyword list by case officer
has potential mitigation: M1152: Peer review of case-specific keyword list created
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1199
weakness name: Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical

W1200: Failure to conduct iterative keyword searching due to excessive time taken per search
type: Weakness
has potential mitigation: M1153: Index data in the case and perform iterative keyword searching using the index
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1200
weakness name: Failure to conduct iterative keyword searching due to excessive time taken per search

W1201: Failure to recover live messages to or from the AI companion app
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1154: Testing for live message recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1201
weakness name: Failure to recover live messages to or from the AI companion app

W1202: Failure to recover deleted but recoverable messages to or from the AI companion app
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1155: Testing for deleted message recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1202
weakness name: Failure to recover deleted but recoverable messages to or from the AI companion app

W1203: Presenting a message from the user or AI companion app that did not exist
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1154: Testing for live message recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1203
weakness name: Presenting a message from the user or AI companion app that did not exist

W1204: Presenting a deleted message to the AI companion app as a live one, or vice versa
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1155: Testing for deleted message recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1204
weakness name: Presenting a deleted message to the AI companion app as a live one, or vice versa

W1205: Presenting a message to the AI chat app as from the AI companion app, or vice versa
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1154: Testing for live message recovery from AI companion app
has potential mitigation: M1155: Testing for deleted message recovery from AI companion app
has potential mitigation: M1156: Testing that message sender and recipient extraction are correct
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1205
weakness name: Presenting a message to the AI chat app as from the AI companion app, or vice versa

W1206: Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1155: Testing for deleted message recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1206
weakness name: Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app

W1207: Failure to display a message to or from the AI companion app in the context of other messages
type: Weakness
has potential mitigation: M1157: Ensure messages are viewed in the context of the message thread
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1207
weakness name: Failure to display a message to or from the AI companion app in the context of other messages

W1208: Failure to recover live images sent to or from the AI companion app
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1158: Testing for live picture message recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1208
weakness name: Failure to recover live images sent to or from the AI companion app

W1209: Failure to recover deleted but recoverable images sent to or from the AI companion app
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1159: Testing for deleted picture message recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1209
weakness name: Failure to recover deleted but recoverable images sent to or from the AI companion app

W1210: Presenting an image sent from the user or AI companion app that did not exist
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1158: Testing for live picture message recovery from AI companion app
has potential mitigation: M1159: Testing for deleted picture message recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1210
weakness name: Presenting an image sent from the user or AI companion app that did not exist

W1211: Presenting a deleted image sent to the AI companion app as a live one, or vice versa
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1158: Testing for live picture message recovery from AI companion app
has potential mitigation: M1159: Testing for deleted picture message recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1211
weakness name: Presenting a deleted image sent to the AI companion app as a live one, or vice versa

W1212: Presenting an image sent to the AI chat app as from the AI companion app, or vice versa
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1158: Testing for live picture message recovery from AI companion app
has potential mitigation: M1159: Testing for deleted picture message recovery from AI companion app
has potential mitigation: M1160: Testing that picture message sender and recipient extraction are correct
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1212
weakness name: Presenting an image sent to the AI chat app as from the AI companion app, or vice versa

W1213: Failure to display an image to or from the AI companion app in the context of other messages
type: Weakness
has potential mitigation: M1157: Ensure messages are viewed in the context of the message thread
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1213
weakness name: Failure to display an image to or from the AI companion app in the context of other messages

W1214: Failure to recover live records of calls to or from the AI companion app
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1161: Testing of live call record recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1214
weakness name: Failure to recover live records of calls to or from the AI companion app

W1215: Failure to recover deleted but recoverable records of calls to or from the AI companion app
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1162: Testing of deleted call record recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1215
weakness name: Failure to recover deleted but recoverable records of calls to or from the AI companion app

W1216: Presenting a call to or from the AI companion app that did not exist
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1161: Testing of live call record recovery from AI companion app
has potential mitigation: M1162: Testing of deleted call record recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1216
weakness name: Presenting a call to or from the AI companion app that did not exist

W1217: Presenting a deleted call to the AI companion app as a live one, or vice versa
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1161: Testing of live call record recovery from AI companion app
has potential mitigation: M1162: Testing of deleted call record recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1217
weakness name: Presenting a deleted call to the AI companion app as a live one, or vice versa

W1218: Presenting a call to the AI companion app as from the AI companion app, or vice versa
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1161: Testing of live call record recovery from AI companion app
has potential mitigation: M1162: Testing of deleted call record recovery from AI companion app
has potential mitigation: M1163: Testing that call record caller and recipient extraction are correct
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1218
weakness name: Presenting a call to the AI companion app as from the AI companion app, or vice versa

W1219: Failure to recover metadata associated with an interaction with the AI companion app
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1154: Testing for live message recovery from AI companion app
has potential mitigation: M1155: Testing for deleted message recovery from AI companion app
has potential mitigation: M1158: Testing for live picture message recovery from AI companion app
has potential mitigation: M1159: Testing for deleted picture message recovery from AI companion app
has potential mitigation: M1161: Testing of live call record recovery from AI companion app
has potential mitigation: M1162: Testing of deleted call record recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1219
weakness name: Failure to recover metadata associated with an interaction with the AI companion app

W1220: Presenting an incorrect timestamp associated with an interaction with the AI companion app
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1154: Testing for live message recovery from AI companion app
has potential mitigation: M1155: Testing for deleted message recovery from AI companion app
has potential mitigation: M1158: Testing for live picture message recovery from AI companion app
has potential mitigation: M1159: Testing for deleted picture message recovery from AI companion app
has potential mitigation: M1161: Testing of live call record recovery from AI companion app
has potential mitigation: M1162: Testing of deleted call record recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1220
weakness name: Presenting an incorrect timestamp associated with an interaction with the AI companion app

W1221: Failure to recover account details from the AI app data
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1164: Testing of account details recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1221
weakness name: Failure to recover account details from the AI app data

W1222: Presenting account details that did not exist
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1164: Testing of account details recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1222
weakness name: Presenting account details that did not exist

W1223: Live access to the device (for extraction) updates last access times for an account
type: Weakness
has potential mitigation: M1165: Ensure data collection prior to any interaction with app
has potential mitigation: M1166: Remove all network connectivity from device
has potential mitigation: M1167: Check time of account access is prior to device seizure time
has potential mitigation: M1168: Request logs of access times from service provider
may result in INAC ALT: true
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1223
weakness name: Live access to the device (for extraction) updates last access times for an account

W1224: Presenting a deleted account as live, or vice versa
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1164: Testing of account details recovery from AI companion app
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1224
weakness name: Presenting a deleted account as live, or vice versa

W1225: Failure to recover relevant app settings
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1169: Testing of app settings recovery from AI companion app
has potential mitigation: M1170: Experiments with test device to view possible settings of forensic value
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1225
weakness name: Failure to recover relevant app settings

W1226: Failure to recover relevant AI bot settings
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1170: Experiments with test device to view possible settings of forensic value
has potential mitigation: M1171: Testing of the recovery of companion AI bot settings
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1226
weakness name: Failure to recover relevant AI bot settings

W1227: Associating a configured bot with the wrong account
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1050: Manual verification of relevant data
has potential mitigation: M1055: Correlation of data extracted with data from service provider
has potential mitigation: M1171: Testing of the recovery of companion AI bot settings
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1227
weakness name: Associating a configured bot with the wrong account

