@prefix : <https://ontology.solveit-df.org/solveit/data/> .
@prefix case-investigation: <https://ontology.caseontology.org/case/investigation/> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
@prefix solveit-analysis: <https://ontology.solveit-df.org/solveit/analysis/> .
@prefix solveit-core: <https://ontology.solveit-df.org/solveit/core/> .
@prefix solveit-observable: <https://ontology.solveit-df.org/solveit/observable/> .
@prefix uco-core: <https://ontology.unifiedcyberontology.org/uco/core/> .
@prefix uco-observable: <https://ontology.unifiedcyberontology.org/uco/observable/> .
@prefix xsd: <http://www.w3.org/2001/XMLSchema#> .

#################################################################
#    SOLVE-IT Knowledge Base
#
#    Generated from the SOLVE-IT knowledge base JSON by
#    reporting_scripts/generate_rdf_from_kb.py. Do not edit by hand.
#
#      Objectives:     24
#      Techniques:     200
#      Weaknesses:     441
#      Mitigations:    336
#      Citations:      164
#################################################################

#################################################################
#    Objectives (24)
#
#    Investigation objectives, each listing the techniques that can achieve it.
#    Ordered by solveit-core:sortOrder, which is the order objectives are
#    worked through in an investigation, not by DFO identifier.
#################################################################

:objectiveDFO-1015
    a solveit-core:Objective ;
    rdfs:label "DFO-1015: Prepare for a digital investigation"@en ;
    solveit-core:objectiveID "DFO-1015" ;
    solveit-core:objectiveName "Prepare for a digital investigation" ;
    solveit-core:objectiveDescription "Conduct activities in preparation of conducting a digital investigation" ;
    solveit-core:sortOrder "0"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1110 .

:objectiveDFO-1014
    a solveit-core:Objective ;
    rdfs:label "DFO-1014: Find potential digital evidence sources"@en ;
    solveit-core:objectiveID "DFO-1014" ;
    solveit-core:objectiveName "Find potential digital evidence sources" ;
    solveit-core:objectiveDescription "Locate sources of digital evidence that may be relevant to the investigation." ;
    solveit-core:sortOrder "1"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1005,
                                   :techniqueDFT-1006,
                                   :techniqueDFT-1007,
                                   :techniqueDFT-1008,
                                   :techniqueDFT-1009 .

:objectiveDFO-1005
    a solveit-core:Objective ;
    rdfs:label "DFO-1005: Prioritize digital evidence sources"@en ;
    solveit-core:objectiveID "DFO-1005" ;
    solveit-core:objectiveName "Prioritize digital evidence sources" ;
    solveit-core:objectiveDescription "Rank the evidence sources based on their relevance and potential value to the investigation." ;
    solveit-core:sortOrder "2"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1001 .

:objectiveDFO-1010
    a solveit-core:Objective ;
    rdfs:label "DFO-1010: Preserve digital evidence"@en ;
    solveit-core:objectiveID "DFO-1010" ;
    solveit-core:objectiveName "Preserve digital evidence" ;
    solveit-core:objectiveDescription "Ensure the integrity and authenticity of digital evidence is maintained." ;
    solveit-core:sortOrder "3"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1010,
                                   :techniqueDFT-1011,
                                   :techniqueDFT-1012,
                                   :techniqueDFT-1013,
                                   :techniqueDFT-1114,
                                   :techniqueDFT-1192 .

:objectiveDFO-1021
    a solveit-core:Objective ;
    rdfs:label "DFO-1021: Access device data for acquisition"@en ;
    solveit-core:objectiveID "DFO-1021" ;
    solveit-core:objectiveName "Access device data for acquisition" ;
    solveit-core:objectiveDescription "Connect to physical sources of digital evidence to facilitate data extraction" ;
    solveit-core:sortOrder "4"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1028,
                                   :techniqueDFT-1029,
                                   :techniqueDFT-1112,
                                   :techniqueDFT-1113,
                                   :techniqueDFT-1166,
                                   :techniqueDFT-1171 .

:objectiveDFO-1016
    a solveit-core:Objective ;
    rdfs:label "DFO-1016: Overcome protection mechanisms"@en ;
    solveit-core:objectiveID "DFO-1016" ;
    solveit-core:objectiveName "Overcome protection mechanisms" ;
    solveit-core:objectiveDescription "Attempt to gain access to protected data sources or other restricted data." ;
    solveit-core:sortOrder "5"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1031,
                                   :techniqueDFT-1032,
                                   :techniqueDFT-1033,
                                   :techniqueDFT-1034,
                                   :techniqueDFT-1035,
                                   :techniqueDFT-1036,
                                   :techniqueDFT-1037,
                                   :techniqueDFT-1038,
                                   :techniqueDFT-1039,
                                   :techniqueDFT-1040,
                                   :techniqueDFT-1041,
                                   :techniqueDFT-1158 .

:objectiveDFO-1006
    a solveit-core:Objective ;
    rdfs:label "DFO-1006: Acquire data"@en ;
    solveit-core:objectiveID "DFO-1006" ;
    solveit-core:objectiveName "Acquire data" ;
    solveit-core:objectiveDescription "Collect data from the identified evidence sources." ;
    solveit-core:sortOrder "6"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1002,
                                   :techniqueDFT-1003,
                                   :techniqueDFT-1004,
                                   :techniqueDFT-1016,
                                   :techniqueDFT-1017,
                                   :techniqueDFT-1018,
                                   :techniqueDFT-1020,
                                   :techniqueDFT-1022,
                                   :techniqueDFT-1023,
                                   :techniqueDFT-1024,
                                   :techniqueDFT-1030,
                                   :techniqueDFT-1104,
                                   :techniqueDFT-1111,
                                   :techniqueDFT-1157,
                                   :techniqueDFT-1159,
                                   :techniqueDFT-1160,
                                   :techniqueDFT-1161,
                                   :techniqueDFT-1162,
                                   :techniqueDFT-1163,
                                   :techniqueDFT-1164,
                                   :techniqueDFT-1175,
                                   :techniqueDFT-1198 .

:objectiveDFO-1022
    a solveit-core:Objective ;
    rdfs:label "DFO-1022: Store acquired data"@en ;
    solveit-core:objectiveID "DFO-1022" ;
    solveit-core:objectiveName "Store acquired data" ;
    solveit-core:objectiveDescription "Store acquired data in one or more formats for subsequent examination and analysis" ;
    solveit-core:sortOrder "7"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1025,
                                   :techniqueDFT-1026,
                                   :techniqueDFT-1178,
                                   :techniqueDFT-1208 .

:objectiveDFO-1018
    a solveit-core:Objective ;
    rdfs:label "DFO-1018: Read data from digital evidence storage formats"@en ;
    solveit-core:objectiveID "DFO-1018" ;
    solveit-core:objectiveName "Read data from digital evidence storage formats" ;
    solveit-core:objectiveDescription "Access data within digital evidence containers such as disk images, memory dumps, or archive formats." ;
    solveit-core:sortOrder "8"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1042,
                                   :techniqueDFT-1043,
                                   :techniqueDFT-1044,
                                   :techniqueDFT-1045,
                                   :techniqueDFT-1102,
                                   :techniqueDFT-1170,
                                   :techniqueDFT-1172,
                                   :techniqueDFT-1173,
                                   :techniqueDFT-1174,
                                   :techniqueDFT-1193,
                                   :techniqueDFT-1199,
                                   :techniqueDFT-1204 .

:objectiveDFO-1007
    a solveit-core:Objective ;
    rdfs:label "DFO-1007: Reduce data under consideration"@en ;
    solveit-core:objectiveID "DFO-1007" ;
    solveit-core:objectiveName "Reduce data under consideration" ;
    solveit-core:objectiveDescription "Filter the data to be considered in the investigation for practical, legal, or privacy protection reasons." ;
    solveit-core:sortOrder "9"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1046,
                                   :techniqueDFT-1047,
                                   :techniqueDFT-1048 .

:objectiveDFO-1013
    a solveit-core:Objective ;
    rdfs:label "DFO-1013: Access partitions, volumes and file systems data"@en ;
    solveit-core:objectiveID "DFO-1013" ;
    solveit-core:objectiveName "Access partitions, volumes and file systems data" ;
    solveit-core:objectiveDescription "Process core data storage structures such as partitions, volumes, and file systems, recovering content and metadata." ;
    solveit-core:sortOrder "10"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1059,
                                   :techniqueDFT-1060,
                                   :techniqueDFT-1061,
                                   :techniqueDFT-1062,
                                   :techniqueDFT-1063,
                                   :techniqueDFT-1168 .

:objectiveDFO-1017
    a solveit-core:Objective ;
    rdfs:label "DFO-1017: Extract artifacts stored by the operating system"@en ;
    solveit-core:objectiveID "DFO-1017" ;
    solveit-core:objectiveName "Extract artifacts stored by the operating system" ;
    solveit-core:objectiveDescription "Process data stored by the operating system to extract digital forensic artifacts." ;
    solveit-core:sortOrder "11"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1065,
                                   :techniqueDFT-1066,
                                   :techniqueDFT-1067,
                                   :techniqueDFT-1068,
                                   :techniqueDFT-1083,
                                   :techniqueDFT-1096,
                                   :techniqueDFT-1097,
                                   :techniqueDFT-1098,
                                   :techniqueDFT-1116,
                                   :techniqueDFT-1149,
                                   :techniqueDFT-1180,
                                   :techniqueDFT-1185,
                                   :techniqueDFT-1190,
                                   :techniqueDFT-1196,
                                   :techniqueDFT-1197 .

:objectiveDFO-1011
    a solveit-core:Objective ;
    rdfs:label "DFO-1011: Extract artifacts stored by applications"@en ;
    solveit-core:objectiveID "DFO-1011" ;
    solveit-core:objectiveName "Extract artifacts stored by applications" ;
    solveit-core:objectiveDescription "Process data stored by the applications to extract digital forensic artifacts." ;
    solveit-core:sortOrder "12"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1069,
                                   :techniqueDFT-1070,
                                   :techniqueDFT-1072,
                                   :techniqueDFT-1073,
                                   :techniqueDFT-1074,
                                   :techniqueDFT-1075,
                                   :techniqueDFT-1077,
                                   :techniqueDFT-1078,
                                   :techniqueDFT-1105,
                                   :techniqueDFT-1107,
                                   :techniqueDFT-1108,
                                   :techniqueDFT-1109,
                                   :techniqueDFT-1133,
                                   :techniqueDFT-1177,
                                   :techniqueDFT-1179,
                                   :techniqueDFT-1181 .

:objectiveDFO-1002
    a solveit-core:Objective ;
    rdfs:label "DFO-1002: Extract data from specific formats"@en ;
    solveit-core:objectiveID "DFO-1002" ;
    solveit-core:objectiveName "Extract data from specific formats" ;
    solveit-core:objectiveDescription "Process data to extract artifacts from specific data formats." ;
    solveit-core:sortOrder "13"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1071,
                                   :techniqueDFT-1099,
                                   :techniqueDFT-1100,
                                   :techniqueDFT-1167,
                                   :techniqueDFT-1187,
                                   :techniqueDFT-1191,
                                   :techniqueDFT-1205,
                                   :techniqueDFT-1206 .

:objectiveDFO-1023
    a solveit-core:Objective ;
    rdfs:label "DFO-1023: Extract specific artifact types"@en ;
    solveit-core:objectiveID "DFO-1023" ;
    solveit-core:objectiveName "Extract specific artifact types" ;
    solveit-core:objectiveDescription "Process data to extract specific types of artifact" ;
    solveit-core:sortOrder "14"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1021,
                                   :techniqueDFT-1052,
                                   :techniqueDFT-1053,
                                   :techniqueDFT-1056,
                                   :techniqueDFT-1076,
                                   :techniqueDFT-1120,
                                   :techniqueDFT-1121,
                                   :techniqueDFT-1165,
                                   :techniqueDFT-1169,
                                   :techniqueDFT-1186 .

:objectiveDFO-1012
    a solveit-core:Objective ;
    rdfs:label "DFO-1012: Locate potentially relevant content"@en ;
    solveit-core:objectiveID "DFO-1012" ;
    solveit-core:objectiveName "Locate potentially relevant content" ;
    solveit-core:objectiveDescription "Attempt to find digital artifacts relevant to the investigation." ;
    solveit-core:sortOrder "15"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1049,
                                   :techniqueDFT-1050,
                                   :techniqueDFT-1051,
                                   :techniqueDFT-1086,
                                   :techniqueDFT-1118,
                                   :techniqueDFT-1203 .

:objectiveDFO-1003
    a solveit-core:Objective ;
    rdfs:label "DFO-1003: Review content for relevance"@en ;
    solveit-core:objectiveID "DFO-1003" ;
    solveit-core:objectiveName "Review content for relevance" ;
    solveit-core:objectiveDescription "Review potentially relevant content to determine its significance or meaning." ;
    solveit-core:sortOrder "16"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1054,
                                   :techniqueDFT-1055,
                                   :techniqueDFT-1079,
                                   :techniqueDFT-1080,
                                   :techniqueDFT-1081,
                                   :techniqueDFT-1082 .

:objectiveDFO-1019
    a solveit-core:Objective ;
    rdfs:label "DFO-1019: Detect anti-forensics and other anomalies"@en ;
    solveit-core:objectiveID "DFO-1019" ;
    solveit-core:objectiveName "Detect anti-forensics and other anomalies" ;
    solveit-core:objectiveDescription "Search for indicators of anti-forensic techniques or other anomalies such as malware, which could affect interpretation." ;
    solveit-core:sortOrder "17"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1057,
                                   :techniqueDFT-1058,
                                   :techniqueDFT-1128,
                                   :techniqueDFT-1129,
                                   :techniqueDFT-1130,
                                   :techniqueDFT-1131,
                                   :techniqueDFT-1132 .

:objectiveDFO-1008
    a solveit-core:Objective ;
    rdfs:label "DFO-1008: Establish identities"@en ;
    solveit-core:objectiveID "DFO-1008" ;
    solveit-core:objectiveName "Establish identities" ;
    solveit-core:objectiveDescription "Attempt to link data or devices to individuals." ;
    solveit-core:sortOrder "18"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1084,
                                   :techniqueDFT-1085 .

:objectiveDFO-1009
    a solveit-core:Objective ;
    rdfs:label "DFO-1009: Create visualizations"@en ;
    solveit-core:objectiveID "DFO-1009" ;
    solveit-core:objectiveName "Create visualizations" ;
    solveit-core:objectiveDescription "Display information using visual representations to assist with analysis." ;
    solveit-core:sortOrder "19"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1103,
                                   :techniqueDFT-1115 .

:objectiveDFO-1004
    a solveit-core:Objective ;
    rdfs:label "DFO-1004: Conduct research"@en ;
    solveit-core:objectiveID "DFO-1004" ;
    solveit-core:objectiveName "Conduct research" ;
    solveit-core:objectiveDescription "Conduct research to gain additional knowledge to support the acquisition, extraction, or interpretation of digital evidence." ;
    solveit-core:sortOrder "20"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1089,
                                   :techniqueDFT-1090,
                                   :techniqueDFT-1095,
                                   :techniqueDFT-1101,
                                   :techniqueDFT-1119 .