W1228: Log entry missing due to incorrect parsing of logfile
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1181: Testing logfile parsing capability
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1228
weakness name: Log entry missing due to incorrect parsing of logfile

W1229: Log entry missing due to being stored in archived copies of logs
type: Weakness
has potential mitigation: M1175: Ensure any available archive logs are also examined
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1229
weakness name: Log entry missing due to being stored in archived copies of logs

W1230: Log entry missing due to rotation size or timing
type: Weakness
has potential mitigation: M1172: Also examine any older versions of the logs from backups
has potential mitigation: M1173: Check logging settings so the bounds of logging are known
has potential mitigation: M1175: Ensure any available archive logs are also examined
has reference: https://www.crowdstrike.com/en-us/guides/syslog-logging/advanced-concepts/
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1230
weakness name: Log entry missing due to rotation size or timing

W1231: Interpreting log entry absence as evidence of deletion rather than logging configuration
type: Weakness
has potential mitigation: M1174: Check logging settings to determine expected behaviour
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1231
weakness name: Interpreting log entry absence as evidence of deletion rather than logging configuration

W1232: Failure to extract log entry timestamp
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1180: Testing correct extraction of logfile entry timestamps
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1232
weakness name: Failure to extract log entry timestamp

W1233: Failure to communicate imprecision in log entry timestamp
type: Weakness
has potential mitigation: M1177: Ensure resolution or limitations of logfile timestamps are understood
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1233
weakness name: Failure to communicate imprecision in log entry timestamp

W1234: Event time presented incorrectly due to incorrect timezone handling
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1178: Ensure timezone handling method for logfile timestamps is understood
has potential mitigation: M1179: If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: true
may result in MISINT: true
weakness ID: W1234
weakness name: Event time presented incorrectly due to incorrect timezone handling

W1235: Failure to extract log entry type
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1182: Testing of correct log entry type extraction
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1235
weakness name: Failure to extract log entry type

W1236: Incorrectly interpreting a log entry type based on a different version of the generating software or operating system
type: Weakness
has potential mitigation: M1176: Ensure log entry type interpretation applies for the software version being examined
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1236
weakness name: Incorrectly interpreting a log entry type based on a different version of the generating software or operating system

W1243: Missing browser history data as it was conducted outside of configured retention period
type: Weakness
has potential mitigation: M1192: Examine browser configuration to determine history retention settings
has potential mitigation: M1193: Obtain older versions of browser history files from backups or from file system versioning features
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1243
weakness name: Missing browser history data as it was conducted outside of configured retention period

W1244: Missing browser history data as it was cleared by user
type: Weakness
has reference: Oh, J., Lee, S. and Lee, S., 2011. Advanced evidence collection and analysis of web browser activity. Digital investigation, 8, pp.S62-S70., section 3.6
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1244
weakness name: Missing browser history data as it was cleared by user

W1245: Relying on times stored in browser history that are not representative of exact web page visit time
type: Weakness
has reference: Groß, T., Dirauf, R. and Freiling, F., 2020, May. Systematic analysis of browser history evidence. In 2020 13th International Conference on Systematic Approaches to Digital Forensic Engineering (SADFE) (pp. 1-12). IEEE.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1245
weakness name: Relying on times stored in browser history that are not representative of exact web page visit time

W1246: Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database
type: Weakness
has potential mitigation: M1193: Obtain older versions of browser history files from backups or from file system versioning features
has potential mitigation: M1194: Consider carefully page titles and other details associated with older web history visits when details are recovered using SQL join queries.
has potential mitigation: M1195: Also examine browser cache to confirm details about an older web visit when details are recovered using SQL join queries.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1246
weakness name: Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database

W1247: Attributing saved browser bookmarks to a user but they were bundled with the browser installation
type: Weakness
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1247
weakness name: Attributing saved browser bookmarks to a user but they were bundled with the browser installation

W1248: Missing browser downloads as the files were saved to a non-standard location
type: Weakness
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1248
weakness name: Missing browser downloads as the files were saved to a non-standard location

W1249: Missing a web browser profile as it was stored outside of the usual browser profile folders
type: Weakness
has potential mitigation: M1191: Ensure that profile configuration is examined rather than just folders within the standard profile folder
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1249
weakness name: Missing a web browser profile as it was stored outside of the usual browser profile folders

W1250: Incomplete browser activity extraction due to not considering the browser cache artifacts
type: Weakness
has potential mitigation: M1187: Ensure browser cache data is also considered
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1250
weakness name: Incomplete browser activity extraction due to not considering the browser cache artifacts

W1251: Incomplete browser activity extraction due to failure to consider multiple profiles
type: Weakness
has potential mitigation: M1188: Ensure all profiles of the web browser are considered
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1251
weakness name: Incomplete browser activity extraction due to failure to consider multiple profiles

W1252: Assuming that data stored in the cache was viewed by the user
type: Weakness
has potential mitigation: M1189: Conduct experiments to determine if content from the page in question is cached only when viewed in the browser
has reference: Horsman, G., 2018. I didn't see that! An examination of internet browser cache behaviour following website visits. Digital Investigation, 25, pp.105-113.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1252
weakness name: Assuming that data stored in the cache was viewed by the user

W1253: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information
type: Weakness
has potential mitigation: M1079: Analyse file content to detect incompatibility between the content and the recovered file system metadata
has potential mitigation: M1080: Use a hashset of known files to detect that recovered content does not match the expected file content
has potential mitigation: M1081: Check if recovered content matches with size in metadata e.g. file footer at expected location.
has potential mitigation: M1083: Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1253
weakness name: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information

W1254: Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information
type: Weakness
has potential mitigation: M1079: Analyse file content to detect incompatibility between the content and the recovered file system metadata
has potential mitigation: M1080: Use a hashset of known files to detect that recovered content does not match the expected file content
has potential mitigation: M1081: Check if recovered content matches with size in metadata e.g. file footer at expected location.
has potential mitigation: M1196: Check if file being recovered is smaller than a block
has potential mitigation: M1197: Check if file being recovered is resident (applicable on some file systems)
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1254
weakness name: Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information

W1255: Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL)
type: Weakness
has potential mitigation: M1079: Analyse file content to detect incompatibility between the content and the recovered file system metadata
has potential mitigation: M1080: Use a hashset of known files to detect that recovered content does not match the expected file content
has potential mitigation: M1081: Check if recovered content matches with size in metadata e.g. file footer at expected location.
has potential mitigation: M1198: Check if file system and operating system make use of an 'allocated but unwritten' value e.g. VDL.
has potential mitigation: M1199: Check all relevant file size metadata values when recovering file content
has potential mitigation: M1200: Ensure that inconsistencies between allocated data size and data written size are clearly flagged.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1255
weakness name: Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL)

W1256: Incorrect attribution of metadata to file content that was the result of 'file tunnelling'
type: Weakness
has potential mitigation: M1079: Analyse file content to detect incompatibility between the content and the recovered file system metadata
has potential mitigation: M1080: Use a hashset of known files to detect that recovered content does not match the expected file content
has potential mitigation: M1081: Check if recovered content matches with size in metadata e.g. file footer at expected location.
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1256
weakness name: Incorrect attribution of metadata to file content that was the result of 'file tunnelling'

W1257: Missing content that is relevant to a keyword search but it has not been extracted as 'artifacts'
type: Weakness
has potential mitigation: M1203: Use indexed keyword search over broader content of the data source
has potential mitigation: M1204: Use live keyword search over broader content of the data source
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1257
weakness name: Missing content that is relevant to a keyword search but it has not been extracted as 'artifacts'

W1258: Failure to present uncertainty associated with automated interpretation of data into artifacts
type: Weakness
has potential mitigation: M1206: Ensure that tools used clearly separate fact from interpretation
has potential mitigation: M1207: Ensure training is in place for tool operators to separate fact from interpretation within the tool used
has potential mitigation: M1208: Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered
has potential mitigation: M1209: Ensure that tools used present the uncertainty associated with automated interpretation of data
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1258
weakness name: Failure to present uncertainty associated with automated interpretation of data into artifacts

W1259: Image format parsing fails to identify or assemble split forensic images
type: Weakness
has potential mitigation: M1004: Check hash of image matches hash of source device
has potential mitigation: M1009: Check hash of image matches hash of source material
has potential mitigation: M1210: Use a forensic image format with internal integrity and continuity metadata
has potential mitigation: M1211: Test the parsing of split forensic images
has potential mitigation: M1212: Test the parsing of split forensic images with the maximum number of segments possible
has potential mitigation: M1213: Test the parsing of split forensic images with missing segments
has potential mitigation: M1214: Ensure forensic tool UI clearly warns that there are problems while parsing a split forensic image file
has potential mitigation: M1215: Test the parsing of split forensic images with a corrupt segment
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: true
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1259
weakness name: Image format parsing fails to identify or assemble split forensic images

W1260: Failure to derive clock offset due to inability to locate a suitable time anchor
type: Weakness
has potential mitigation: M1218: Ensure that tools and processes take into account all current knowledge on sources of local/external timestamp pairs (time anchors)
has potential mitigation: M1222: Testing to ensure that tooling is able to extract local/external timestamp pairs (time anchors)
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1260
weakness name: Failure to derive clock offset due to inability to locate a suitable time anchor

W1261: Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring
type: Weakness
has potential mitigation: M1217: Consider multiple time anchors and check if timestamps from multiple external time sources agree
has potential mitigation: M1220: Periodically keep records of time offsets of significant external servers
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1261
weakness name: Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring

W1262: Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time
type: Weakness
has potential mitigation: M1216: Check that the assumption is valid that the specific local/external timestamp pair should be correlated
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1262
weakness name: Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time

W1263: Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring
type: Weakness
has potential mitigation: M1219: Manual verification of timestamp decoding within a time anchor
has potential mitigation: M1221: Testing of timestamp decoding within a time anchor
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1263
weakness name: Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring

W1264: Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp
type: Weakness
has potential mitigation: M1223: Apply time zone based offsets only to UTC stored timestamps
has potential mitigation: M1226: Testing to determine whether a timestamp is in UTC or local time
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1264
weakness name: Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp

W1265: Offset applied to timestamp is incorrect due to variations in time zone over the history of data source
type: Weakness
has potential mitigation: M1224: Check for location artifacts to infer the time zone at a specific moment
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1265
weakness name: Offset applied to timestamp is incorrect due to variations in time zone over the history of data source

W1267: Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source
type: Weakness
has potential mitigation: M1225: Estimate clock offset at a specific point in time using time anchoring
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1267
weakness name: Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source

W1268: Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used
type: Weakness
has potential mitigation: M1224: Check for location artifacts to infer the time zone at a specific moment
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1268
weakness name: Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used

W1269: Failure to apply time offset to a timeline entry
type: Weakness
has potential mitigation: M1101: Apply time offset to timestamp
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: true
may result in MISINT: true
weakness ID: W1269
weakness name: Failure to apply time offset to a timeline entry

W1270: Inability to create a device backup due to locked device
type: Weakness
has potential mitigation: M1097: Attempt to obtain password/passcode from the device owner
has potential mitigation: M1234: Exploit device to facilitate password/pincode attacks
has potential mitigation: M1235: Attempt to obtain password/pincode with brute force attacks
has potential mitigation: M1236: Attempt to obtain password/pincode with dictionary attacks
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1270
weakness name: Inability to create a device backup due to locked device

W1271: Inability to access required service as it is not enabled
type: Weakness
has potential mitigation: M1232: Adopt a systematic search pattern
has reference: Android (2025), How to Enable Android Developer Settings: Unlock your Device’s Hidden Potential, https://www.android.com/intl/en_uk/articles/enable-android-developer-settings/
has reference: Belkasoft (undated) Dealing with Apple's USB Restricted Mode, https://belkasoft.com/dealing_with_usb_restricted_mode
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1271
weakness name: Inability to access required service as it is not enabled

W1272: Failure to preserve all relevant timestamps of files obtained using exposed services on a device
type: Weakness
has potential mitigation: M1233: Test data extraction methods against reference data with known timestamps
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1272
weakness name: Failure to preserve all relevant timestamps of files obtained using exposed services on a device

W1273: Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device
type: Weakness
has potential mitigation: M1233: Test data extraction methods against reference data with known timestamps
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1273
weakness name: Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device

W1274: Inability to enable required service due to locked device
type: Weakness
has potential mitigation: M1097: Attempt to obtain password/passcode from the device owner
has potential mitigation: M1234: Exploit device to facilitate password/pincode attacks
has potential mitigation: M1235: Attempt to obtain password/pincode with brute force attacks
has potential mitigation: M1236: Attempt to obtain password/pincode with dictionary attacks
has potential mitigation: M1238: Configure device to enable required service
has potential mitigation: M1239: Obtain possible passwords/PIN codes from other devices with limited security
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1274
weakness name: Inability to enable required service due to locked device

W1275: Failure to store data due to size limitations of archive format used
type: Weakness
has potential mitigation: M1237: Ensure that archive format used can handle sufficiently large files
has reference: Wikipedia (2026), ZIP (file format), https://en.wikipedia.org/wiki/ZIP_(file_format)#ZIP64
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1275
weakness name: Failure to store data due to size limitations of archive format used

W1276: Relevant data is overwritten by deploying an agent to a mobile device
type: Weakness
has potential mitigation: M1014: Test and document changes made by the tools used
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1276
weakness name: Relevant data is overwritten by deploying an agent to a mobile device

M1003: Check image size corresponds with drive label
type: Mitigation
mitigation ID: M1003
mitigation name: Check image size corresponds with drive label

M1005: Testing to ensure software and hardware setup detects HPAs
type: Mitigation
mitigation ID: M1005
mitigation name: Testing to ensure software and hardware setup detects HPAs

M1006: Testing to ensure software and hardware setup detects DCOs
type: Mitigation
mitigation ID: M1006
mitigation name: Testing to ensure software and hardware setup detects DCOs

M1009: Check hash of image matches hash of source material
type: Mitigation
mitigation ID: M1009
mitigation name: Check hash of image matches hash of source material

M1010: Perform full extraction instead of selective
type: Mitigation
mitigation ID: M1010
mitigation name: Perform full extraction instead of selective

M1011: Perform full extraction instead of selective, followed by partial processing
type: Mitigation
mitigation ID: M1011
mitigation name: Perform full extraction instead of selective, followed by partial processing

M1013: Consider memory acquisition and offline analysis instead
type: Mitigation
has reference: Hargreaves, C.J., 2009. Assessing the reliability of digital evidence from live investigations involving encryption. Chapter 6
mitigation ID: M1013
mitigation name: Consider memory acquisition and offline analysis instead

M1015: Use tools only if changes made are to locations where relevant evidence is unlikely to be located.
type: Mitigation
has reference: Hargreaves, C.J., 2009. Assessing the reliability of digital evidence from live investigations involving encryption. Chapter 5
mitigation ID: M1015
mitigation name: Use tools only if changes made are to locations where relevant evidence is unlikely to be located.