:objectiveDFO-1001
    a solveit-core:Objective ;
    rdfs:label "DFO-1001: Reconstruct events"@en ;
    solveit-core:objectiveID "DFO-1001" ;
    solveit-core:objectiveName "Reconstruct events" ;
    solveit-core:objectiveDescription "Use available digital evidence to formulate and test hypotheses about events." ;
    solveit-core:sortOrder "21"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1087,
                                   :techniqueDFT-1088,
                                   :techniqueDFT-1117,
                                   :techniqueDFT-1154,
                                   :techniqueDFT-1155,
                                   :techniqueDFT-1156 .

:objectiveDFO-1024
    a solveit-core:Objective ;
    rdfs:label "DFO-1024: Evaluate evidence"@en ;
    solveit-core:objectiveID "DFO-1024" ;
    solveit-core:objectiveName "Evaluate evidence" ;
    solveit-core:objectiveDescription "Evaluate evidence " ;
    solveit-core:sortOrder "22"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1195,
                                   :techniqueDFT-1200,
                                   :techniqueDFT-1202 .

:objectiveDFO-1020
    a solveit-core:Objective ;
    rdfs:label "DFO-1020: Document digital forensic activities"@en ;
    solveit-core:objectiveID "DFO-1020" ;
    solveit-core:objectiveName "Document digital forensic activities" ;
    solveit-core:objectiveDescription "Create documentation about techniques used and findings." ;
    solveit-core:sortOrder "23"^^xsd:integer ;
    solveit-core:includesTechnique :techniqueDFT-1014,
                                   :techniqueDFT-1091,
                                   :techniqueDFT-1092,
                                   :techniqueDFT-1093,
                                   :techniqueDFT-1094 .

#################################################################
#    Techniques (200)
#
#    Each technique is an instance of the solveit-core:Technique metaclass AND
#    an owl:Class in its own right, following uco-action:Technique (UCO 1.5.0).
#    A performed investigative action is typed with the technique class it
#    implements. Root techniques are rdfs:subClassOf
#    solveit-core:SolveitInvestigativeAction; sub-techniques are
#    rdfs:subClassOf their parent technique and inherit the anchor through it.
#################################################################

:techniqueDFT-1001
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1001: Triage devices or media"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1001" ;
    solveit-core:techniqueName "Triage devices or media" ;
    solveit-core:techniqueDescription "Digital forensic triage is a partial forensic examination conducted under (significant) time and resource constraints [DFCite-1115]." ;
    solveit-core:techniqueDetails "Involves the ranking of apprehended digital items in terms of their importance to a case and likelihood that they contain the data required [DFCite-1131]. It can involve multiple techniques to identify devices of most interest such as keyword searching, hash matching, media review etc." ;
    solveit-core:hasCASEInputClass solveit-observable:DeviceSet ;
    solveit-core:hasCASEOutputClass solveit-observable:PrioritizedDeviceSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1001,
                                      :weaknessDFW-1002,
                                      :weaknessDFW-1003 ;
    solveit-core:hasReference :citationDFCite-1115,
                              :citationDFCite-1131 .

:techniqueDFT-1002
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1002: Copy sectors from storage media"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1002" ;
    solveit-core:techniqueName "Copy sectors from storage media" ;
    solveit-core:techniqueDescription "Copying of sectors from a storage media, typically LBA~0~ to LBA~max~ to a bitstream that can be stored in a image format (DFT-1025)." ;
    solveit-core:techniqueDetails "The process could be applied to a traditional hard disk, SSD, USB stick, or data from an eMMC chip that has been desoldered and placed in a reader. This data needs to be stored as a container file (DFT-1025). Logs would also usually be created recording the details of the imaging process and any errors that occured." ;
    solveit-core:hasSynonym "disk imaging" ;
    solveit-core:hasExample "FTK Imager",
                            "Magnet ACQUIRE",
                            "dcfldd" ;
    solveit-core:hasCASEInputClass solveit-observable:ReadWriteDeviceInterface,
                                   solveit-observable:WriteProtectedDeviceInterface ;
    solveit-core:hasCASEOutputClass solveit-observable:Bitstream ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1004,
                                      :weaknessDFW-1006,
                                      :weaknessDFW-1007,
                                      :weaknessDFW-1013,
                                      :weaknessDFW-1014,
                                      :weaknessDFW-1015,
                                      :weaknessDFW-1016,
                                      :weaknessDFW-1136,
                                      :weaknessDFW-1143,
                                      :weaknessDFW-1278 ;
    solveit-core:hasReference :citationDFCite-1107 .

:techniqueDFT-1003
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1003: Copy pages from physical memory"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1003" ;
    solveit-core:techniqueName "Copy pages from physical memory" ;
    solveit-core:techniqueDescription "Involves creating a copy of the live memory data of a running system" ;
    solveit-core:techniqueDetails "Collection of Pagefile may also be useful (Kornblum 2007)." ;
    solveit-core:hasSynonym "Memory imaging",
                            "RAM dump",
                            "RAM imaging",
                            "memory dump" ;
    solveit-core:hasExample "FTK Imager" ;
    solveit-core:hasCASEInputClass uco-observable:Memory ;
    solveit-core:hasCASEOutputClass solveit-observable:Bitstream ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1029,
                                      :weaknessDFW-1030,
                                      :weaknessDFW-1031,
                                      :weaknessDFW-1032,
                                      :weaknessDFW-1033 ;
    solveit-core:hasReference :citationDFCite-1025,
                              :citationDFCite-1084,
                              :citationDFCite-1085 .

:techniqueDFT-1004
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1004: Collect logical files selectively"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1004" ;
    solveit-core:techniqueName "Collect logical files selectively" ;
    solveit-core:techniqueDescription "Views a set of files (typically via direct access from previewing) and acquires a subset of them." ;
    solveit-core:techniqueDetails "This selection of files would subsequently be stored into a container such as a tar/zip file or a forensic image format." ;
    solveit-core:hasSynonym "Logical acquisition",
                            "Logical imaging" ;
    solveit-core:hasExample "FTK Imager - allows an AD1 logical container to be created of a selected subset of files within a previewed data source." ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-observable:FilteredFileSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1017,
                                      :weaknessDFW-1018,
                                      :weaknessDFW-1019,
                                      :weaknessDFW-1020,
                                      :weaknessDFW-1021,
                                      :weaknessDFW-1022,
                                      :weaknessDFW-1023,
                                      :weaknessDFW-1024 ;
    solveit-core:hasSubtechnique :techniqueDFT-1015 .

:techniqueDFT-1005
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1005: Search a crime scene for relevant physical evidence"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1005" ;
    solveit-core:techniqueName "Search a crime scene for relevant physical evidence" ;
    solveit-core:techniqueDescription "The process of 'carefully documenting the conditions at a crime scene and identifying all relevant physical evidence.' (Birzer 2018)." ;
    solveit-core:techniqueDetails """The UK's Forensic Science Regulator (FSR) guidance refers to "Incident scene examination" which takes a holistic approach and considers an incident scene in conjunction with the requirements of an investigation and the criminal justice system. The aim of incident scene examination is to identify and locate, or note the absence of, physical material which has relevance and significance to inform the investigation including, where relevant, the reconstruction of past events.
The techqniue does not restrict to searching for digital devices as other physical objects may be relevant e.g. contain passwords.""" ;
    solveit-core:hasSynonym "Crime scene examination",
                            "Crime scene investigation",
                            "Crime scene processing",
                            "Incident scene examination",
                            "Scene search" ;
    solveit-core:hasCASEOutputClass solveit-observable:DeviceSet,
                                    uco-observable:Device,
                                    uco-observable:location ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1114 ;
    solveit-core:hasReference :citationDFCite-1018,
                              :citationDFCite-1044 .

:techniqueDFT-1006
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1006: Search a crime scene using digital sniffer dogs"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1006" ;
    solveit-core:techniqueName "Search a crime scene using digital sniffer dogs" ;
    solveit-core:techniqueDescription "The use of canines to locate obscured digital storage devices." ;
    solveit-core:hasSynonym "Digi-dogs",
                            "Digital Storage Device Dogs",
                            "Digital detection dogs",
                            "Electronic Storage Detection (ESD) sniffing dog",
                            "Storage Detection Police Dogs" ;
    solveit-core:hasCASEOutputClass uco-observable:Device,
                                    uco-observable:location ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1005 ;
    solveit-core:hasReference :citationDFCite-1114 .

:techniqueDFT-1007
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1007: Detect the potential existence of digital devices using a SyncTriage-based approach"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1007" ;
    solveit-core:techniqueName "Detect the potential existence of digital devices using a SyncTriage-based approach" ;
    solveit-core:techniqueDescription "A technique developed in Hargreaves & Marshall (2018) whereby synchronization artifacts on a device are examined and used to identify the existence of a related device. Also sometimes used to infer activity that occurred on an inaccessible or unavailable device. " ;
    solveit-core:hasExample "SyncTriage - https://bitbucket.org/chrishargreaves/synctriage" ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1008,
                                      :weaknessDFW-1009,
                                      :weaknessDFW-1010,
                                      :weaknessDFW-1011,
                                      :weaknessDFW-1012 ;
    solveit-core:hasReference :citationDFCite-1057 .

:techniqueDFT-1008
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1008: Detect the potential existence of digital devices by profiling network traffic"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1008" ;
    solveit-core:techniqueName "Detect the potential existence of digital devices by profiling network traffic" .

:techniqueDFT-1009
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1009: Locate potential digital evidence sources via cloud account identifiers"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1009" ;
    solveit-core:techniqueName "Locate potential digital evidence sources via cloud account identifiers" .

:techniqueDFT-1010
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1010: Place device in a faraday environment"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1010" ;
    solveit-core:techniqueName "Place device in a faraday environment" ;
    solveit-core:techniqueDescription "Place a device in an environment designed to shield a mobile phone or small digital device from radio waves entering the environment and reaching the device, and to stop radio waves escaping from the environment (adapted from Lennox-Steele & Nisbet (2016))" ;
    solveit-core:techniqueDetails "Environment should block: mobile network, Wi-Fi, and Bluetooth and all other RF." ;
    solveit-core:hasCASEInputClass uco-observable:Device ;
    solveit-core:hasCASEOutputClass uco-observable:Device ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1115,
                                      :weaknessDFW-1116,
                                      :weaknessDFW-1117 ;
    solveit-core:hasReference :citationDFCite-1086 .

:techniqueDFT-1011
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1011: Store seized devices or media in evidence bags"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1011" ;
    solveit-core:techniqueName "Store seized devices or media in evidence bags" ;
    solveit-core:hasCASEInputClass uco-observable:Device ;
    solveit-core:hasCASEOutputClass case-investigation:exhibitNumber,
                                    uco-observable:Device .

:techniqueDFT-1012
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1012: Write protect storage media using a hardware write blocker"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1012" ;
    solveit-core:techniqueName "Write protect storage media using a hardware write blocker" ;
    solveit-core:techniqueDescription "A hardware write blocking device [should] prevent any change to data in the user area of a hard drive while allowing access to all data on a hard drive. (Lyle 2006)" ;
    solveit-core:techniqueDetails "Note that \"Sometimes it may be desirable to change a drive configuration to obtain access to otherwise hidden sectors, for example, such as within an HPA (host protected area).\" (Lyle 2006) " ;
    solveit-core:hasCASEInputClass uco-observable:StorageMedium ;
    solveit-core:hasCASEOutputClass solveit-observable:WriteProtectedDeviceInterface ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1118,
                                      :weaknessDFW-1119,
                                      :weaknessDFW-1120 ;
    solveit-core:hasReference :citationDFCite-1089 .

:techniqueDFT-1013
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1013: Write protect storage media using a software write blocker"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1013" ;
    solveit-core:techniqueName "Write protect storage media using a software write blocker" ;
    solveit-core:techniqueDescription "Use of a software-based tool that prevents a computer from writing to computer storage media connected to it (NIST 2006)" ;
    solveit-core:techniqueDetails "Note that both read/write and write protected interfaces are specified as input since a software write blocker could be applied to a hardware write protected interface." ;
    solveit-core:hasCASEInputClass solveit-observable:ReadWriteDeviceInterface,
                                   solveit-observable:WriteProtectedDeviceInterface ;
    solveit-core:hasCASEOutputClass solveit-observable:WriteProtectedDeviceInterface ;
    solveit-core:hasReference :citationDFCite-1102 .

:techniqueDFT-1014
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1014: Document the chain of custody"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1014" ;
    solveit-core:techniqueName "Document the chain of custody" ;
    solveit-core:techniqueDescription "A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer [DFCite-1147]." ;
    solveit-core:hasSynonym "CoC",
                            "Continuity of evidence" ;
    solveit-core:hasCASEInputClass case-investigation:ProvenanceRecord ;
    solveit-core:hasCASEOutputClass case-investigation:ProvenanceRecord ;
    solveit-core:hasReference :citationDFCite-1147 .

:techniqueDFT-1015
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1015: Collect logical files selectively based on privacy preserving criteria"@en ;
    rdfs:subClassOf :techniqueDFT-1004 ;
    solveit-core:techniqueID "DFT-1015" ;
    solveit-core:techniqueName "Collect logical files selectively based on privacy preserving criteria" ;
    solveit-core:techniqueDescription "Previewing a data source and selecting a subset of the data for collection into a container such as a tar/zip file or a forensic image format for the purposes of protecting the privacy of the complainant or witness." ;
    solveit-core:hasExample "Cellebrite - Allows filtering by app, data category, and/or by timestamp as to what data is collected.",
                            "Odyssey - Allows selective storing of data from mobile devices - https://www.bluelightsdigital.com/odyssey",
                            "XRY - Allows filtering by app, data category, and/or by timestamp as to what data is collected." ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1025,
                                      :weaknessDFW-1026,
                                      :weaknessDFW-1027,
                                      :weaknessDFW-1028 .

:techniqueDFT-1016
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1016: Collect specific pieces of information from a live running device"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1016" ;
    solveit-core:techniqueName "Collect specific pieces of information from a live running device" ;
    solveit-core:techniqueDescription "Running commands on a live system to collect specific pieces of information e.g. running processes or open ports" ;
    solveit-core:techniqueDetails """Prior to collecting data from the system, pre-stages are described in (Waits et al 2008) as:
- Establish trusted command shell
- Establish method for transmitting and storing the information
""" ;
    solveit-core:hasSynonym "Live response data collection",
                            "Volatile data collection" ;
    solveit-core:hasExample "ipconfig",
                            "netstat",
                            "procdump",
                            "pslist",
                            "psloggedon" ;
    solveit-core:hasCASEInputClass uco-observable:Device ;
    solveit-core:hasCASEOutputClass uco-observable:IPAddress,
                                    uco-observable:MACAddress,
                                    uco-observable:NetworkConnection,
                                    uco-observable:Process,
                                    uco-observable:UserAccount ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1034,
                                      :weaknessDFW-1035,
                                      :weaknessDFW-1036 ;
    solveit-core:hasReference :citationDFCite-1080,
                              :citationDFCite-1129 .

:techniqueDFT-1017
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1017: Capture network packets"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1017" ;
    solveit-core:techniqueName "Capture network packets" ;
    solveit-core:hasCASEInputClass uco-observable:NetworkInterface ;
    solveit-core:hasCASEOutputClass solveit-observable:NetworkPacketCapture .

:techniqueDFT-1018
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1018: Collect data from a remote networked device"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1018" ;
    solveit-core:techniqueName "Collect data from a remote networked device" ;
    solveit-core:hasCASEInputClass uco-observable:NetworkConnection ;
    solveit-core:hasCASEOutputClass solveit-observable:FileSet,
                                    solveit-observable:ForensicImageContainer .

:techniqueDFT-1019
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1019: Extract a backup from a mobile device"@en ;
    rdfs:subClassOf :techniqueDFT-1157 ;
    solveit-core:techniqueID "DFT-1019" ;
    solveit-core:techniqueName "Extract a backup from a mobile device" ;
    solveit-core:techniqueDescription "Using the in-built backup capability of a device to extract a subset of its contents" ;
    solveit-core:hasExample "Extraction of an iOS backup",
                            "Use of ADB to generate an Android backup" ;
    solveit-core:hasCASEInputClass uco-observable:MobileDevice ;
    solveit-core:hasCASEOutputClass solveit-observable:DeviceGeneratedBackup ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1037,
                                      :weaknessDFW-1038,
                                      :weaknessDFW-1039,
                                      :weaknessDFW-1040,
                                      :weaknessDFW-1041,
                                      :weaknessDFW-1270 .

:techniqueDFT-1020
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1020: Extract the file system from a mobile device"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1020" ;
    solveit-core:techniqueName "Extract the file system from a mobile device" ;
    solveit-core:techniqueDescription "Accessing the file system(s) of the device and extracting a set of files (full or partial depending on level of access)" ;
    solveit-core:techniqueDetails "Note that Fukami et al (2021) states \"In order to conduct effective file system extraction, rooting the device is required.\" See T1040. Usually results in a zip/tar file. Rooting may provide access to the file system, but files may still be encrypted. Attacking the user pin, usually on device, using T1034, or T1035 may be necessary, unless the PIN can be obtained from the device user (T1037)" ;
    solveit-core:hasSynonym "file system extraction" ;
    solveit-core:hasCASEInputClass uco-observable:MobileDevice ;
    solveit-core:hasCASEOutputClass solveit-observable:FileSystemExtraction ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1159,
                                      :weaknessDFW-1160,
                                      :weaknessDFW-1161,
                                      :weaknessDFW-1162,
                                      :weaknessDFW-1163,
                                      :weaknessDFW-1164 ;
    solveit-core:hasReference :citationDFCite-1031,
                              :citationDFCite-1045,
                              :citationDFCite-1091 .

:techniqueDFT-1021
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1021: Extract artifacts from a configuration file"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1021" ;
    solveit-core:techniqueName "Extract artifacts from a configuration file" ;
    solveit-core:techniqueDescription "Examination of a file that was designed for storing configuration information for a piece of software (e.g. an application or operating system feature)" ;
    solveit-core:hasSynonym "configuration file examination" ;
    solveit-core:hasExample "prefs.js from Firefox" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet,
                                   uco-observable:File ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/configuration/Configuration>,
                                    <https://ontology.unifiedcyberontology.org/uco/configuration/ConfigurationEntry> .

:techniqueDFT-1022
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1022: Capture mobile device screenshots (manually)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1022" ;
    solveit-core:techniqueName "Capture mobile device screenshots (manually)" ;
    solveit-core:techniqueDescription "An examiner directly manipulates the target mobile device using the device's input interface (i.e., keypads and buttons), and records the content shown on the display of the device. (Fukami et al 2021)" ;
    solveit-core:techniqueDetails "This is the manual version of DFT-1163. The device is controlled manually, and screenshots are captured manually." ;
    solveit-core:hasCASEInputClass uco-observable:MobileDevice ;
    solveit-core:hasCASEOutputClass solveit-observable:DeviceScreenshotCapture ;
    solveit-core:hasReference :citationDFCite-1045 .

:techniqueDFT-1023
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1023: Collect data from cloud service via a live web page using credentials"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1023" ;
    solveit-core:techniqueName "Collect data from cloud service via a live web page using credentials" ;
    solveit-core:hasCASEInputClass uco-observable:Credential,
                                   uco-observable:OnlineService ;
    solveit-core:hasCASEOutputClass uco-observable:ArchiveFile .

:techniqueDFT-1024
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1024: Collect data from cloud service via submission of request to service provider"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1024" ;
    solveit-core:techniqueName "Collect data from cloud service via submission of request to service provider" ;
    solveit-core:hasCASEInputClass uco-observable:OnlineService,
                                   uco-observable:accountIdentifier ;
    solveit-core:hasCASEOutputClass uco-observable:ArchiveFile .

:techniqueDFT-1025
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1025: Store bitstream data in a forensic image format"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1025" ;
    solveit-core:techniqueName "Store bitstream data in a forensic image format" ;
    solveit-core:techniqueDescription "Storage of bitstream data recovered from a digital device" ;
    solveit-core:techniqueDetails "The storage of bitstream data resulting from disk imaging, in formats such as: EWF, AFF4. The imaged data may be split into several linked container formats. e.g. e01, e02 e03 etc. This technique represents storage of data in container formats, whereas DFT-1178 represents data stored in raw files. " ;
    solveit-core:hasSynonym "store disk image container",
                            "store image file",
                            "write data to a disk image container",
                            "write data to a forensic image format" ;
    solveit-core:hasExample "2009 M57-Jean - Data is supplied as a ‘multi-volume Expert Witness file’ - i.e. split EnCase E01 & E02 image files (https://digitalcorpora.org/corpora/scenarios/m57-jean/)",
                            "FTK Imager: This tool can be used to acquire data from block devices in various image formats including RAW, EWF, and AFF",
                            "Magnet Acquire: This tool can be used to acquire data from block devices in various image formats including RAW and EWF.",
                            "libewf: This open source library allows access to the EWF format. The accompanying ewftools proves tools to verify, inspect and create EWF images. " ;
    solveit-core:hasCASEInputClass solveit-observable:Bitstream ;
    solveit-core:hasCASEOutputClass solveit-observable:PhysicalImageContainer ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1043 .

:techniqueDFT-1026
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1026: Store data in standard archive format"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1026" ;
    solveit-core:techniqueName "Store data in standard archive format" ;
    solveit-core:techniqueDescription "Storing acquired data in a standard archive format such as rar, tar or zip" ;
    solveit-core:techniqueDetails "This is commonly used with mobile file system extractions, but mobile backups can also sometimes be compressed into an archive." ;
    solveit-core:hasExample "RAR",
                            "TAR",
                            "ZIP" ;
    solveit-core:hasCASEInputClass solveit-observable:DeviceGeneratedBackup,
                                   solveit-observable:FileSystemExtraction ;
    solveit-core:hasCASEOutputClass uco-observable:ArchiveFile ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1165,
                                      :weaknessDFW-1275 .

:techniqueDFT-1027
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1027: Read data from a device using JTAG"@en ;
    rdfs:subClassOf :techniqueDFT-1162 ;
    solveit-core:techniqueID "DFT-1027" ;
    solveit-core:techniqueName "Read data from a device using JTAG" .

:techniqueDFT-1028
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1028: Physically remove a storage chip from a device (chip-off)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1028" ;
    solveit-core:techniqueName "Physically remove a storage chip from a device (chip-off)" ;
    solveit-core:hasSynonym "chip-off" .

:techniqueDFT-1029
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1029: Read data from a desoldered eMMC via a chip reader"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1029" ;
    solveit-core:techniqueName "Read data from a desoldered eMMC via a chip reader" ;
    solveit-core:hasCASEOutputClass solveit-observable:Bitstream .

:techniqueDFT-1030
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1030: Read data from unmanaged NAND"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1030" ;
    solveit-core:techniqueName "Read data from unmanaged NAND" ;
    solveit-core:techniqueDetails "Data read in this way will need decoding to be made accessible, e.g. via DFT-1029" .

:techniqueDFT-1031
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1031: Recover encryption/decryption key from memory"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1031" ;
    solveit-core:techniqueName "Recover encryption/decryption key from memory" ;
    solveit-core:techniqueDescription "This describes the technique whereby an attempt is made to extract key material from memory, or a memory acquisition of a running system to fascinate the decryption of some data " ;
    solveit-core:hasExample "Bulk Extractor - of the many scanners within bulk extractor, one of which attempts to locate AES keys.",
                            "Volatility - the plug in ‘trucryptmaster’ attempts to recover Truecrypt 7.1a master keys." ;
    solveit-core:hasCASEOutputClass solveit-observable:DecryptionKey ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1044,
                                      :weaknessDFW-1045 ;
    solveit-core:hasReference :citationDFCite-1053,
                              :citationDFCite-1054,
                              :citationDFCite-1056 .

:techniqueDFT-1032
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1032: Recover encryption/decryption key information using side channel attacks"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1032" ;
    solveit-core:techniqueName "Recover encryption/decryption key information using side channel attacks" .

:techniqueDFT-1033
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1033: Extract credential(s) from an accessible device to attempt access to a more secure device or service"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1033" ;
    solveit-core:techniqueName "Extract credential(s) from an accessible device to attempt access to a more secure device or service" ;
    solveit-core:techniqueDescription "Accessing a device with limited or no security to obtain a credential (e.g. password, PIN, token) that can be used to access another device or service." ;
    solveit-core:hasCASEOutputClass uco-observable:Credential .

:techniqueDFT-1034
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1034: Attack a stored credential or device using a brute force approach"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1034" ;
    solveit-core:techniqueName "Attack a stored credential or device using a brute force approach" ;
    solveit-core:techniqueDescription "A brute force attack, or exhaustive search is a password cracking approach where every combination of characters is tested until the correct one is found. This method is \"guaranteed to work\" given infinite time and resources which in a real-life scenario is not feasible." ;
    solveit-core:techniqueDetails "Brute force attack involves trying every possible combination in a defined search space to find the correct value. The search space could be limited to just numbers, for example in the case of a 4-digit PIN number, or alphanumerical values or even the full ASCII character set. The larger the search space, the longer it takes to complete a brute force attack." ;
    solveit-core:hasSynonym "brute force attack",
                            "exhaustive password search" ;
    solveit-core:hasCASEOutputClass uco-observable:password ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1140,
                                      :weaknessDFW-1141,
                                      :weaknessDFW-1142 ;
    solveit-core:hasReference :citationDFCite-1077 .

:techniqueDFT-1035
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1035: Attack a stored credential or device using a dictionary-based approach"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1035" ;
    solveit-core:techniqueName "Attack a stored credential or device using a dictionary-based approach" ;
    solveit-core:techniqueDescription "A dictionary attack is a password cracking technique where an attacker uses a list of passwords, called a dictionary, to attempt to guess a password." ;
    solveit-core:techniqueDetails "Dictionary attacks use list compiled common passwords that are likely to be used by people, such as dictionary words, names, common patterns or existing lists of popular or leaked passwords.  Therefore, success depends on the quality and of dictionary list." ;
    solveit-core:hasSynonym "dictionary attack" ;
    solveit-core:hasCASEOutputClass uco-observable:password ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1137,
                                      :weaknessDFW-1138,
                                      :weaknessDFW-1139 ;
    solveit-core:hasReference :citationDFCite-1075 .

:techniqueDFT-1036
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1036: Recover information about a potential device PIN or pattern lock using a smudge attack"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1036" ;
    solveit-core:techniqueName "Recover information about a potential device PIN or pattern lock using a smudge attack" ;
    solveit-core:hasCASEOutputClass solveit-observable:UnlockPattern .

:techniqueDFT-1037
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1037: Obtain password from the device's owner"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1037" ;
    solveit-core:techniqueName "Obtain password from the device's owner" ;
    solveit-core:hasCASEOutputClass uco-observable:password .

:techniqueDFT-1038
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1038: Attack a stored credential or device using a rainbow table-based approach"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1038" ;
    solveit-core:techniqueName "Attack a stored credential or device using a rainbow table-based approach" ;
    solveit-core:hasSynonym "rainbow table attack" ;
    solveit-core:hasCASEOutputClass uco-observable:password .

:techniqueDFT-1039
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1039: Downgrade apps to facilitate data extraction"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1039" ;
    solveit-core:techniqueName "Downgrade apps to facilitate data extraction" ;
    solveit-core:techniqueDescription "Downgrading an app to a version in which data is available e.g. via a backup method" ;
    solveit-core:hasReference :citationDFCite-1139,
                              :citationDFCite-1142 .

:techniqueDFT-1040
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1040: Exploit a mobile device to facilitate privileged access for data extraction"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1040" ;
    solveit-core:techniqueName "Exploit a mobile device to facilitate privileged access for data extraction" ;
    solveit-core:techniqueDescription "A process that typically exploits a security flaw in a specific device or operating system to enable users to perform higher privileged functions on a device (derived from Grover 2013)" ;
    solveit-core:hasSynonym "jailbreaking",
                            "mobile device exploit",
                            "rooting" ;
    solveit-core:hasExample "",
                            "Checkra1n, https://checkra.in" ;
    solveit-core:hasCASEOutputClass uco-observable:isPrivileged ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1157,
                                      :weaknessDFW-1158 ;
    solveit-core:hasReference :citationDFCite-1049 .

:techniqueDFT-1041
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1041: Gain access to a device via a Pin2Pwn approach"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1041" ;
    solveit-core:techniqueName "Gain access to a device via a Pin2Pwn approach" .

:techniqueDFT-1042
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1042: Verify hash of copied data matches the hash of the data read from source device"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1042" ;
    solveit-core:techniqueName "Verify hash of copied data matches the hash of the data read from source device" ;
    solveit-core:techniqueDescription """Compares a hash of data read from a source device with a hash computed by reading back the copy of that data stored in a raw image or a forensic image container. 

The source hash may be computed as the data is read during imaging, or by reading the source device again at a later point. 

What distinguishes this technique is that the reference hash comes from reading the source device, rather than from a stored record of that hash. Comparison against a stored hash, whether inside the image file, in a separate file, or held externally, is covered by DFT-1204.""" ;
    solveit-core:hasCASEInputClass uco-observable:hash ;
    solveit-core:hasCASEOutputClass solveit-observable:HashVerificationResult ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1124,
                                      :weaknessDFW-1125,
                                      :weaknessDFW-1126 ;
    solveit-core:hasReference :citationDFCite-1081,
                              :citationDFCite-1083,
                              :citationDFCite-1088 .

:techniqueDFT-1043
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1043: Read bitstream from forensic image container file(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1043" ;
    solveit-core:techniqueName "Read bitstream from forensic image container file(s)" ;
    solveit-core:techniqueDescription "The decoding of a forensic format such as EWF such that the raw sectors can be accessed by a forensic tool (typically performed on-the-fly internally in a tool.)" ;
    solveit-core:techniqueDetails "For example a EWF (Expert Witness Format) needs to be processed to expose the equivalent RAW image sectors." ;
    solveit-core:hasSynonym "Access forensic image content",
                            "Access forensic image",
                            "Decode forensic image bitstream",
                            "Read forensic format",
                            "Read forensic image" ;
    solveit-core:hasExample "Advanced Forensic Format (AFF)",
                            "Expert Witness Format (EWF)" ;
    solveit-core:hasCASEInputClass solveit-observable:PhysicalImageContainer ;
    solveit-core:hasCASEOutputClass solveit-observable:BitstreamRandomAccessed ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1121,
                                      :weaknessDFW-1122,
                                      :weaknessDFW-1259 .