M1022: Restrict access to stored disk images
type: Mitigation
mitigation ID: M1022
mitigation name: Restrict access to stored disk images

M1023: Ensure and check logs of access to stored disk images
type: Mitigation
mitigation ID: M1023
mitigation name: Ensure and check logs of access to stored disk images

M1028: Parse app lists if available and highlight missing data
type: Mitigation
mitigation ID: M1028
mitigation name: Parse app lists if available and highlight missing data

M1031: Also using synonyms for terms used
type: Mitigation
mitigation ID: M1031
mitigation name: Also using synonyms for terms used

M1032: Evaluation of the effectiveness of wordlist used for case-type searching
type: Mitigation
has reference: Kanta, A. and Hargreaves, C., 2025, August. Measuring the effectiveness of keyword lists in digital forensics. In Proceedings of the 20th International Conference on Availability, Reliability and Security.
mitigation ID: M1032
mitigation name: Evaluation of the effectiveness of wordlist used for case-type searching

M1033: Prioritization of search results based on context
type: Mitigation
has reference: Beebe, N.L. and Liu, L., 2014. Ranking algorithms for digital forensic string search hits. Digital Investigation, 11, pp.S124-S132.
mitigation ID: M1033
mitigation name: Prioritization of search results based on context

M1038: Word list selected such that a practically reviewable number of results are returned
type: Mitigation
mitigation ID: M1038
mitigation name: Word list selected such that a practically reviewable number of results are returned

M1042: Secondary review of flagged items to ensure relevance
type: Mitigation
mitigation ID: M1042
mitigation name: Secondary review of flagged items to ensure relevance

M1047: Testing partition table parsing on standard and non-standard configurations
type: Mitigation
mitigation ID: M1047
mitigation name: Testing partition table parsing on standard and non-standard configurations

M1057: Testing of parsing of syncronisation artefacts
type: Mitigation
mitigation ID: M1057
mitigation name: Testing of parsing of syncronisation artefacts

M1058: Checking for other confirmatory indicators of the inferred device's existence.
type: Mitigation
mitigation ID: M1058
mitigation name: Checking for other confirmatory indicators of the inferred device's existence.

M1062: Verify semantic integrity of carved content using manual inspection of relevant data
type: Mitigation
mitigation ID: M1062
mitigation name: Verify semantic integrity of carved content using manual inspection of relevant data

M1063: Verify semantic integrity of carved content using an automated tool
type: Mitigation
mitigation ID: M1063
mitigation name: Verify semantic integrity of carved content using an automated tool

M1064: Verify that salvaged content is renderable using visual inspection of displayed/rendered content
type: Mitigation
mitigation ID: M1064
mitigation name: Verify that salvaged content is renderable using visual inspection of displayed/rendered content

M1082: Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file
type: Mitigation
mitigation ID: M1082
mitigation name: Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file

M1090: Compare carved results against known files (e.g. from another source)
type: Mitigation
mitigation ID: M1090
mitigation name: Compare carved results against known files (e.g. from another source)

M1092: Optimise dictionary
type: Mitigation
has reference: Kanta, A., Coisel, I. and Scanlon, M., 2023. Harder, better, faster, stronger: Optimising the performance of context-based password cracking dictionaries. Forensic Science International: Digital Investigation, 44, p.301507.
mitigation ID: M1092
mitigation name: Optimise dictionary

M1094: Include contextual information when assembling the dictionary
type: Mitigation
has reference: Kanta, A., Coisel, I. and Scanlon, M., 2023. Harder, better, faster, stronger: Optimising the performance of context-based password cracking dictionaries. Forensic Science International: Digital Investigation, 44, p.301507.
mitigation ID: M1094
mitigation name: Include contextual information when assembling the dictionary

M1095: Order dictionary to test the most likely candidates first
type: Mitigation
mitigation ID: M1095
mitigation name: Order dictionary to test the most likely candidates first

M1126: Use forensic bootable environment to gain access to internal media
type: Mitigation
links to technique: T1113: Access internal storage via bootable environment
mitigation ID: M1126
mitigation name: Use forensic bootable environment to gain access to internal media

M1142: Review of case-specific keyword list by case officer
type: Mitigation
mitigation ID: M1142
mitigation name: Review of case-specific keyword list by case officer

M1143: Use live logical keyword search
type: Mitigation
links to technique: T1127: Keyword search (live) (logical)
mitigation ID: M1143
mitigation name: Use live logical keyword search

M1144: Use indexed keyword search
type: Mitigation
links to technique: T1124: Keyword search (indexed)
mitigation ID: M1144
mitigation name: Use indexed keyword search

M1152: Peer review of case-specific keyword list created
type: Mitigation
mitigation ID: M1152
mitigation name: Peer review of case-specific keyword list created

M1157: Ensure messages are viewed in the context of the message thread
type: Mitigation
mitigation ID: M1157
mitigation name: Ensure messages are viewed in the context of the message thread

M1170: Experiments with test device to view possible settings of forensic value
type: Mitigation
mitigation ID: M1170
mitigation name: Experiments with test device to view possible settings of forensic value

M1171: Testing of the recovery of companion AI bot settings
type: Mitigation
mitigation ID: M1171
mitigation name: Testing of the recovery of companion AI bot settings

M1175: Ensure any available archive logs are also examined
type: Mitigation
mitigation ID: M1175
mitigation name: Ensure any available archive logs are also examined

M1193: Obtain older versions of browser history files from backups or from file system versioning features
type: Mitigation
mitigation ID: M1193
mitigation name: Obtain older versions of browser history files from backups or from file system versioning features

M1205: Use wordlist generator with case data
type: Mitigation
has reference: Magnet Forensics (2019) Magnet Axiom Wordlist Generator. Magnet Forensics. Available at: https://www.magnetforensics.com/resources/magnet-axiom-wordlist-generator/
has reference: Magnet Forensics (2019) Utilizing AXIOM Wordlist Generator to Optimize Handset Lock Code Breaking, Magnet Forensics, Available at: https://www.magnetforensics.com/blog/utilizing-axiom-wordlist-generator-to-optimize-handset-lock-code-breaking/
mitigation ID: M1205
mitigation name: Use wordlist generator with case data

M1225: Estimate clock offset at a specific point in time using time anchoring
type: Mitigation
has reference: C. Vanini, C. Hargreaves, H. van Beek, F. Breitinger, 2024, Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction, Forensic Science International: Digital Investigation, 10.1016/j.fsidi.2024.301759
links to technique: T1134: Use time anchors to estimate clock offset
mitigation ID: M1225
mitigation name: Estimate clock offset at a specific point in time using time anchoring

M1232: Adopt a systematic search pattern
type: Mitigation
has reference: Fisher & Fisher. 2012, Techniques of Crime Scene Investigation, Eighth Edition, p82
mitigation description: According to Fisher & Fisher (2012): "Criminal investigation texts recommend a variety of search patterns: the strip or lane search, grid search, spiral search, and quadrant search. "
mitigation ID: M1232
mitigation name: Adopt a systematic search pattern

M1233: Test data extraction methods against reference data with known timestamps
type: Mitigation
mitigation ID: M1233
mitigation name: Test data extraction methods against reference data with known timestamps

M1234: Exploit device to facilitate password/pincode attacks
type: Mitigation
links to technique: T1040: Use mobile device exploit
mitigation ID: M1234
mitigation name: Exploit device to facilitate password/pincode attacks

M1235: Attempt to obtain password/pincode with brute force attacks
type: Mitigation
links to technique: T1034: Brute force attack
mitigation ID: M1235
mitigation name: Attempt to obtain password/pincode with brute force attacks

M1236: Attempt to obtain password/pincode with dictionary attacks
type: Mitigation
links to technique: T1035: Dictionary attack
mitigation ID: M1236
mitigation name: Attempt to obtain password/pincode with dictionary attacks

T1006: Digital sniffer dogs
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Device
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/location
has potential weakness: W1005: Dogs fail to find a digital device
has reference: Petersen, S.J. and Schoon, A., 2022. Dogs as Detectors for Hidden Digital Storage Devices: A Pilot Study from the National Police of The Netherlands. In Canines (pp. 535-557). Jenny Stanford Publishing.
has synonym: Digital Storage Device Dogs
technique description: The use of canines to locate obscured digital storage devices.
technique ID: T1006
technique name: Digital sniffer dogs

T1007: Use a SyncTriage-based approach to detect existence of devices
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Device
has example: SyncTriage - https://bitbucket.org/chrishargreaves/synctriage
has potential weakness: W1008: Missing the existence of a device by missing synchronisation artefacts
has potential weakness: W1009: Missing the existence of a device by incorrectly parsing synchronisation artefacts
has potential weakness: W1010: Misattributing activity to the wrong device
has potential weakness: W1011: Suggesting the existence of a device that does not exist
has potential weakness: W1012: Interaction with the target devices to read synronisation artefacts causes changes
has reference: Hargreaves, C. and Marshall, A., 2019. SyncTriage: Using synchronisation artefacts to optimise acquisition order. Digital Investigation, 28, pp.S134-S140.
technique description: A technique developed in Hargreaves & Marshall (2018) whereby synchronisation artefacts on a device are examined and used to identify the existence of a related device. Also sometimes used to infer activity that occurred on an inaccessible or unavailable device.
technique ID: T1007
technique name: Use a SyncTriage-based approach to detect existence of devices

T1012: Connect storage medium via hardware write blocker
type: Technique
has CASE input class: https://ontology.unifiedcyberontology.org/uco/observable/StorageMedium
has CASE output class: https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface
has potential weakness: W1118: Hardware write blocker fails to prevent modifications to the attached device.
has potential weakness: W1119: Hardware write blocker hides the existence of an HPA.
has potential weakness: W1120: Hardware write blocker hides the existence of an DCO.
has reference: Lyle, J.R., 2006. A strategy for testing hardware write block devices. digital investigation, 3, pp.3-9.
technique description: A hardware write blocking device [should] prevent any change to data in the user area of a hard drive while allowing access to all data on a hard drive. (Lyle 2006)
technique details: Note that "Sometimes it may be desirable to change a drive configuration to obtain access to otherwise hidden sectors, for example, such as within an HPA (host protected area)." (Lyle 2006)
technique ID: T1012
technique name: Connect storage medium via hardware write blocker

T1013: Use software write blockers to provide read only access to storage media
type: Technique
has CASE input class: https://ontology.solveit-df.org/solveit/observable/DeviceInterface
has CASE output class: https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface
has reference: NIST (2006) NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response, https://doi.org/10.6028/NIST.SP.800-86
technique description: Use of a software-based tool that prevents a computer from writing to computer storage media connected to it (NIST 2006)
technique ID: T1013
technique name: Use software write blockers to provide read only access to storage media

T1020: Mobile file system extraction
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile
has potential weakness: W1159: Presenting a mobile file system acquisition as a bitwise copy of the device
has potential weakness: W1160: Failure to copy relevant files from the mobile device
has potential weakness: W1161: Lack of privileges for file system acquisition
has potential weakness: W1162: Changing relevant files during file system acquisition
has potential weakness: W1163: Changing relevant file metadata during file system acquisition
has potential weakness: W1164: Files are still encrypted using file-based encryption so inaccessible
has reference: Cellebrite (undated), Full File System Extraction - Mobile Device Forensics, https://cellebrite.com/en/glossary/full-file-system-extraction-mobile-device-forensics/
has reference: Fukami, A., Stoykova, R. and Geradts, Z., 2021. A new model for forensic data extraction from encrypted mobile devices. Forensic Science International: Digital Investigation, 38, p.301169.
has reference: Magnet (2024) Revealing hidden data: Full file system extractions uncovered, https://www.magnetforensics.com/blog/revealing-hidden-data-full-file-system-extractions-uncovered/
technique description: Accessing the file system(s) of the device and extracting a set of files (full or partial depending on level of access)
technique details: Note that Fukami et al (2021) states "In order to conduct effective file system extraction, rooting the device is required." See T1040. Usually results in a zip/tar file. Rooting may provide access to the file system, but files may still be encrypted. Attacking the user pin, usually on device, using T1034, or T1035 may be necessary, unless the PIN can be obtained from the device user (T1037)
technique ID: T1020
technique name: Mobile file system extraction

T1033: Extraction of credential from an accessible device
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/Account
technique description: Accessing a device with limited or no security to obtain a credential (e.g. password, PIN, token) that can be used to access another device or service.
technique ID: T1033
technique name: Extraction of credential from an accessible device

T1042: Disk image hash verification
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/hash
has potential weakness: W1042: Disk image was tampered with, but manipulated to have a collision with original hash
has potential weakness: W1124: Failure to compute hash correctly: this could result in a message indicating corrupt evidence, thus stopping or delaying further investigation
has potential weakness: W1125: Failure to validate hash properly: this could allow errors from earlier to propagate e.g. incorrect sectors
has potential weakness: W1126: Failure to validate hash properly allowing an incomplete disk image to present as validated
has potential weakness: W1127: Failure to validate metadata: this could allow details such as acquisition date to be changed
has potential weakness: W1128: Image replaced with tampered version along with updated stored hash
has reference: Kessler GC. The impact of SHA-1 file hash collisions on digital forensic imaging: A follow-up experiment. Journal of Digital Forensics, Security and Law. 2016;11(4):10.
has reference: Kessler, G.C., 2016. The impact of MD5 file hash collisions on digital forensic imaging. Journal of digital forensics, security and law, 11(4), p.9.
has reference: Lyle, J., 2002. Testing disk imaging tools. DFRWS USA 2002, https://dfrws.org/wp-content/uploads/2019/06/2002_USA_paper-testing_disk_imaging_tools.pdf
technique description: Computing the hash function of the entire contents of a disk, recording it, and then subsequently computing the hash over any disk image created to detect if any content is different (adapted from Lyle 2002)
technique ID: T1042
technique name: Disk image hash verification

T1090: Experimentation
type: Technique
has reference: todo
technique ID: T1090
technique name: Experimentation

T1099: File repair with grafting
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
technique description: Repair file by grafting different reference data onto fragment(s)
technique ID: T1099
technique name: File repair with grafting

T1105: Memory examination (application-level)
type: Technique
technique ID: T1105
technique name: Memory examination (application-level)

T1110: Preserving reference data
type: Technique
has potential weakness: W1172: Relevant reference data missed as its necessity was not known at time of preservation
has reference: Spichiger, H. and Adelstein, F., 2025. Preserving meaning of evidence from evolving systems. Forensic Science International: Digital Investigation, 52, p.301867.
technique details: Reference data may be needed for later trace interpretation, but may change (especially server side software), so relevant data should be preserved close to the time of the event of interest
technique ID: T1110
technique name: Preserving reference data