:techniqueDFT-1044
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1044: Decode data stored in a mobile backup format"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1044" ;
    solveit-core:techniqueName "Decode data stored in a mobile backup format" ;
    solveit-core:techniqueDescription "Processing an extracted mobile device backup to access the files contained within." ;
    solveit-core:hasExample "adb backup decoding",
                            "iOS backup decoding" ;
    solveit-core:hasCASEInputClass solveit-observable:DeviceGeneratedBackup ;
    solveit-core:hasCASEOutputClass solveit-observable:FileSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1046,
                                      :weaknessDFW-1047,
                                      :weaknessDFW-1048,
                                      :weaknessDFW-1049,
                                      :weaknessDFW-1050,
                                      :weaknessDFW-1051 .

:techniqueDFT-1045
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1045: Read contents from standard archive file(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1045" ;
    solveit-core:techniqueName "Read contents from standard archive file(s)" ;
    solveit-core:techniqueDescription "Extract files from a common archive format e.g. TAR, RAR, ZIP" ;
    solveit-core:hasCASEInputClass uco-observable:ArchiveFile ;
    solveit-core:hasCASEOutputClass solveit-observable:FileSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1185 .

:techniqueDFT-1046
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1046: Redact digital forensic tool results to protect privileged material"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1046" ;
    solveit-core:techniqueName "Redact digital forensic tool results to protect privileged material" ;
    solveit-core:hasCASEInputClass solveit-observable:ArtifactSet,
                                   solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-observable:RedactedArtifactSet,
                                    solveit-observable:RedactedFileSet .

:techniqueDFT-1047
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1047: Filter files using a hashset to reduce files examined"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1047" ;
    solveit-core:techniqueName "Filter files using a hashset to reduce files examined" ;
    solveit-core:techniqueDescription "After hashing a set of files, compare the hashes against a known hashset to identify and remove known files from further examination." ;
    solveit-core:hasSynonym "hash matching (reduce)" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet,
                                   solveit-observable:HashSet ;
    solveit-core:hasCASEOutputClass solveit-observable:RedactedFileSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1132 .

:techniqueDFT-1048
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1048: Protect privacy by only partially processing data from a source"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1048" ;
    solveit-core:techniqueName "Protect privacy by only partially processing data from a source" ;
    solveit-core:techniqueDescription "Limiting the scope of file processing based on type, date or other criteria to protect privacy." ;
    solveit-core:techniqueDetails "The files may still be present in the data set or removed, or made inaccessible, but the core of the technique is to provide a limited set of artifacts, compared with full processing." ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-observable:RedactedArtifactSet,
                                    solveit-observable:RedactedFileSet ;
    solveit-core:hasReference :citationDFCite-1037 .

:techniqueDFT-1049
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1049: Keyword search"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1049" ;
    solveit-core:techniqueName "Keyword search" ;
    solveit-core:techniqueDescription "This technique involves searching data in the case for specific strings" ;
    solveit-core:techniqueDetails "This search may be conducted live, directly over the data, or from a generated index of strings extracted from the data. The words searched for may be either case-specific, or sometimes case-type specific." ;
    solveit-core:hasSynonym "string search" ;
    solveit-core:hasCASEOutputClass solveit-observable:KeywordSearchResultSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1053,
                                      :weaknessDFW-1058,
                                      :weaknessDFW-1059,
                                      :weaknessDFW-1196 ;
    solveit-core:hasSubtechnique :techniqueDFT-1122,
                                 :techniqueDFT-1123,
                                 :techniqueDFT-1124,
                                 :techniqueDFT-1125,
                                 :techniqueDFT-1126,
                                 :techniqueDFT-1127,
                                 :techniqueDFT-1151 ;
    solveit-core:hasReference :citationDFCite-1013,
                              :citationDFCite-1014,
                              :citationDFCite-1103 .

:techniqueDFT-1050
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1050: Locate relevant files using a hashset to identify files of interest"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1050" ;
    solveit-core:techniqueName "Locate relevant files using a hashset to identify files of interest" ;
    solveit-core:hasSynonym "Hash matching (locate)" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet,
                                   solveit-observable:HashSet ;
    solveit-core:hasCASEOutputClass solveit-observable:FilteredFileSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1132 .

:techniqueDFT-1051
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1051: Locate potentially relevant files using fuzzy hash matching"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1051" ;
    solveit-core:techniqueName "Locate potentially relevant files using fuzzy hash matching" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-observable:FilteredFileSet .

:techniqueDFT-1052
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1052: Generate timeline"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1052" ;
    solveit-core:techniqueName "Generate timeline" ;
    solveit-core:techniqueDescription "The extraction and normalisation of timestamps from a data source into a set of timeline entries" ;
    solveit-core:hasSynonym "timeline generation",
                            "timelining" ;
    solveit-core:hasExample "plaso" ;
    solveit-core:hasCASEInputClass solveit-observable:ArtifactSet,
                                   solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-observable:Timeline ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1144,
                                      :weaknessDFW-1145,
                                      :weaknessDFW-1146,
                                      :weaknessDFW-1147,
                                      :weaknessDFW-1151,
                                      :weaknessDFW-1269 ;
    solveit-core:hasSubtechnique :techniqueDFT-1153 ;
    solveit-core:hasReference :citationDFCite-1039,
                              :citationDFCite-1058 .

:techniqueDFT-1053
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1053: Extract 'entities' from a data source"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1053" ;
    solveit-core:techniqueName "Extract 'entities' from a data source" ;
    solveit-core:techniqueDescription "Extracting common types of entity in a data source e.g. email addresses, IP addresses, domain names, URLs, credit card numbers, etc." ;
    solveit-core:hasSynonym "entity extraction" ;
    solveit-core:hasExample "bulk extractor" ;
    solveit-core:hasCASEInputClass solveit-observable:ArtifactSet,
                                   solveit-observable:BitstreamRandomAccessed,
                                   solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-observable:ArtifactSet .

:techniqueDFT-1054
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1054: Review artifacts or content manually for relevant material"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1054" ;
    solveit-core:techniqueName "Review artifacts or content manually for relevant material" ;
    solveit-core:techniqueDescription "Manual examination of files or artifacts to determine their relevance to the investigation." ;
    solveit-core:techniqueDetails """The result of this process is a classification, which may be 'relevant', or could be more specific, e.g. 'contains reference to x'. This technique is likely paired with T1091 (Bookmark artifacts) but they could be recorded in other ways. 

This manual review could be for:
- images (DFT-1081) 
- video (DFT-1080)
- audio (DFT-1079)
- the general content of files (DFT-1058)
- artefacts in general.""" ;
    solveit-core:hasCASEInputClass solveit-observable:ArtifactSet,
                                   solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification>,
                                    solveit-observable:ArtifactSet,
                                    solveit-observable:FileSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1060,
                                      :weaknessDFW-1061,
                                      :weaknessDFW-1062 .

:techniqueDFT-1055
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1055: Examine file and folder structure"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1055" ;
    solveit-core:techniqueName "Examine file and folder structure" ;
    solveit-core:techniqueDescription "The process of examining the directory hierarchy, file and folder names (rather than file contents) to identify potentially relevant material." ;
    solveit-core:hasSynonym "Directory structure review" .

:techniqueDFT-1056
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1056: Enumerate connections between artifacts"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1056" ;
    solveit-core:techniqueName "Enumerate connections between artifacts" ;
    solveit-core:techniqueDescription "Finds references between artifacts, such as operating system artifacts that refer to a specific file" ;
    solveit-core:hasExample "AXIOM Connections feature" ;
    solveit-core:hasCASEInputClass uco-observable:ObservableObject ;
    solveit-core:hasCASEOutputClass solveit-observable:ArtifactSet,
                                    uco-observable:ObservableRelationship .

:techniqueDFT-1057
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1057: Search for indicators of steganography"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1057" ;
    solveit-core:techniqueName "Search for indicators of steganography" ;
    solveit-core:techniqueDescription "Searching for the presence of current or historical steganography software on a system" ;
    solveit-core:hasCASEInputClass solveit-observable:AcquiredData ;
    solveit-core:hasCASEOutputClass solveit-observable:ArtifactSet ;
    solveit-core:hasReference :citationDFCite-1082 .

:techniqueDFT-1058
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1058: Search for mismatched file extensions"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1058" ;
    solveit-core:techniqueName "Search for mismatched file extensions" ;
    solveit-core:techniqueDescription "Checking the content of a file against its file extension to identify mismatches." ;
    solveit-core:techniqueDetails "This results in a file path of an identified file, but also highlights the extension that the file has, and the file extension(s) that are expected" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-observable:FilteredFileSet ;
    solveit-core:hasReference :citationDFCite-1007 .

:techniqueDFT-1059
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1059: Identify partitions"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1059" ;
    solveit-core:techniqueName "Identify partitions" ;
    solveit-core:techniqueDescription "Partitions are defined as ‘allocated contiguous sets of sectors from storage media’. This involves recovering the list of partitions that exist on a storage media." ;
    solveit-core:techniqueDetails """Partitions schemes include: MBR, GPT, APM. Some schemes such as GPT have records of the partitions in a single area (plus a backup partition table), others such as MBR make use of Extended Partition Tables (EPTs) that are scattered throughout the disk.

Partitions can also be deleted but may be recoverable if the start sectors of the volumes contained within them can be identified. """ ;
    solveit-core:hasSynonym "media management analysis" ;
    solveit-core:hasExample "Hargreaves, Nelson and Casey (2024) provides a dataset with a deleted but recoverable partition that can be used for tool evaluation." ;
    solveit-core:hasCASEInputClass solveit-observable:BitstreamRandomAccessed ;
    solveit-core:hasCASEOutputClass uco-observable:DiskPartition ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1063,
                                      :weaknessDFW-1064,
                                      :weaknessDFW-1065,
                                      :weaknessDFW-1066,
                                      :weaknessDFW-1067 ;
    solveit-core:hasReference :citationDFCite-1024,
                              :citationDFCite-1106 .

:techniqueDFT-1060
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1060: Enumerate allocated files and folders"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1060" ;
    solveit-core:techniqueName "Enumerate allocated files and folders" ;
    solveit-core:techniqueDescription "This involves parsing the allocated file system data structures and reconstructing the file system of the target media or device." ;
    solveit-core:hasSynonym "file system parsing" ;
    solveit-core:hasExample "The Sleuth Kit - allows parsing of file system structures",
                            "X-Ways Forensics - allows parsing of file system structures" ;
    solveit-core:hasCASEInputClass uco-observable:FileSystem ;
    solveit-core:hasCASEOutputClass solveit-observable:FileSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1068,
                                      :weaknessDFW-1069,
                                      :weaknessDFW-1070,
                                      :weaknessDFW-1071,
                                      :weaknessDFW-1072,
                                      :weaknessDFW-1073,
                                      :weaknessDFW-1074,
                                      :weaknessDFW-1075,
                                      :weaknessDFW-1076,
                                      :weaknessDFW-1077,
                                      :weaknessDFW-1078,
                                      :weaknessDFW-1079,
                                      :weaknessDFW-1080,
                                      :weaknessDFW-1081,
                                      :weaknessDFW-1082,
                                      :weaknessDFW-1083,
                                      :weaknessDFW-1084 ;
    solveit-core:hasReference :citationDFCite-1024,
                              :citationDFCite-1030 .

:techniqueDFT-1061
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1061: Recover non-allocated files"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1061" ;
    solveit-core:techniqueName "Recover non-allocated files" ;
    solveit-core:techniqueDescription "The recovery of files from non-allocated space" ;
    solveit-core:techniqueDetails "An attempt to recover non-allocated files from either a current file system or non-allocated space from within a file system, partition, or storage media." ;
    solveit-core:hasSynonym "Deleted data recovery",
                            "Deleted file recovery" ;
    solveit-core:hasCASEInputClass uco-observable:ContentData,
                                   uco-observable:FileSystem ;
    solveit-core:hasCASEOutputClass uco-core:confidence,
                                    uco-observable:Directory,
                                    uco-observable:File ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1133 ;
    solveit-core:hasSubtechnique :techniqueDFT-1064,
                                 :techniqueDFT-1150 ;
    solveit-core:hasReference :citationDFCite-1030 .

:techniqueDFT-1062
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1062: Decrypt encrypted file systems/volumes"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1062" ;
    solveit-core:techniqueName "Decrypt encrypted file systems/volumes" ;
    solveit-core:techniqueDescription "The process of decrypting an encrypted file system/volume to make its contents accessible for analysis." ;
    solveit-core:techniqueDetails "The output of this process will vary depending on the encryption implementation in place. If encryption is at the sector level then it would result in a decrypted forensic image, but if it uses file-based encryption then the process would result in an equivalent volume but with the file content/metadata decrypted." ;
    solveit-core:hasCASEOutputClass uco-observable:Image,
                                    uco-observable:Volume .

:techniqueDFT-1063
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1063: Identify file types"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1063" ;
    solveit-core:techniqueName "Identify file types" ;
    solveit-core:techniqueDescription "Applying a process that identifies the types of files." ;
    solveit-core:techniqueDetails "This could be via extension, although files may have been renamed, and so this is unreliable, so other means such as examining a file signature or other techniques are used (Dubettier et al 2023)" ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification>,
                                    uco-observable:mimeType ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1129,
                                      :weaknessDFW-1130,
                                      :weaknessDFW-1131 ;
    solveit-core:hasReference :citationDFCite-1040,
                              :citationDFCite-1060 .

:techniqueDFT-1064
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1064: Carve non-allocated files"@en ;
    rdfs:subClassOf :techniqueDFT-1061 ;
    solveit-core:techniqueID "DFT-1064" ;
    solveit-core:techniqueName "Carve non-allocated files" ;
    solveit-core:techniqueDescription "The process of recovering files from non-allocated space using only the structural properties of files." ;
    solveit-core:techniqueDetails "File carving should result in not just the file content, but the offset in which it was found and the offset base (i.e. the disk, volume, or offset within another file). This approach uses internal files structural information only - if residual file system metadata is used then the complementary technique T1150 is more applicable." ;
    solveit-core:hasSynonym "file carving" ;
    solveit-core:hasExample "Photorec (Grenier 2023)",
                            "foremost",
                            "scalpel" ;
    solveit-core:hasCASEOutputClass uco-core:confidence,
                                    uco-observable:File,
                                    uco-observable:rangeOffset,
                                    uco-observable:rangeOffsetType ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1103,
                                      :weaknessDFW-1104,
                                      :weaknessDFW-1105,
                                      :weaknessDFW-1106,
                                      :weaknessDFW-1107 ;
    solveit-core:hasReference :citationDFCite-1011,
                              :citationDFCite-1048 .

:techniqueDFT-1065
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1065: Extract artifacts from operating system-level content indexer(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1065" ;
    solveit-core:techniqueName "Extract artifacts from operating system-level content indexer(s)" ;
    solveit-core:techniqueDescription "Examine information from operating system artifacts relating to content indexing and search capabilities e.g. Windows Desktop Search" ;
    solveit-core:techniqueDetails "For example the Windows Search database '...contains vast amount of values about various of artifacts found on a Windows system, e.g. files and directories, emails, appointments, attachments, images, audio and video' (Metz 2011)" ;
    solveit-core:hasSynonym "OS search database examination",
                            "operating system search database examination" ;
    solveit-core:hasExample "Spotlight",
                            "Windows Search",
                            "Zeitgeist" ;
    solveit-core:hasCASEOutputClass uco-observable:fileName,
                                    uco-observable:filePath ;
    solveit-core:hasReference :citationDFCite-1100,
                              :citationDFCite-1122 .