T1111: Recording system clock offset
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/ClockOffset
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/systemTime
has potential weakness: W1173: Trusted time source is incorrect
technique description: Recording a system clock compared with trusted time source
technique details: Collection of the time of a device clock compared with the correct time, allowing an offset to be calculated *for the point in time when the clock was observed*.
technique ID: T1111
technique name: Recording system clock offset

T1113: Access internal storage via bootable environment
type: Technique
has CASE input class: https://ontology.unifiedcyberontology.org/uco/observable/Computer
has CASE output class: https://ontology.solveit-df.org/solveit/observable/DeviceInterface
has example: PALADIN Forensic - is a modified “live” Linux distribution based on Ubuntu that simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox.
has example: WinFE - Windows Forensic Environment, is forensically sound, bootable Windows operation system that can be burned into USB and plug the USB into suspected device. Then, after changing boot order, booting to the USB to create forensic images from the tested Windows, MacOS and Linux systems.
has potential weakness: W1177: Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence
has potential weakness: W1178: Inability to load the forensic bootable environment due to system configuration
has potential weakness: W1179: Failure to detect internal disk from bootable environment
has potential weakness: W1180: Failing to decrypt internal disk using the bootable environment
has reference: Interpol (2021), Guidelines for digital forensics first responders v7, Ch5 Specific Procedures p34, https://www.interpol.int/content/download/16243/file/Guidelines_to_Digital_Forensics_First_Responders_V7.pdf
has reference: Paladin Forensic Suite, https://sumuri.com/software/paladin/
has reference: WinFE, https://www.winfe.net
technique description: Booting the suspected computer device into forensically-sound bootable software-write blocked operating system in order to image the disks.
technique ID: T1113
technique name: Access internal storage via bootable environment

T1119: Automatically scan for artifact changes caused by app updates
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/TableField
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/filePath
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/hasChanged
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/tableSchema
has example: Discussed in 'Puma: Automatically generating digital forensic reference data triggered by mobile application updates' (Claij-Swart et al. 2025)
has potential weakness: W1191: Missing changes in app artifacts during research since app interaction is needed to cause changes
has reference: Claij-Swart et al. (2025), PUMA (Programmable Utility for Mobile Automation), https://github.com/NetherlandsForensicInstitute/puma
has reference: Claij-Swart, A.A., Oudsen, E., Timbermont, B., Hargreaves, C. and Voigt, L.L., 2025. Automatically generating digital forensic reference data triggered by mobile application updates. Forensic Science International: Digital Investigation, 54, p.301985.
has synonym: App update monitoring
technique description: Monitor every version change of an application to determine if there are changes to the way the app stores data
technique ID: T1119
technique name: Automatically scan for artifact changes caused by app updates

T1127: Keyword search (live) (logical)
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResult
has potential weakness: W1195: Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file
has reference: NIST, 2025. Computer forensics tools & techniques catalog: string search, https://toolcatalog.nist.gov/taxonomy/index.php?ff_id=31
has reference: X-Ways (2025), X-Ways Manual: Logical Search (section 5.11), https://www.x-ways.net/winhex/manual.pdf
has synonym: live search
technique description: Searching for keywords over the raw data, without an index of text content, but on a file by file basis
technique details: This approach can include decoding the individual file formats and content. It can also overcome limitations associated with compressed data or data split due to file fragmentation.
technique ID: T1127
technique name: Keyword search (live) (logical)

T1129: Search for indicators of clock tampering
type: Technique
has reference: Dreier, L.M., Vanini, C., Hargreaves, C.J., Breitinger, F. and Freiling, F., 2024. Beyond timestamps: Integrating implicit timing information into digital forensic timelines. Forensic Science International: Digital Investigation, 49, p.301755.
has reference: Vanini, C., Hargreaves, C.J., van Beek, H. and Breitinger, F., 2024. Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction. Forensic Science International: Digital Investigation, 49, p.301759.
technique description: Searching for indicators that the system clock has been tampered with
technique ID: T1129
technique name: Search for indicators of clock tampering

T1134: Use time anchors to estimate clock offset
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/ClockOffset
has example: Browser caches often contain local timestamps and those derived from external servers
has example: Email headers often record timestamps derived from external mail servers as well as timestamps generated by the local system time
has example: Missed call or voicemail notification messages often include a timestamp derived from an external time source, e.g., missed call from XX on 2018-06-06 at 01:32:49 pm, which can be compared to the local file system time the message was received
has example: Records in web browser history databases contain local timestamps and, in some cases, timestamps from external servers, embedded in URLs
has potential weakness: W1260: Failure to derive clock offset due to inability to locate a suitable time anchor
has potential weakness: W1261: Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring
has potential weakness: W1262: Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time
has potential weakness: W1263: Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring
has reference: C. Vanini, C. Hargreaves, H. van Beek, F. Breitinger, 2024, Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction, Forensic Science International: Digital Investigation, 10.1016/j.fsidi.2024.301759
has synonym: Time anchoring (Vanini et al 2024)
has synonym: Timestamp correlation
technique description: Correlate timestamps from the system clock and an external trusted time source (Time Anchoring)
technique details: Correlate timestamps from the system clock and an external trusted source of time contained in the same artifact, allowing an offset to be estimated *for the point in time the timestamp was recorded*
technique ID: T1134
technique name: Use time anchors to estimate clock offset

T1144: Browser profile enumeration
type: Technique
has potential weakness: W1249: Missing a web browser profile as it was stored outside of the usual browser profile folders
technique description: The enumeration of the separate user profiles set up within a browser
technique ID: T1144
technique name: Browser profile enumeration

T1153: Apply offset to a timestamp
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/DateTimeStamp
has CASE output class: https://ontology.solveit-df.org/solveit/observable/TimelineEntry
has potential weakness: W1264: Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp
has potential weakness: W1265: Offset applied to timestamp is incorrect due to variations in time zone over the history of data source
has potential weakness: W1267: Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source
has potential weakness: W1268: Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used
technique description: Application of a time offset to a timestamp
technique details: This could be a clock offset, a timezone or other reason for a timestamp correction
technique ID: T1153
technique name: Apply offset to a timestamp

T1158: Configure device to enable a service needed for data extraction
type: Technique
has example: Turn on developer mode to make use of Android Debug Bridge (ADB)
has potential weakness: W1274: Inability to enable required service due to locked device
has reference: Android (2025), How to Enable Android Developer Settings: Unlock your Device’s Hidden Potential, https://www.android.com/intl/en_uk/articles/enable-android-developer-settings/
technique description: Change a setting on a device such that a service needed for data extraction is enabled. This may require a user PIN that can be obtained using other techniques.
technique ID: T1158
technique name: Configure device to enable a service needed for data extraction

W1011: Suggesting the existence of a device that does not exist
type: Weakness
has potential mitigation: M1027: Dual tool verification
has potential mitigation: M1058: Checking for other confirmatory indicators of the inferred device's existence.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1011
weakness name: Suggesting the existence of a device that does not exist

W1032: Not all memory is acquired
type: Weakness
has reference: Vömel, S. and Stüttgen, J., 2013. An evaluation platform for forensic memory acquisition software. Digital Investigation, 10, S30-S40.
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1032
weakness name: Not all memory is acquired

W1037: Presenting data as complete, that is in reality a partial set
type: Weakness
has potential mitigation: M1016: Alert user that the data collected is a partial set of data stored on the device
has potential mitigation: M1020: Compare data extracted with full list of installed apps
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1037
weakness name: Presenting data as complete, that is in reality a partial set

W1040: Not considering SD Card acquisition in addition to other extractions performed
type: Weakness
has potential mitigation: M1017: Check for physical presence of SD card
has potential mitigation: M1018: Check if presence of SD card is expected
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1040
weakness name: Not considering SD Card acquisition in addition to other extractions performed

W1041: Not considering file system acquisition as alternative
type: Weakness
has potential mitigation: M1019: Consider if file system acquisition is possible/permitted
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1041
weakness name: Not considering file system acquisition as alternative

W1059: Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical
type: Weakness
has potential mitigation: M1032: Evaluation of the effectiveness of wordlist used for case-type searching
has potential mitigation: M1033: Prioritization of search results based on context
has potential mitigation: M1038: Word list selected such that a practically reviewable number of results are returned
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: true
may result in MISINT: false
weakness ID: W1059
weakness name: Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical

W1132: Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation
type: Weakness
has reference: Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679.
may result in INAC ALT: true
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1132
weakness name: Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation

W1148: Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock
type: Weakness
has potential mitigation: M1101: Apply time offset to timestamp
has potential mitigation: M1225: Estimate clock offset at a specific point in time using time anchoring
has potential mitigation: M1227: Search for indicators of clock tampering
has potential mitigation: M1228: Record system clock offset
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1148
weakness name: Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock

W1195: Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file
type: Weakness
has potential mitigation: M1151: Check keyword results are part of allocated file, or if not perform detailed analysis to determine if the association between keyword results and file is valid
may result in INAC ALT: false
may result in INAC AS: true
may result in INAC COR: false
may result in INAC EX: false
may result in INCOMP: false
may result in MISINT: true
weakness ID: W1195
weakness name: Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file

W1266: Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings
type: Weakness
has potential mitigation: M1101: Apply time offset to timestamp
has potential mitigation: M1224: Check for location artifacts to infer the time zone at a specific moment
has potential mitigation: M1229: Determine last timezone used on system
has potential mitigation: M1230: Ensure that daylight savings offsets that are applied to timestamps are correct
may result in INAC ALT: false
may result in INAC AS: false
may result in INAC COR: false
may result in INAC EX: true
may result in INCOMP: false
may result in MISINT: false
weakness ID: W1266
weakness name: Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings

M1002: Testing of the faraday environment to be used
type: Mitigation
has reference: Lennox-Steele, A., & Nisbet, A. (2016). A forensic examination of several mobile device Faraday bags & materials to test their effectiveness. In Valli, C. (Ed.). (2016). The Proceedings of 14th Australian Digital Forensics Conference, 5-6 December 2016, Edith Cowan University, Perth, Australia. (pp 34-41).
mitigation ID: M1002
mitigation name: Testing of the faraday environment to be used

M1014: Test and document changes made by the tools used
type: Mitigation
has reference: Hargreaves, C.J., 2009. Assessing the reliability of digital evidence from live investigations involving encryption. Chapter 5
mitigation ID: M1014
mitigation name: Test and document changes made by the tools used

M1039: Hash matching to reduce need for manual review
type: Mitigation
mitigation ID: M1039
mitigation name: Hash matching to reduce need for manual review

M1040: Use of AI to flag potentially relevant content to reduce need for manual review
type: Mitigation
mitigation ID: M1040
mitigation name: Use of AI to flag potentially relevant content to reduce need for manual review

M1041: Regular breaks to minimise investigator fatigue
type: Mitigation
mitigation ID: M1041
mitigation name: Regular breaks to minimise investigator fatigue

M1075: Testing programme to validate hashes of data in images is calculated correctly
type: Mitigation
mitigation ID: M1075
mitigation name: Testing programme to validate hashes of data in images is calculated correctly

M1083: Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)
type: Mitigation
mitigation ID: M1083
mitigation name: Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)

M1085: Use of multiple tools to verify disk image hash
type: Mitigation
mitigation ID: M1085
mitigation name: Use of multiple tools to verify disk image hash

M1098: Optimise the brute force search space
type: Mitigation
mitigation ID: M1098
mitigation name: Optimise the brute force search space

M1099: Use a dictionary attack instead
type: Mitigation
links to technique: T1035: Dictionary attack
mitigation ID: M1099
mitigation name: Use a dictionary attack instead

M1101: Apply time offset to timestamp
type: Mitigation
links to technique: T1153: Apply offset to a timestamp
mitigation ID: M1101
mitigation name: Apply time offset to timestamp

M1109: Testing that tool(s) identify file types correctly
type: Mitigation
mitigation ID: M1109
mitigation name: Testing that tool(s) identify file types correctly

M1111: Use of multiple tools to classify file types
type: Mitigation
mitigation ID: M1111
mitigation name: Use of multiple tools to classify file types

M1112: Use of AI to classify files in addition to standard programmatic methods
type: Mitigation
has reference: Alam, S. and Demir, A.K., 2024. SIFT: Sifting file types—application of explainable artificial intelligence in cyber forensics. Cybersecurity, 7(1), p.52.
has reference: Karampidis, K. and Papadourakis, G., 2017. File type identification-computational intelligence for digital forensics. Journal of Digital Forensics, Security and Law, 12(2), p.6.
has reference: https://www.opswat.com/blog/accurate-file-type-detection-powered-by-ai
mitigation ID: M1112
mitigation name: Use of AI to classify files in addition to standard programmatic methods

M1139: Use automated software monitoring to detect app artefact changes
type: Mitigation
links to technique: T1119: Automatically scan for artifact changes caused by app updates
mitigation ID: M1139
mitigation name: Use automated software monitoring to detect app artefact changes

M1164: Testing of account details recovery from AI companion app
type: Mitigation
mitigation ID: M1164
mitigation name: Testing of account details recovery from AI companion app

M1224: Check for location artifacts to infer the time zone at a specific moment
type: Mitigation
mitigation ID: M1224
mitigation name: Check for location artifacts to infer the time zone at a specific moment

T1034: Brute force attack
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/password
has potential weakness: W1140: Failing to determine password as it is not in the search space
has potential weakness: W1141: Failing to determine password via brute force in the time available
has potential weakness: W1142: System locks after X failed brute force attempts
has reference: Kanta, A., Coray, S., Coisel, I. and Scanlon, M., 2021. How viable is password cracking in digital forensic investigation? Analyzing the guessability of over 3.9 billion real-world accounts. Forensic Science International: Digital Investigation, 37, p.301186.
has synonym: exhaustive password search
technique description: A brute force attack, or exhaustive search is a password cracking approach where every combination of characters is tested until the correct one is found. This method is "guaranteed to work" given infinite time and resources which in a real-life scenario is not feasible.
technique details: Brute force attack involves trying every possible combination in a defined search space to find the correct value. The search space could be limited to just numbers, for example in the case of a 4-digit PIN number, or alphanumerical values or even the full ASCII character set. The larger the search space, the longer it takes to complete a brute force attack.
technique ID: T1034
technique name: Brute force attack

T1037: Obtain password from the device owner
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/password
technique ID: T1037
technique name: Obtain password from the device owner

T1040: Use mobile device exploit
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/isPrivileged
has example: Checkra1n, https://checkra.in
has potential weakness: W1157: Use of mobile exploit changes/overwrites data that was relevant to the investigation
has potential weakness: W1158: Use of mobile exploit renders device unusable or 'bricked'
has reference: Grover, J., 2013. Android forensics: Automated data collection and reporting from a mobile device. Digital Investigation, 10, pp.S12-S20.
technique description: A process that typically exploits a security flaw in a specific device or operating system to enable users to perform higher privileged functions on a device (derived from Grover 2013)
technique ID: T1040
technique name: Use mobile device exploit