:techniqueDFT-1066
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1066: Extract artifacts from operating system log files"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1066" ;
    solveit-core:techniqueName "Extract artifacts from operating system log files" ;
    solveit-core:hasSynonym "event log examination" ;
    solveit-core:hasExample "Windows Event Logs" ;
    solveit-core:hasCASEOutputClass uco-observable:EventLog .

:techniqueDFT-1067
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1067: Extract artifacts from operating system cloud synchronization features"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1067" ;
    solveit-core:techniqueName "Extract artifacts from operating system cloud synchronization features" ;
    solveit-core:techniqueDescription "Focuses on operating system level cloud syncronization features, such as iCloud Drive and OneDrive, which may be used to synchronize files between a local system and a cloud service." ;
    solveit-core:hasExample "OneDrive",
                            "iCloud Drive" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet .

:techniqueDFT-1068
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1068: Extract operating system artifacts indicating recently used files"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1068" ;
    solveit-core:techniqueName "Extract operating system artifacts indicating recently used files" ;
    solveit-core:techniqueDescription "The process of examining operating system files to extract artifacts that may indicate file accesses." ;
    solveit-core:techniqueDetails "While this technique may result in file paths and timestamps, to evaluate a hypothesis that a file was accessed requires use of T1155 to evaluate if this access occurred, and optionally T1117 if the time of access is relevant." ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass uco-observable:accessedTime,
                                    uco-observable:filePath .

:techniqueDFT-1069
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1069: Extract artifacts from a web browser"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1069" ;
    solveit-core:techniqueName "Extract artifacts from a web browser" ;
    solveit-core:techniqueDescription "Recovery of information left from web browsing activity (derived from Oh et al (2011))" ;
    solveit-core:techniqueDetails "This may involve: history, cached items, bookmarks, cookies, saved passwords, form data." ;
    solveit-core:hasCASEInputClass solveit-observable:BrowserAppFiles ;
    solveit-core:hasCASEOutputClass uco-observable:BrowserBookmark,
                                    uco-observable:BrowserCookie,
                                    uco-observable:CookieHistory,
                                    uco-observable:URLHistory,
                                    uco-observable:URLHistoryEntry,
                                    uco-observable:URLVisit ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1113,
                                      :weaknessDFW-1250,
                                      :weaknessDFW-1251 ;
    solveit-core:hasSubtechnique :techniqueDFT-1137,
                                 :techniqueDFT-1138,
                                 :techniqueDFT-1139,
                                 :techniqueDFT-1140,
                                 :techniqueDFT-1141,
                                 :techniqueDFT-1142,
                                 :techniqueDFT-1143,
                                 :techniqueDFT-1144,
                                 :techniqueDFT-1145,
                                 :techniqueDFT-1146,
                                 :techniqueDFT-1147,
                                 :techniqueDFT-1148 ;
    solveit-core:hasReference :citationDFCite-1038,
                              :citationDFCite-1108 .

:techniqueDFT-1070
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1070: Extract artifacts from email client(s) or webmail access"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1070" ;
    solveit-core:techniqueName "Extract artifacts from email client(s) or webmail access" ;
    solveit-core:hasCASEInputClass solveit-observable:EmailAppFiles ;
    solveit-core:hasCASEOutputClass uco-observable:Contact,
                                    uco-observable:EmailAccount,
                                    uco-observable:EmailMessage .

:techniqueDFT-1071
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1071: Extract data from SQLite database(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1071" ;
    solveit-core:techniqueName "Extract data from SQLite database(s)" ;
    solveit-core:techniqueDescription "Examination of a SQLite database file(s) to extract information from within." ;
    solveit-core:hasSynonym "database forensics" ;
    solveit-core:hasExample "sqlite-forensic-corpus (2018), https://faui1-files.cs.fau.de/public/sqlite-forensic-corpus/" ;
    solveit-core:hasCASEInputClass solveit-observable:SQLiteDatabase ;
    solveit-core:hasCASEOutputClass solveit-observable:SQLiteTable ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1166,
                                      :weaknessDFW-1167,
                                      :weaknessDFW-1168,
                                      :weaknessDFW-1169,
                                      :weaknessDFW-1170,
                                      :weaknessDFW-1171 ;
    solveit-core:hasReference :citationDFCite-1104 .

:techniqueDFT-1072
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1072: Extract artifacts from chat app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1072" ;
    solveit-core:techniqueName "Extract artifacts from chat app(s)" ;
    solveit-core:techniqueDescription "Analysis of the files that provide the backing store for a chat or messenger application" ;
    solveit-core:techniqueDetails """Messenger apps include:

iOS Messenger 
WhatApp
Telegram
Signal
Facebook Messenger
…""" ;
    solveit-core:hasSynonym "Messenger app analysis" ;
    solveit-core:hasCASEInputClass solveit-observable:ChatAppFiles ;
    solveit-core:hasCASEOutputClass uco-observable:Contact,
                                    uco-observable:Message,
                                    uco-observable:SMSMessage ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1085,
                                      :weaknessDFW-1086,
                                      :weaknessDFW-1087,
                                      :weaknessDFW-1088,
                                      :weaknessDFW-1089,
                                      :weaknessDFW-1090,
                                      :weaknessDFW-1091,
                                      :weaknessDFW-1092,
                                      :weaknessDFW-1093,
                                      :weaknessDFW-1094,
                                      :weaknessDFW-1095,
                                      :weaknessDFW-1096,
                                      :weaknessDFW-1097,
                                      :weaknessDFW-1098,
                                      :weaknessDFW-1099,
                                      :weaknessDFW-1100,
                                      :weaknessDFW-1101,
                                      :weaknessDFW-1102 .

:techniqueDFT-1073
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1073: Extract artifacts from calendar app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1073" ;
    solveit-core:techniqueName "Extract artifacts from calendar app(s)" ;
    solveit-core:hasCASEInputClass solveit-observable:CalendarAppFiles ;
    solveit-core:hasCASEOutputClass uco-observable:Calendar,
                                    uco-observable:CalendarEntry .

:techniqueDFT-1074
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1074: Extract artifacts from social network app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1074" ;
    solveit-core:techniqueName "Extract artifacts from social network app(s)" ;
    solveit-core:hasCASEInputClass solveit-observable:SocialMediaAppFiles ;
    solveit-core:hasCASEOutputClass uco-observable:Contact,
                                    uco-observable:Message,
                                    uco-observable:Post .

:techniqueDFT-1075
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1075: Extract artifacts from maps/travel app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1075" ;
    solveit-core:techniqueName "Extract artifacts from maps/travel app(s)" ;
    solveit-core:hasCASEInputClass solveit-observable:MapsAppFiles,
                                   solveit-observable:NavigationAppFiles .

:techniqueDFT-1076
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1076: Extract artifacts from log files"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1076" ;
    solveit-core:techniqueName "Extract artifacts from log files" ;
    solveit-core:techniqueDescription "Examination of a file that was designed for incremental logging from a piece of software (e.g. an application or operating system feature)" ;
    solveit-core:techniqueDetails "These could be in a variety of formats e.g. plain text, JSON, XML, binary, etc." ;
    solveit-core:hasExample "Examination of setupapi.dev.log",
                            "Examination of syslog" ;
    solveit-core:hasCASEOutputClass uco-core:eventType,
                                    uco-observable:EventLog ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1228,
                                      :weaknessDFW-1229,
                                      :weaknessDFW-1230,
                                      :weaknessDFW-1231,
                                      :weaknessDFW-1232,
                                      :weaknessDFW-1233,
                                      :weaknessDFW-1234,
                                      :weaknessDFW-1235,
                                      :weaknessDFW-1236 .

:techniqueDFT-1077
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1077: Extract artifacts from photo management app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1077" ;
    solveit-core:techniqueName "Extract artifacts from photo management app(s)" ;
    solveit-core:hasExample "Apple Photos app",
                            "Darktable",
                            "Lightroom",
                            "Windows Photos app",
                            "XnView MP",
                            "digiKam" ;
    solveit-core:hasCASEInputClass solveit-observable:PhotosAppFiles .

:techniqueDFT-1078
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1078: Extract artifacts from cloud synchronization app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1078" ;
    solveit-core:techniqueName "Extract artifacts from cloud synchronization app(s)" ;
    solveit-core:techniqueDescription "Involves examination of cloud synchronization artifacts from apps rather than those built into the operating system." ;
    solveit-core:hasExample "Dropbox",
                            "Google Drive" .

:techniqueDFT-1079
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1079: Examine audio content"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1079" ;
    solveit-core:techniqueName "Examine audio content" ;
    solveit-core:hasSubtechnique :techniqueDFT-1194 .

:techniqueDFT-1080
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1080: Examine video content"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1080" ;
    solveit-core:techniqueName "Examine video content" ;
    solveit-core:hasSubtechnique :techniqueDFT-1106 .

:techniqueDFT-1081
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1081: Examine image/picture content"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1081" ;
    solveit-core:techniqueName "Examine image/picture content" ;
    solveit-core:hasSubtechnique :techniqueDFT-1176 .

:techniqueDFT-1082
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1082: Examine document content"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1082" ;
    solveit-core:techniqueName "Examine document content" ;
    solveit-core:hasExample "Microsoft Word",
                            "Pages" .

:techniqueDFT-1083
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1083: Extract artifacts from operating system memory structures"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1083" ;
    solveit-core:techniqueName "Extract artifacts from operating system memory structures" ;
    solveit-core:techniqueDescription "Examination of the operating system structures that allows individual processes to be listed and pages used by specific processes to be enumerated." ;
    solveit-core:hasExample "EPROCESS blocks",
                            "VAD trees" .

:techniqueDFT-1084
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1084: Extract potentially user-identifying content from account information"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1084" ;
    solveit-core:techniqueName "Extract potentially user-identifying content from account information" ;
    solveit-core:techniqueDescription "Analysis of user account information to extract content that may help identify the person associated with an account, such as usernames, real names, password hints, security questions, recovery email addresses, and profile details." ;
    solveit-core:hasCASEInputClass uco-observable:UserAccount ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/identity/Person>,
                                    solveit-analysis:HypothesisedRelationship .

:techniqueDFT-1085
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1085: Conflate specific account identifiers to a single user identity"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1085" ;
    solveit-core:techniqueName "Conflate specific account identifiers to a single user identity" ;
    solveit-core:hasCASEInputClass uco-observable:Account ;
    solveit-core:hasCASEOutputClass solveit-analysis:HypothesisedRelationship .

:techniqueDFT-1086
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1086: Analyze timeline"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1086" ;
    solveit-core:techniqueName "Analyze timeline" ;
    solveit-core:techniqueDescription "The process of searching, filtering, sorting, highlighting, or aggregating timeline entries to determine which are relevant for event reconstruction, or to identify times of interest (adapted from Breitinger et al. 2025)" ;
    solveit-core:techniqueDetails "This can involve refinement approaches such as: filtering irrelevant entries, highlighting key entries, or aggregating entries into more meaningful events. This may result in a filtered timeline, or a set of highlighted timeline entries" ;
    solveit-core:hasSynonym "Temporal analysis",
                            "Timeline analysis" ;
    solveit-core:hasExample "PyDFT (Hargreaves & Patterson 2012)",
                            "TimeSketch (Berggren et al. 2014)" ;
    solveit-core:hasCASEOutputClass solveit-observable:Timeline,
                                    solveit-observable:TimelineEntry ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1148,
                                      :weaknessDFW-1266 ;
    solveit-core:hasSubtechnique :techniqueDFT-1134,
                                 :techniqueDFT-1182,
                                 :techniqueDFT-1184 ;
    solveit-core:hasReference :citationDFCite-1017,
                              :citationDFCite-1019,
                              :citationDFCite-1028,
                              :citationDFCite-1058 .

:techniqueDFT-1087
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1087: Reconstruct the location-based properties of an event"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1087" ;
    solveit-core:techniqueName "Reconstruct the location-based properties of an event" ;
    solveit-core:techniqueDescription "The process of assigning location properties to a reconstructed event" ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/location/Location>,
                                    solveit-analysis:HypothesisedEvent,
                                    uco-core:confidence ;
    solveit-core:hasReference :citationDFCite-1146 .

:techniqueDFT-1088
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1088: Reconstruct relations between events or properties of events"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1088" ;
    solveit-core:techniqueName "Reconstruct relations between events or properties of events" ;
    solveit-core:techniqueDescription "The process of determining the existence and nature of relationships between entities during event reconstruction" ;
    solveit-core:hasSynonym "Connection-based event reconstruction",
                            "Relation-based event reconstruction",
                            "Relational analysis" ;
    solveit-core:hasCASEInputClass uco-observable:Contact,
                                   uco-observable:Message ;
    solveit-core:hasCASEOutputClass solveit-analysis:HypothesisedCommunication,
                                    solveit-analysis:HypothesisedRelationship ;
    solveit-core:hasReference :citationDFCite-1029 .

:techniqueDFT-1089
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1089: Review source code of software"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1089" ;
    solveit-core:techniqueName "Review source code of software" ;
    solveit-core:techniqueDescription "Typically to  understand it's capabilities, the artifacts it produces, or what user actions could be potentially reconstructed" ;
    solveit-core:techniqueDetails "The equivalent of `static analysis` of malware, but applied to software in general." ;
    solveit-core:hasCASEInputClass uco-observable:Code .

:techniqueDFT-1090
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1090: Experiment with software to ascertain forensic artifacts"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1090" ;
    solveit-core:techniqueName "Experiment with software to ascertain forensic artifacts" ;
    solveit-core:techniqueDescription "The process of running software in a controlled environment to observe its behavior and identify potential forensic artifacts." ;
    solveit-core:techniqueDetails "The equivalent of `dynamic analysis` of malware, but applied to software in general. This can involve running the software in a controlled environment and observing its behavior, inputs, and outputs to gain insights into its functionality and potential for event reconstruction." ;
    solveit-core:hasCASEInputClass uco-observable:Software ;
    solveit-core:hasCASEOutputClass solveit-analysis:HypothesisedRelationship .

:techniqueDFT-1091
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1091: Tag artifacts"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1091" ;
    solveit-core:techniqueName "Tag artifacts" ;
    solveit-core:techniqueDescription "Make a record of selected files or pieces of data so they can be accessed easily, or used for generating automated reports." ;
    solveit-core:hasSynonym "Bookmark artifacts",
                            "Bookmarking",
                            "Tagging" ;
    solveit-core:hasCASEInputClass uco-observable:ObservableObject ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification>,
                                    uco-core:Annotation ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1155,
                                      :weaknessDFW-1156 .

:techniqueDFT-1092
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1092: Generate tag-based automated report"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1092" ;
    solveit-core:techniqueName "Generate tag-based automated report" ;
    solveit-core:techniqueDescription "Generate a report in PDF, HTML or other format that compiles tagged (or bookmarked) items from a case into a package that can be reviewed." ;
    solveit-core:hasSynonym "Produce bookmark-based automated report" ;
    solveit-core:hasCASEOutputClass solveit-analysis:ForensicToolTagBasedReport ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1152,
                                      :weaknessDFW-1153,
                                      :weaknessDFW-1154 ;
    solveit-core:hasReference :citationDFCite-1008,
                              :citationDFCite-1009 .

:techniqueDFT-1093
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1093: Write expert report"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1093" ;
    solveit-core:techniqueName "Write expert report" ;
    solveit-core:hasCASEOutputClass <https://cacontology.projectvic.org/case-management#ExpertReport> .

:techniqueDFT-1094
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1094: Disclose investigation material to an authorized legal authority"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1094" ;
    solveit-core:techniqueName "Disclose investigation material to an authorized legal authority" ;
    solveit-core:hasReference :citationDFCite-1154,
                              :citationDFCite-1155 .

:techniqueDFT-1095
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1095: Instrument a piece of running software"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1095" ;
    solveit-core:techniqueName "Instrument a piece of running software" ;
    solveit-core:techniqueDescription "This can be done during experiments to help ascertain functionality, or potential forensic artifacts" ;
    solveit-core:hasExample "Fiddler",
                            "Frida",
                            "IDA Pro" ;
    solveit-core:hasReference :citationDFCite-1156 .

:techniqueDFT-1096
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1096: Extract operating system artifacts indicating program execution"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1096" ;
    solveit-core:techniqueName "Extract operating system artifacts indicating program execution" ;
    solveit-core:techniqueDescription "The process of examining operating system files to extract artifacts that may indicate a program has been run." ;
    solveit-core:techniqueDetails "While this technique may result in paths to executables/scripts and timestamps, to evaluate a hypothesis that a program was run requires use of T1155 to evaluate if this occurred, and optionally T1117 if the time of access is relevant." ;
    solveit-core:hasSynonym "Programs run identification (OS)" ;
    solveit-core:hasCASEInputClass solveit-observable:ArtifactSet ;
    solveit-core:hasCASEOutputClass uco-observable:execProgramHashes,
                                    uco-observable:execProgramPath,
                                    uco-observable:timesExecuted .

:techniqueDFT-1097
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1097: Extract operating system artifacts indicating installed software"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1097" ;
    solveit-core:techniqueName "Extract operating system artifacts indicating installed software" ;
    solveit-core:techniqueDescription "Extraction and analysis of information that allows programs installed on an OS to be identified." ;
    solveit-core:hasSynonym "Installed software identification (OS)" ;
    solveit-core:hasCASEInputClass solveit-observable:ArtifactSet ;
    solveit-core:hasCASEOutputClass uco-observable:Application,
                                    uco-observable:ApplicationVersion .

:techniqueDFT-1098
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1098: Enumerate operating system user accounts"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1098" ;
    solveit-core:techniqueName "Enumerate operating system user accounts" ;
    solveit-core:techniqueDescription "Examination of operating system artifacts to determine user accounts" ;
    solveit-core:techniqueDetails "This might include which accounts exist on the system, when they were created, etc." ;
    solveit-core:hasSynonym "User account analysis (OS)" ;
    solveit-core:hasExample "Windows SAM file" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass uco-observable:UserAccount,
                                    uco-observable:accountType .

:techniqueDFT-1099
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1099: Repair a damaged or incomplete file using `grafting`"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1099" ;
    solveit-core:techniqueName "Repair a damaged or incomplete file using `grafting`" ;
    solveit-core:techniqueDescription "Repair file by grafting different reference data onto fragment(s)" ;
    solveit-core:hasCASEInputClass uco-observable:ContentData ;
    solveit-core:hasCASEOutputClass uco-observable:File .

:techniqueDFT-1100
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1100: Extract metadata from within images"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1100" ;
    solveit-core:techniqueName "Extract metadata from within images" ;
    solveit-core:techniqueDescription "The extraction of metadata from within images (pictures). e.g. EXIF, XMP. IPTC, iTXt etc." ;
    solveit-core:hasSynonym "EXIF extraction" ;
    solveit-core:hasCASEInputClass uco-observable:RasterPicture ;
    solveit-core:hasCASEOutputClass uco-observable:exifData .

:techniqueDFT-1101
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1101: Conduct cell site survey"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1101" ;
    solveit-core:techniqueName "Conduct cell site survey" ;
    solveit-core:techniqueDescription "Taking measurements to assess which cells actually provide service at a specific location (adapted from Tart et al 2012)." ;
    solveit-core:techniqueDetails "Can involve: spot sample, location survey, area survey, cell survey (Tart et al 2012)" ;
    solveit-core:hasCASEInputClass <https://ontology.unifiedcyberontology.org/uco/location/Location> ;
    solveit-core:hasReference :citationDFCite-1067,
                              :citationDFCite-1121 .

:techniqueDFT-1102
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1102: Decode data extracted from unmanaged NAND"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1102" ;
    solveit-core:techniqueName "Decode data extracted from unmanaged NAND" ;
    solveit-core:hasCASEInputClass uco-observable:ContentData .

:techniqueDFT-1103
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1103: Virtualize suspect system for previewing"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1103" ;
    solveit-core:techniqueName "Virtualize suspect system for previewing" ;
    solveit-core:techniqueDescription "A suspect disk image can be configured to boot as a virtual machine, which allows screenshots to be taken showing how the user's desktop looked for example." ;
    solveit-core:hasCASEInputClass solveit-observable:PhysicalImageContainer,
                                   solveit-observable:RawImage ;
    solveit-core:hasCASEOutputClass solveit-observable:VirtualizedComputer .

:techniqueDFT-1104
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1104: Collect data using open source intelligence"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1104" ;
    solveit-core:techniqueName "Collect data using open source intelligence" .

:techniqueDFT-1105
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1105: Examine memory dump from an application"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1105" ;
    solveit-core:techniqueName "Examine memory dump from an application" ;
    solveit-core:techniqueDescription "Examination of the specific structures from the memory of a specific application" ;
    solveit-core:techniqueDetails "These could be extracted from a physical memory dump through analysis of operating system memory structures to extract specific process memory, or obtained directly on a live system." .

:techniqueDFT-1106
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1106: Classify if a video is potentially synthetically generated"@en ;
    rdfs:subClassOf :techniqueDFT-1080 ;
    solveit-core:techniqueID "DFT-1106" ;
    solveit-core:techniqueName "Classify if a video is potentially synthetically generated" ;
    solveit-core:hasCASEInputClass solveit-observable:VideoFile ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification>,
                                    <https://ontology.unifiedcyberontology.org/uco/analysis/classificationConfidence> .

:techniqueDFT-1107
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1107: Extract artifacts from health/fitness app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1107" ;
    solveit-core:techniqueName "Extract artifacts from health/fitness app(s)" ;
    solveit-core:hasCASEInputClass solveit-observable:HealthAppFiles .

:techniqueDFT-1108
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1108: Extract artifacts from reminders app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1108" ;
    solveit-core:techniqueName "Extract artifacts from reminders app(s)" ;
    solveit-core:hasCASEInputClass solveit-observable:RemindersAppFiles .

:techniqueDFT-1109
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1109: Extract artifacts from payment app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1109" ;
    solveit-core:techniqueName "Extract artifacts from payment app(s)" ;
    solveit-core:hasCASEInputClass solveit-observable:PaymentAppFiles .

:techniqueDFT-1110
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1110: Preserve reference data"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1110" ;
    solveit-core:techniqueName "Preserve reference data" ;
    solveit-core:techniqueDetails "Reference data may be needed for later trace interpretation, but may change (especially server side software), so relevant data should be preserved close to the time of the event of interest" ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1172 ;
    solveit-core:hasReference :citationDFCite-1118 .

:techniqueDFT-1111
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1111: Record system clock offset"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1111" ;
    solveit-core:techniqueName "Record system clock offset" ;
    solveit-core:techniqueDescription "Recording a system clock compared with trusted time source" ;
    solveit-core:techniqueDetails "Collection of the time of a device clock compared with the correct time, allowing an offset to be calculated *for the point in time when the clock was observed*." ;
    solveit-core:hasCASEInputClass uco-observable:Device ;
    solveit-core:hasCASEOutputClass solveit-observable:ClockOffsetCapture,
                                    uco-observable:systemTime ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1173 .

:techniqueDFT-1112
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1112: Locate and remove physical disks from a device"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1112" ;
    solveit-core:techniqueName "Locate and remove physical disks from a device" ;
    solveit-core:techniqueDescription "Locate physical storage media within devices and removing them" ;
    solveit-core:hasCASEInputClass uco-observable:Computer ;
    solveit-core:hasCASEOutputClass uco-observable:StorageMedium ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1174,
                                      :weaknessDFW-1175,
                                      :weaknessDFW-1176 .

:techniqueDFT-1113
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1113: Access internal storage via bootable environment"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1113" ;
    solveit-core:techniqueName "Access internal storage via bootable environment" ;
    solveit-core:techniqueDescription "Booting the suspected computer device into an alternative operating system in order to image the attached disks." ;
    solveit-core:techniqueDetails "These operating systems are usually modified to contain forensic imaging tools and to avoid writing to the attached storage through the use of software write blocking (DFT-1013)" ;
    solveit-core:hasExample "PALADIN Forensic - is a modified “live” Linux distribution based on Ubuntu that simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox.",
                            "WinFE - Windows Forensic Environment, is forensically sound, bootable Windows operation system that can be burned into USB and plug the USB into suspected device. Then, after changing boot order, booting to the USB to create forensic images from the tested Windows, MacOS and Linux systems." ;
    solveit-core:hasCASEInputClass uco-observable:Computer ;
    solveit-core:hasCASEOutputClass solveit-observable:ReadWriteDeviceInterface ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1177,
                                      :weaknessDFW-1178,
                                      :weaknessDFW-1179,
                                      :weaknessDFW-1180,
                                      :weaknessDFW-1182 ;
    solveit-core:hasReference :citationDFCite-1071,
                              :citationDFCite-1112,
                              :citationDFCite-1132 .

:techniqueDFT-1114
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1114: Preserve memory contents via Cold Boot Attack"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1114" ;
    solveit-core:techniqueName "Preserve memory contents via Cold Boot Attack" ;
    solveit-core:techniqueDescription "A precursor to extracting volatile memory (RAM) from a powered-off system by quickly rebooting or transferring the memory module to another system before residual data fades. Cooling the memory modules can significantly slow down data decay, preserving critical data such as encryption keys or passwords." ;
    solveit-core:techniqueDetails "An examiner freezes a computer’s RAM by spraying it with liquid nitrogen or even using inverted canned air, then powering off the live system without proper shutdown, and then booting into an external plugged USB, and try capturing the residual RAM content (DFT-1003) with encryption keys that might still be stored there" ;
    solveit-core:hasSynonym "Cold Boot Attack",
                            "Extracting RAM data using Cold Boot Attack" ;
    solveit-core:hasCASEOutputClass uco-observable:Memory ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1032 ;
    solveit-core:hasReference :citationDFCite-1053 .

:techniqueDFT-1115
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1115: Visualize geolocation information"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1115" ;
    solveit-core:techniqueName "Visualize geolocation information" ;
    solveit-core:techniqueDescription "Presenting points or paths visually using extracted data, typically on a map" ;
    solveit-core:hasExample "Autopsy Geolocation view (Basis Technology 2020)",
                            "Magnet Axiom 'World map view' (Magnet 2020)" ;
    solveit-core:hasCASEInputClass <https://ontology.unifiedcyberontology.org/uco/location/Location> ;
    solveit-core:hasReference :citationDFCite-1010,
                              :citationDFCite-1092,
                              :citationDFCite-1093 .

:techniqueDFT-1116
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1116: Extract references to connected devices"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1116" ;
    solveit-core:techniqueName "Extract references to connected devices" ;
    solveit-core:techniqueDescription "Examine artifacts and extract indicators of devices that have been connected to the target device." ;
    solveit-core:techniqueDetails "This technique extracts references to other devices that have potentially been connected to the device being examined. The subsequent interpretation of these artifacts (using T1088: Relational-based event reconstruction), could result in HypothesisedDevices. The separate process for inferring the connected device(s) captures the uncertainty in such an interpretation." ;
    solveit-core:hasExample "ADB connected hosts",
                            "Paired bluetooth devices",
                            "Synronization artifacts referencing another device",
                            "USB connected devices",
                            "iOS backups from a computer" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1011,
                                      :weaknessDFW-1183,
                                      :weaknessDFW-1184 ;
    solveit-core:hasReference :citationDFCite-1001,
                              :citationDFCite-1057 .

:techniqueDFT-1117
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1117: Reconstruct the time that an event may have occurred"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1117" ;
    solveit-core:techniqueName "Reconstruct the time that an event may have occurred" ;
    solveit-core:techniqueDescription "The process of assigning a time component to a reconstructed event" ;
    solveit-core:hasSynonym "Temporal-based event reconstruction" ;
    solveit-core:hasCASEOutputClass solveit-analysis:hypothesisedDateTime ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1148,
                                      :weaknessDFW-1149,
                                      :weaknessDFW-1266 .

:techniqueDFT-1118
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1118: Locate relevant files by path"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1118" ;
    solveit-core:techniqueName "Locate relevant files by path" ;
    solveit-core:techniqueDescription "Use the path of file name to determine potential relevance of the file." ;
    solveit-core:techniqueDetails "There are multiple applications of this, for example: within a tool to determine what processing should occur to a file, or flagging files with particular extensions." ;
    solveit-core:hasSynonym "Filename matching" ;
    solveit-core:hasExample "Autopsy Interesting Files module",
                            "Pattern matching in ALEAPP/iLEAPP to trigger specific plugins" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-observable:FilteredFileSet,
                                    uco-observable:File ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1186,
                                      :weaknessDFW-1187,
                                      :weaknessDFW-1188 ;
    solveit-core:hasReference :citationDFCite-1006 .

:techniqueDFT-1119
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1119: Automatically scan for artifact changes caused by app updates"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1119" ;
    solveit-core:techniqueName "Automatically scan for artifact changes caused by app updates" ;
    solveit-core:techniqueDescription "Monitor every version change of an application to determine if there are changes to the way the app stores data" ;
    solveit-core:hasSynonym "App update monitoring" ;
    solveit-core:hasExample "Discussed in 'Puma: Automatically generating digital forensic reference data triggered by mobile application updates' (Claij-Swart et al. 2025)" ;
    solveit-core:hasCASEOutputClass uco-observable:TableField,
                                    uco-observable:filePath,
                                    uco-observable:hasChanged,
                                    uco-observable:tableSchema ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1191 ;
    solveit-core:hasReference :citationDFCite-1033,
                              :citationDFCite-1034 .

:techniqueDFT-1120
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1120: Extract artifacts from app data automatically"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1120" ;
    solveit-core:techniqueName "Extract artifacts from app data automatically" ;
    solveit-core:techniqueDescription "The use of automation to extract pieces of data that are potentially useful for a digital forensic investigation from app data." ;
    solveit-core:techniqueDetails "Artifacts extracted may be a direct mapping to lower levels of abstraction e.g. a database field 'message content' may map to an artifact 'message content', but in many cases, automated interpretation is applied where a field such as 'flag' containing numeric values, may be mapped to more meaningful text strings in the extracted artifact." ;
    solveit-core:hasSynonym "Automated trace extraction" ;
    solveit-core:hasExample "Axiom",
                            "Hansken",
                            "aLEAPP",
                            "iLEAPP" ;
    solveit-core:hasCASEInputClass solveit-observable:ApplicationFiles ;
    solveit-core:hasCASEOutputClass solveit-observable:ArtifactSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1189,
                                      :weaknessDFW-1190,
                                      :weaknessDFW-1258 .