T1125: Keyword search (live)
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResult
has potential weakness: W1200: Failure to conduct iterative keyword searching due to excessive time taken per search
has reference: NIST, 2025. Computer forensics tools & techniques catalog: string search, https://toolcatalog.nist.gov/taxonomy/index.php?ff_id=31
has reference: X-Ways (2025), X-Ways Manual: Logical Search (section 5.11), https://www.x-ways.net/winhex/manual.pdf
has reference: X-Ways (2025), X-Ways Manual: Simultaneous Search (section 5.10), https://www.x-ways.net/winhex/manual.pdf
has synonym: live search
technique description: Searching for keywords over the raw data in a case without using an index of text content
technique details: This may be done on a physical sector basis, or on a logical (file) basis.
technique ID: T1125
technique name: Keyword search (live)

T1138: Browser cache examination
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/httpResponseHeader
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/File
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/SQLiteBlob
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/httpRequestHeader
has potential weakness: W1252: Assuming that data stored in the cache was viewed by the user
has synonym: internet cache examination
has synonym: web cache examination
technique description: The examination of the content saved locally by browsers to improve performance
technique ID: T1138
technique name: Browser cache examination

T1143: Browser configuration examination
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
technique description: The examination of a browsers configuration
technique ID: T1143
technique name: Browser configuration examination

M1004: Check hash of image matches hash of source device
type: Mitigation
links to technique: T1042: Disk image hash verification
mitigation ID: M1004
mitigation name: Check hash of image matches hash of source device

M1007: Use hardware write blocker
type: Mitigation
links to technique: T1012: Connect storage medium via hardware write blocker
mitigation ID: M1007
mitigation name: Use hardware write blocker

M1026: Testing of backup parsing method
type: Mitigation
mitigation ID: M1026
mitigation name: Testing of backup parsing method

T1035: Dictionary attack
type: Technique
has CASE output class: https://ontology.unifiedcyberontology.org/uco/observable/password
has potential weakness: W1137: Failing to determine password as it is not in the dictionary used
has potential weakness: W1138: Failing to identify password in the time available
has potential weakness: W1139: System locks after X failed dictionary attempts
has reference: Kanta, A., Coisel, I. and Scanlon, M., 2021, December. PCWQ: A framework for evaluating password cracking wordlist quality. In International Conference on Digital Forensics and Cyber Crime (pp. 159-175). Cham: Springer International Publishing.
technique description: A dictionary attack is a password cracking technique where an attacker uses a list of passwords, called a dictionary, to attempt to guess a password.
technique details: Dictionary attacks use list compiled common passwords that are likely to be used by people, such as dictionary words, names, common patterns or existing lists of popular or leaked passwords. Therefore, success depends on the quality and of dictionary list.
technique ID: T1035
technique name: Dictionary attack

T1124: Keyword search (indexed)
type: Technique
has CASE output class: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResult
has potential weakness: W1052: Incorrect retrieval of results from an index
has reference: NIST, 2025. Computer forensics tools & techniques catalog: string search, https://toolcatalog.nist.gov/taxonomy/index.php?ff_id=31
has synonym: indexed search
technique description: Searching for keywords within a generated index of data in a case
technique ID: T1124
technique name: Keyword search (indexed)

M1008: Use software write blocker
type: Mitigation
links to technique: T1013: Use software write blockers to provide read only access to storage media
mitigation ID: M1008
mitigation name: Use software write blocker

M1029: Testing of keyword indexing component of tool
type: Mitigation
mitigation ID: M1029
mitigation name: Testing of keyword indexing component of tool

M1154: Testing for live message recovery from AI companion app
type: Mitigation
mitigation ID: M1154
mitigation name: Testing for live message recovery from AI companion app

M1034: Comparison of index results with live search results
type: Mitigation
links to technique: T1125: Keyword search (live)
mitigation ID: M1034
mitigation name: Comparison of index results with live search results

M1079: Analyse file content to detect incompatibility between the content and the recovered file system metadata
type: Mitigation
mitigation ID: M1079
mitigation name: Analyse file content to detect incompatibility between the content and the recovered file system metadata

M1080: Use a hashset of known files to detect that recovered content does not match the expected file content
type: Mitigation
mitigation ID: M1080
mitigation name: Use a hashset of known files to detect that recovered content does not match the expected file content

M1081: Check if recovered content matches with size in metadata e.g. file footer at expected location.
type: Mitigation
mitigation ID: M1081
mitigation name: Check if recovered content matches with size in metadata e.g. file footer at expected location.

M1155: Testing for deleted message recovery from AI companion app
type: Mitigation
mitigation ID: M1155
mitigation name: Testing for deleted message recovery from AI companion app

M1158: Testing for live picture message recovery from AI companion app
type: Mitigation
mitigation ID: M1158
mitigation name: Testing for live picture message recovery from AI companion app

M1159: Testing for deleted picture message recovery from AI companion app
type: Mitigation
mitigation ID: M1159
mitigation name: Testing for deleted picture message recovery from AI companion app

M1161: Testing of live call record recovery from AI companion app
type: Mitigation
mitigation ID: M1161
mitigation name: Testing of live call record recovery from AI companion app

M1162: Testing of deleted call record recovery from AI companion app
type: Mitigation
mitigation ID: M1162
mitigation name: Testing of deleted call record recovery from AI companion app

M1097: Attempt to obtain password/passcode from the device owner
type: Mitigation
links to technique: T1037: Obtain password from the device owner
mitigation ID: M1097
mitigation name: Attempt to obtain password/passcode from the device owner

M1231: Make use of 'paired searching'
type: Mitigation
has reference: Fisher & Fisher. 2012, Techniques of Crime Scene Investigation, Eighth Edition, p82
mitigation description: According to Fisher & Fisher (2012): "Indoor crime scene searches are best done with two persons. One easy way of accomplishing a search in a room is to divide it in half. Each investigator searches one half. After they have done a thorough search, they switch halves."
mitigation ID: M1231
mitigation name: Make use of 'paired searching'

M1056: Correlation of message data from third party data (another participant in message thread)
type: Mitigation
mitigation ID: M1056
mitigation name: Correlation of message data from third party data (another participant in message thread)

M1051: Validation of specific file system parsing operation for the file system under consideration
type: Mitigation
mitigation ID: M1051
mitigation name: Validation of specific file system parsing operation for the file system under consideration

M1052: Use of a second independent tool to compare live file system listing
type: Mitigation
mitigation ID: M1052
mitigation name: Use of a second independent tool to compare live file system listing

M1053: Verification of the file system specification used as the basis for the tool development
type: Mitigation
mitigation ID: M1053
mitigation name: Verification of the file system specification used as the basis for the tool development

M1054: Testing of message extraction and parsing features
type: Mitigation
mitigation ID: M1054
mitigation name: Testing of message extraction and parsing features

M1055: Correlation of data extracted with data from service provider
type: Mitigation
mitigation ID: M1055
mitigation name: Correlation of data extracted with data from service provider

M1050: Manual verification of relevant data
type: Mitigation
mitigation ID: M1050
mitigation name: Manual verification of relevant data

M1027: Dual tool verification
type: Mitigation
mitigation ID: M1027
mitigation name: Dual tool verification