:techniqueDFT-1121
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1121: Index a data source for keyword searching"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1121" ;
    solveit-core:techniqueName "Index a data source for keyword searching" ;
    solveit-core:techniqueDescription "Extracting strings from a data source and adding them to an index for subsequent searching." ;
    solveit-core:techniqueDetails "An index can be constructed over a set of files (including non-allocated space represented as files), a set of extracted artifacts, or both." ;
    solveit-core:hasSynonym "keyword indexing" ;
    solveit-core:hasCASEInputClass solveit-observable:ArtifactSet,
                                   solveit-observable:FileSet,
                                   solveit-observable:KeywordIndexingConfiguration ;
    solveit-core:hasCASEOutputClass solveit-observable:KeywordIndex ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1054,
                                      :weaknessDFW-1055,
                                      :weaknessDFW-1056,
                                      :weaknessDFW-1197,
                                      :weaknessDFW-1198 .

:techniqueDFT-1122
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1122: Keyword search (case-type wordlists)"@en ;
    rdfs:subClassOf :techniqueDFT-1049 ;
    solveit-core:techniqueID "DFT-1122" ;
    solveit-core:techniqueName "Keyword search (case-type wordlists)" ;
    solveit-core:techniqueDescription "Searching for case-type specific keywords" ;
    solveit-core:techniqueDetails "This complements case-specific wordlists (T1123) created for the individual case." ;
    solveit-core:hasExample "Example word lists https://www.dfir.training/downloads/search-terms" ;
    solveit-core:hasCASEOutputClass solveit-observable:KeywordSearchResultSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1057,
                                      :weaknessDFW-1059 ;
    solveit-core:hasReference :citationDFCite-1074 .

:techniqueDFT-1123
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1123: Keyword search (case-specific wordlists)"@en ;
    rdfs:subClassOf :techniqueDFT-1049 ;
    solveit-core:techniqueID "DFT-1123" ;
    solveit-core:techniqueName "Keyword search (case-specific wordlists)" ;
    solveit-core:techniqueDescription "Searching for case-specific keywords, e.g. people's names, places etc." ;
    solveit-core:techniqueDetails "This complements case-type wordlists (T1122) using words typical to specific offenses." ;
    solveit-core:hasCASEOutputClass solveit-observable:KeywordSearchResultSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1192,
                                      :weaknessDFW-1199 .

:techniqueDFT-1124
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1124: Keyword search (indexed)"@en ;
    rdfs:subClassOf :techniqueDFT-1049 ;
    solveit-core:techniqueID "DFT-1124" ;
    solveit-core:techniqueName "Keyword search (indexed)" ;
    solveit-core:techniqueDescription "Searching for keywords within a generated index of data in a case" ;
    solveit-core:hasSynonym "indexed search" ;
    solveit-core:hasCASEInputClass solveit-observable:KeywordIndex,
                                   solveit-observable:Wordlist ;
    solveit-core:hasCASEOutputClass solveit-observable:KeywordSearchResultSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1052 ;
    solveit-core:hasReference :citationDFCite-1103 .

:techniqueDFT-1125
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1125: Keyword search (live)"@en ;
    rdfs:subClassOf :techniqueDFT-1049 ;
    solveit-core:techniqueID "DFT-1125" ;
    solveit-core:techniqueName "Keyword search (live)" ;
    solveit-core:techniqueDescription "Searching for keywords over the raw data in a case without using an index of text content" ;
    solveit-core:techniqueDetails "This may be done on a physical sector basis, or on a logical (file) basis." ;
    solveit-core:hasSynonym "live search" ;
    solveit-core:hasCASEOutputClass solveit-observable:KeywordSearchResultSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1200,
                                      :weaknessDFW-1378 ;
    solveit-core:hasReference :citationDFCite-1103,
                              :citationDFCite-1133,
                              :citationDFCite-1134 .

:techniqueDFT-1126
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1126: Keyword search (live) (physical)"@en ;
    rdfs:subClassOf :techniqueDFT-1049 ;
    solveit-core:techniqueID "DFT-1126" ;
    solveit-core:techniqueName "Keyword search (live) (physical)" ;
    solveit-core:techniqueDescription "Searching for keywords over the raw data on a sector by sector basis" ;
    solveit-core:hasSynonym "live search" ;
    solveit-core:hasCASEOutputClass solveit-observable:KeywordSearchResultSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1193,
                                      :weaknessDFW-1194,
                                      :weaknessDFW-1195,
                                      :weaknessDFW-1378 ;
    solveit-core:hasReference :citationDFCite-1103,
                              :citationDFCite-1134 .

:techniqueDFT-1127
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1127: Keyword search (live) (logical)"@en ;
    rdfs:subClassOf :techniqueDFT-1049 ;
    solveit-core:techniqueID "DFT-1127" ;
    solveit-core:techniqueName "Keyword search (live) (logical)" ;
    solveit-core:techniqueDescription "Searching for keywords over the raw data, without an index of text content, but on a file by file basis" ;
    solveit-core:techniqueDetails "This approach can include decoding the individual file formats and content. It can also overcome limitations associated with compressed data or data split due to file fragmentation." ;
    solveit-core:hasSynonym "live search" ;
    solveit-core:hasCASEOutputClass solveit-observable:KeywordSearchResultSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1195,
                                      :weaknessDFW-1378 ;
    solveit-core:hasReference :citationDFCite-1103,
                              :citationDFCite-1133 .

:techniqueDFT-1128
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1128: Search for indicators of malware"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1128" ;
    solveit-core:techniqueName "Search for indicators of malware" ;
    solveit-core:techniqueDescription "Searching for the presence of current or historical malware on a system" ;
    solveit-core:techniqueDetails "This can involve searching for malware itself or other indicators e.g. persistence mechanisms, delivery method etc." ;
    solveit-core:hasSynonym "malware scan",
                            "virus scan" .

:techniqueDFT-1129
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1129: Search for indicators of clock tampering"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1129" ;
    solveit-core:techniqueName "Search for indicators of clock tampering" ;
    solveit-core:techniqueDescription "Searching for indicators that the system clock has been tampered with" ;
    solveit-core:hasReference :citationDFCite-1039,
                              :citationDFCite-1127 .

:techniqueDFT-1130
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1130: Search for indicators of encrypted data"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1130" ;
    solveit-core:techniqueName "Search for indicators of encrypted data" ;
    solveit-core:techniqueDescription "Searching for the presence of current or historical encrypted data on a system" ;
    solveit-core:techniqueDetails "This can include encryption software itself, or encrypted files." ;
    solveit-core:hasCASEOutputClass uco-observable:Application,
                                    uco-observable:File .

:techniqueDFT-1131
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1131: Search for indicators of trail obfuscation"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1131" ;
    solveit-core:techniqueName "Search for indicators of trail obfuscation" ;
    solveit-core:techniqueDescription "Searching for the presence of current or historical trail obfuscation on a system" ;
    solveit-core:hasCASEOutputClass uco-observable:Application ;
    solveit-core:hasReference :citationDFCite-1082 .

:techniqueDFT-1132
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1132: Search for indicators of artifact wiping"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1132" ;
    solveit-core:techniqueName "Search for indicators of artifact wiping" ;
    solveit-core:techniqueDescription "Searching for the presence of current or historical artifact wiping" ;
    solveit-core:hasSynonym "artifact scrubbing" ;
    solveit-core:hasCASEOutputClass uco-observable:Application ;
    solveit-core:hasReference :citationDFCite-1082 .

:techniqueDFT-1133
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1133: Extract artifacts from AI companion app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1133" ;
    solveit-core:techniqueName "Extract artifacts from AI companion app(s)" ;
    solveit-core:techniqueDescription "The forensic examination of the artifacts describing the configuration or the interaction with an AI companion app or service." ;
    solveit-core:techniqueDetails "An AI companion is defined as \"a type of generative AI-based conversational agent (CA) explicitly designed for companionship and friendship with a human user (Strohmann et al. 2022; Pentina et al. 2023)\" (Bayor et al 2025)." ;
    solveit-core:hasExample "See Hargreaves & Drury (2025)" ;
    solveit-core:hasCASEInputClass solveit-observable:AiChatAppFiles ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/configuration/Configuration>,
                                    uco-observable:Account,
                                    uco-observable:Call,
                                    uco-observable:Message,
                                    uco-observable:callType,
                                    uco-observable:emailAddress,
                                    uco-observable:messageType,
                                    uco-observable:phoneNumber,
                                    uco-observable:receivedTime,
                                    uco-observable:sentTime ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1201,
                                      :weaknessDFW-1202,
                                      :weaknessDFW-1203,
                                      :weaknessDFW-1204,
                                      :weaknessDFW-1205,
                                      :weaknessDFW-1206,
                                      :weaknessDFW-1207,
                                      :weaknessDFW-1208,
                                      :weaknessDFW-1209,
                                      :weaknessDFW-1210,
                                      :weaknessDFW-1211,
                                      :weaknessDFW-1212,
                                      :weaknessDFW-1213,
                                      :weaknessDFW-1214,
                                      :weaknessDFW-1215,
                                      :weaknessDFW-1216,
                                      :weaknessDFW-1217,
                                      :weaknessDFW-1218,
                                      :weaknessDFW-1219,
                                      :weaknessDFW-1220,
                                      :weaknessDFW-1221,
                                      :weaknessDFW-1222,
                                      :weaknessDFW-1223,
                                      :weaknessDFW-1224,
                                      :weaknessDFW-1225,
                                      :weaknessDFW-1226,
                                      :weaknessDFW-1227 ;
    solveit-core:hasReference :citationDFCite-1012,
                              :citationDFCite-1055 .

:techniqueDFT-1134
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1134: Use time anchors to estimate clock offset"@en ;
    rdfs:subClassOf :techniqueDFT-1086 ;
    solveit-core:techniqueID "DFT-1134" ;
    solveit-core:techniqueName "Use time anchors to estimate clock offset" ;
    solveit-core:techniqueDescription "Correlate timestamps from the system clock and an external trusted time source (Time Anchoring)" ;
    solveit-core:techniqueDetails "Correlate timestamps from the system clock and an external trusted source of time contained in the same artifact, allowing an offset to be estimated *for the point in time the timestamp was recorded*" ;
    solveit-core:hasSynonym "Time anchoring (Vanini et al 2024)",
                            "Timestamp correlation" ;
    solveit-core:hasExample "Browser caches often contain local timestamps and those derived from external servers",
                            "Email headers often record timestamps derived from external mail servers as well as timestamps generated by the local system time",
                            "Missed call or voicemail notification messages often include a timestamp derived from an external time source, e.g., missed call from XX on 2018-06-06 at 01:32:49 pm, which can be compared to the local file system time the message was received",
                            "Records in web browser history databases contain local timestamps and, in some cases, timestamps from external servers, embedded in URLs" ;
    solveit-core:hasCASEInputClass solveit-observable:DateTimeStamp ;
    solveit-core:hasCASEOutputClass solveit-observable:TimestampOffset ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1260,
                                      :weaknessDFW-1261,
                                      :weaknessDFW-1262,
                                      :weaknessDFW-1263 ;
    solveit-core:hasReference :citationDFCite-1020 .

:techniqueDFT-1137
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1137: Extract browser history artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1137" ;
    solveit-core:techniqueName "Extract browser history artifacts" ;
    solveit-core:techniqueDescription "The examination of the history component of a web browser." ;
    solveit-core:techniqueDetails "Typically this would involve the examination of data in one or more SQLite tables." ;
    solveit-core:hasSynonym "internet history examination",
                            "web history examination" ;
    solveit-core:hasExample "History for Chrome",
                            "places.sqlite for Firefox" ;
    solveit-core:hasCASEInputClass solveit-observable:BrowserAppFiles ;
    solveit-core:hasCASEOutputClass uco-observable:URLHistory ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1108,
                                      :weaknessDFW-1109,
                                      :weaknessDFW-1110,
                                      :weaknessDFW-1111,
                                      :weaknessDFW-1112,
                                      :weaknessDFW-1243,
                                      :weaknessDFW-1244,
                                      :weaknessDFW-1245,
                                      :weaknessDFW-1246 .

:techniqueDFT-1138
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1138: Extract browser cache artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1138" ;
    solveit-core:techniqueName "Extract browser cache artifacts" ;
    solveit-core:techniqueDescription "The examination of the content saved locally by browsers to improve performance" ;
    solveit-core:hasSynonym "internet cache examination",
                            "web cache examination" ;
    solveit-core:hasCASEInputClass solveit-observable:BrowserCacheData ;
    solveit-core:hasCASEOutputClass solveit-observable:httpResponseHeader,
                                    uco-observable:File,
                                    uco-observable:URL,
                                    uco-observable:httpRequestHeader ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1252 ;
    solveit-core:hasReference :citationDFCite-1148 .

:techniqueDFT-1139
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1139: Extract browser session artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1139" ;
    solveit-core:techniqueName "Extract browser session artifacts" ;
    solveit-core:techniqueDescription "The examination of sessions and open tabs and their individual histories" .

:techniqueDFT-1140
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1140: Extract browser autofill artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1140" ;
    solveit-core:techniqueName "Extract browser autofill artifacts" ;
    solveit-core:techniqueDescription "The examination of data that is stored to autocomplete entries in forms" .

:techniqueDFT-1141
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1141: Extract browser bookmark artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1141" ;
    solveit-core:techniqueName "Extract browser bookmark artifacts" ;
    solveit-core:techniqueDescription "The examination of the links saved within a browser to facilitate quick access" ;
    solveit-core:hasCASEOutputClass uco-observable:BrowserBookmark ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1247 .

:techniqueDFT-1142
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1142: Extract browser download artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1142" ;
    solveit-core:techniqueName "Extract browser download artifacts" ;
    solveit-core:techniqueDescription "The examination of records of files downloaded with a browser" ;
    solveit-core:hasCASEOutputClass uco-observable:File,
                                    uco-observable:URL ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1248 .

:techniqueDFT-1143
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1143: Extract browser configuration artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1143" ;
    solveit-core:techniqueName "Extract browser configuration artifacts" ;
    solveit-core:techniqueDescription "The examination of a browsers configuration" ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/configuration/Configuration> .

:techniqueDFT-1144
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1144: Enumerate browser profiles"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1144" ;
    solveit-core:techniqueName "Enumerate browser profiles" ;
    solveit-core:techniqueDescription "The enumeration of the separate user profiles set up within a browser" ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1249 .

:techniqueDFT-1145
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1145: Extract browser extensions artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1145" ;
    solveit-core:techniqueName "Extract browser extensions artifacts" ;
    solveit-core:techniqueDescription "The examination of the extensions installed within a browser" .

:techniqueDFT-1146
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1146: Extract browser synchronization artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1146" ;
    solveit-core:techniqueName "Extract browser synchronization artifacts" ;
    solveit-core:techniqueDescription "The examination of the settings and artifacts resulting from a browser synchronization feature" ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/configuration/Configuration> .

:techniqueDFT-1147
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1147: Extract browser cookie artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1147" ;
    solveit-core:techniqueName "Extract browser cookie artifacts" ;
    solveit-core:techniqueDescription "The examination of stored browser cookies" ;
    solveit-core:hasCASEOutputClass uco-observable:BrowserCookie,
                                    uco-observable:CookieHistory .

:techniqueDFT-1148
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1148: Extract browser web storage artifacts"@en ;
    rdfs:subClassOf :techniqueDFT-1069 ;
    solveit-core:techniqueID "DFT-1148" ;
    solveit-core:techniqueName "Extract browser web storage artifacts" ;
    solveit-core:techniqueDescription "The examination of " ;
    solveit-core:techniqueDetails "Web storage is a browser-based API bundled in HTML5 specifications that allow persistent client-side storage for web applications. (Mendoza 2015)" ;
    solveit-core:hasSynonym "HTML5 storage examination",
                            "browser storage examination",
                            "local storage examination",
                            "web storage examination" ;
    solveit-core:hasReference :citationDFCite-1099 .

:techniqueDFT-1149
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1149: Extract artifacts from the file versioning feature"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1149" ;
    solveit-core:techniqueName "Extract artifacts from the file versioning feature" ;
    solveit-core:techniqueDescription "Extraction of data from the versioning system used by an operating system to store older versions of files." ;
    solveit-core:techniqueDetails "Operating systems often maintain versioning systems that preserve older versions of files, either for backup purposes or to enable users to restore previous states. These systems create snapshots or shadow copies at regular intervals or when significant changes occur. Digital forensic examination of these versioning features can reveal files that have been modified or deleted, providing valuable evidence of system activity and user behavior. The examination process involves identifying the versioning mechanism used by the operating system, locating the stored versions, and extracting relevant data for analysis." ;
    solveit-core:hasSynonym "'Revert to...' feature examination",
                            "macOS 'Versions' examination",
                            "previous versions",
                            "shadow copy examination" ;
    solveit-core:hasExample "MacOS \"Revert to\" feature",
                            "Volume Shadow Service (VSS)" ;
    solveit-core:hasCASEOutputClass uco-observable:File,
                                    uco-observable:modifiedTime,
                                    uco-observable:version ;
    solveit-core:hasReference :citationDFCite-1005,
                              :citationDFCite-1059,
                              :citationDFCite-1087,
                              :citationDFCite-1120 .

:techniqueDFT-1150
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1150: Recover non-allocated files using residual file metadata"@en ;
    rdfs:subClassOf :techniqueDFT-1061 ;
    solveit-core:techniqueID "DFT-1150" ;
    solveit-core:techniqueName "Recover non-allocated files using residual file metadata" ;
    solveit-core:techniqueDescription "Use metadata that remains in the file system to recover non-allocated files" ;
    solveit-core:hasCASEInputClass uco-observable:FileSystem ;
    solveit-core:hasCASEOutputClass uco-core:confidence,
                                    uco-observable:Directory,
                                    uco-observable:File ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1134,
                                      :weaknessDFW-1135,
                                      :weaknessDFW-1253,
                                      :weaknessDFW-1254,
                                      :weaknessDFW-1255,
                                      :weaknessDFW-1256 ;
    solveit-core:hasReference :citationDFCite-1024,
                              :citationDFCite-1030 .

:techniqueDFT-1151
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1151: Keyword search (over extracted artifacts)"@en ;
    rdfs:subClassOf :techniqueDFT-1049 ;
    solveit-core:techniqueID "DFT-1151" ;
    solveit-core:techniqueName "Keyword search (over extracted artifacts)" ;
    solveit-core:techniqueDescription "Keyword searching only applied over extracted artifacts" ;
    solveit-core:techniqueDetails "This limited scope search may be performed within tools themselves e.g. McQuaid (2017), or within an exported packaged report." ;
    solveit-core:hasSynonym "search artifacts only" ;
    solveit-core:hasExample "Using Keywords with Magnet AXIOM (McQuaid 2017)" ;
    solveit-core:hasCASEInputClass solveit-observable:ArtifactSet ;
    solveit-core:hasCASEOutputClass solveit-observable:KeywordSearchResultSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1257 ;
    solveit-core:hasReference :citationDFCite-1098 .

:techniqueDFT-1153
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1153: Apply offset to a timestamp"@en ;
    rdfs:subClassOf :techniqueDFT-1052 ;
    solveit-core:techniqueID "DFT-1153" ;
    solveit-core:techniqueName "Apply offset to a timestamp" ;
    solveit-core:techniqueDescription "Application of a time offset to a timestamp" ;
    solveit-core:techniqueDetails "This could be a clock offset, a timezone or other reason for a timestamp correction" ;
    solveit-core:hasCASEOutputClass solveit-observable:DateTimeStamp,
                                    solveit-observable:TimelineEntry ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1264,
                                      :weaknessDFW-1265,
                                      :weaknessDFW-1267,
                                      :weaknessDFW-1268 .

:techniqueDFT-1154
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1154: Reconstruct an identity associated with an event"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1154" ;
    solveit-core:techniqueName "Reconstruct an identity associated with an event" ;
    solveit-core:techniqueDescription "The process of attempting to link an identity (account, person etc.) to a reconstructed event" ;
    solveit-core:hasSynonym "Identity-based event reconstruction",
                            "Resolving the person-account gap,",
                            "Resolving the person-device gap" ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/identity/Person>,
                                    uco-core:confidence,
                                    uco-observable:Account ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1150 ;
    solveit-core:hasReference :citationDFCite-1027,
                              :citationDFCite-1119 .

:techniqueDFT-1155
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1155: Reconstruct that a specific event may have occurred"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1155" ;
    solveit-core:techniqueName "Reconstruct that a specific event may have occurred" ;
    solveit-core:techniqueDescription "The process of reconstructing that an operation occurred on a digital system" ;
    solveit-core:techniqueDetails """While some event reconstruction needs a time component, there are some questions that are simply explaining what happened, or if something happened. The time component may need to investigated later, or may be learned as a byproduct of reconstructing the event, but isn't intrinsic to the question being asked.
e.g. Was this file opened? How many times was this file opened? What data has been exfiltrated?""" ;
    solveit-core:hasSynonym "Action-based event reconstruction",
                            "Activity-based event reconstruction",
                            "Operation-based event reconstruction" ;
    solveit-core:hasCASEInputClass solveit-observable:ArtifactSet,
                                   solveit-observable:FileSet,
                                   solveit-observable:Timeline ;
    solveit-core:hasCASEOutputClass solveit-analysis:HypothesisedEvent ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1150 .

:techniqueDFT-1156
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1156: Reconstruct if an event could have functionally occurred on a system given its capabilities"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1156" ;
    solveit-core:techniqueName "Reconstruct if an event could have functionally occurred on a system given its capabilities" ;
    solveit-core:techniqueDescription "Reconstructing the configuration or capabilities of a system at the time of an event" ;
    solveit-core:techniqueDetails """Considering how a system works and what conditions were necessary for an event to be possible, i.e. supporting or refuting if a hypothesis is feasible.

This might involve questions such as:
- is a program or system capable of performing some action
- how was the program or system configured (to determine if an operation was possible)""" ;
    solveit-core:hasSynonym "Functional-based event reconstruction" ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/configuration/Configuration>,
                                    <https://ontology.unifiedcyberontology.org/uco/configuration/dependencies>,
                                    uco-core:confidence .

:techniqueDFT-1157
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1157: Extract device data using exposed service"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1157" ;
    solveit-core:techniqueName "Extract device data using exposed service" ;
    solveit-core:techniqueDescription "Use an exposed service on a device to extract data. This represents several of the mobile data extraction methods e.g. Query content providers (android), AFC (iOS)." ;
    solveit-core:hasExample "Android Debug Bridge (ADB) provides command line access when USB debugging is enabled on Android devices",
                            "Extraction of data by querying Content Providers on Android (via ADB)",
                            "Extraction of data using AFC on iOS",
                            "Media Transfer Protocol (MTP)" ;
    solveit-core:hasCASEInputClass uco-observable:MobileDevice ;
    solveit-core:hasCASEOutputClass solveit-observable:ServiceBasedExtractionData ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1037,
                                      :weaknessDFW-1040,
                                      :weaknessDFW-1041,
                                      :weaknessDFW-1271,
                                      :weaknessDFW-1272,
                                      :weaknessDFW-1273 ;
    solveit-core:hasSubtechnique :techniqueDFT-1019 .

:techniqueDFT-1158
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1158: Configure device to enable a service needed for data extraction"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1158" ;
    solveit-core:techniqueName "Configure device to enable a service needed for data extraction" ;
    solveit-core:techniqueDescription "Change a setting on a device such that a service needed for data extraction is enabled. This may require a user PIN that can be obtained using other techniques." ;
    solveit-core:hasExample "Turn on developer mode to make use of Android Debug Bridge (ADB)" ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1274 ;
    solveit-core:hasReference :citationDFCite-1004 .

:techniqueDFT-1159
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1159: Extract mobile data via deployed agent"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1159" ;
    solveit-core:techniqueName "Extract mobile data via deployed agent" ;
    solveit-core:techniqueDescription "Deploy software to a mobile device that can carry out some function, either collect data with available permissions or attempt further exploitation e.g. sandbox escape." ;
    solveit-core:techniqueDetails "While Android agents can be sideloaded with adb, deploying agents on iOS may require a developer account. Output may be equivalent of a file system acquisition if an exploit is successful. Otherwise data such as contacts would be extracted." ;
    solveit-core:hasExample "Belkasoft",
                            "Elcomsoft" ;
    solveit-core:hasCASEInputClass uco-observable:MobileDevice ;
    solveit-core:hasCASEOutputClass solveit-observable:ServiceBasedExtractionData ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1276 ;
    solveit-core:hasReference :citationDFCite-1016,
                              :citationDFCite-1041 .

:techniqueDFT-1160
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1160: Collect data with 'cloud backup restore' approach"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1160" ;
    solveit-core:techniqueName "Collect data with 'cloud backup restore' approach" ;
    solveit-core:techniqueDescription "Restore a device's cloud backup to a donor device, then subsequently use a local acquisition approach on that donor device, e.g. T1019/T1020" ;
    solveit-core:hasCASEOutputClass uco-observable:SmartDevice ;
    solveit-core:hasReference :citationDFCite-1046 .

:techniqueDFT-1161
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1161: Collect data from cloud service via API using credentials"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1161" ;
    solveit-core:techniqueName "Collect data from cloud service via API using credentials" ;
    solveit-core:techniqueDescription "Copying data from a cloud service using the officially supported API of the provider." ;
    solveit-core:techniqueDetails "API-based forensic acquisition of cloud data using the officially supported API of the provider can provide additional details and structure that is not available via other access methods. Requests may target public or undocumented endpoints identified via network observation or reverse engineering. Returned responses may include artifacts such as messages, file metadata, activity logs, and identity attributes. Analysts may use traffic capture tools or instrumentation to extract and store this data for forensic or intelligence purposes, both reactively and proactively." ;
    solveit-core:hasSynonym "API-based cloud acquisition",
                            "Cloud Data Collection via RESTful API" ;
    solveit-core:hasExample "Cellebrite UFED Cloud",
                            "FOREST (open-source cloud forensic tool)",
                            "Magnet AXIOM Cloud",
                            "Oxygen Forensic Cloud Extractor",
                            "kumodd" ;
    solveit-core:hasCASEInputClass uco-observable:OnlineService ;
    solveit-core:hasCASEOutputClass solveit-observable:FileSet,
                                    uco-observable:Account,
                                    uco-observable:ContentData,
                                    uco-observable:EventRecord,
                                    uco-observable:File,
                                    uco-observable:Message ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1356,
                                      :weaknessDFW-1357,
                                      :weaknessDFW-1358,
                                      :weaknessDFW-1359,
                                      :weaknessDFW-1360,
                                      :weaknessDFW-1361,
                                      :weaknessDFW-1362,
                                      :weaknessDFW-1363,
                                      :weaknessDFW-1364,
                                      :weaknessDFW-1365,
                                      :weaknessDFW-1366,
                                      :weaknessDFW-1367,
                                      :weaknessDFW-1368,
                                      :weaknessDFW-1369,
                                      :weaknessDFW-1370,
                                      :weaknessDFW-1371,
                                      :weaknessDFW-1372,
                                      :weaknessDFW-1373,
                                      :weaknessDFW-1374,
                                      :weaknessDFW-1375,
                                      :weaknessDFW-1376,
                                      :weaknessDFW-1377 ;
    solveit-core:hasReference :citationDFCite-1159,
                              :citationDFCite-1160,
                              :citationDFCite-1161 .

:techniqueDFT-1162
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1162: Read data from a device via In-System Programming (ISP)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1162" ;
    solveit-core:techniqueName "Read data from a device via In-System Programming (ISP)" ;
    solveit-core:hasSynonym "ISCP",
                            "In-circuit serial Programming" ;
    solveit-core:hasCASEOutputClass uco-observable:Image ;
    solveit-core:hasSubtechnique :techniqueDFT-1027 ;
    solveit-core:hasReference :citationDFCite-1136 .

:techniqueDFT-1163
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1163: Capture mobile device screenshots (automatically)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1163" ;
    solveit-core:techniqueName "Capture mobile device screenshots (automatically)" ;
    solveit-core:techniqueDescription "Programmatically controlling a mobile device while capturing screenshots of the display." ;
    solveit-core:techniqueDetails "This is the automated version of DFT-1022. The device is controlled programmatically, and screenshots are captured automatically." ;
    solveit-core:hasCASEInputClass uco-observable:MobileDevice ;
    solveit-core:hasCASEOutputClass solveit-observable:DeviceScreenshotCapture ;
    solveit-core:hasReference :citationDFCite-1137,
                              :citationDFCite-1138 .

:techniqueDFT-1164
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1164: Read data directly from a block device"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1164" ;
    solveit-core:techniqueName "Read data directly from a block device" ;
    solveit-core:techniqueDescription "Rather than imaging a block device, this involves accessing it directly without the expectation of saving block data to a forensic image format." ;
    solveit-core:techniqueDetails "This would typically be followed by processing of the data that is read to then provide a live view of partitions and file systems, and facilitates logical file extraction or any other direct operations on the data." ;
    solveit-core:hasCASEInputClass solveit-observable:ReadWriteDeviceInterface,
                                   solveit-observable:WriteProtectedDeviceInterface ;
    solveit-core:hasCASEOutputClass solveit-observable:BitstreamRandomAccessed .

:techniqueDFT-1165
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1165: Extract software configuration information"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1165" ;
    solveit-core:techniqueName "Extract software configuration information" ;
    solveit-core:techniqueDescription "Examination of one or more files to extract configuration information for a piece of software." ;
    solveit-core:techniqueDetails "A configuration file of a browser for example may contain the home page that is set or other information. This technique extracts and presents that configuration information." ;
    solveit-core:hasCASEInputClass solveit-observable:ApplicationFiles ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/configuration/Configuration> .

:techniqueDFT-1166
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1166: Connect directly to storage media"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1166" ;
    solveit-core:techniqueName "Connect directly to storage media" ;
    solveit-core:techniqueDescription "This technique describes the occasions where it is necessary to connect directly to a disk without a hardware write blocker. This would typically then involve a subseqeunt software write blocker, which then presents a write protected interface." ;
    solveit-core:hasCASEInputClass uco-observable:Disk,
                                   uco-observable:StorageMedium ;
    solveit-core:hasCASEOutputClass solveit-observable:ReadWriteDeviceInterface ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1277 .

:techniqueDFT-1167
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1167: Extract search terms from URLs"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1167" ;
    solveit-core:techniqueName "Extract search terms from URLs" ;
    solveit-core:techniqueDescription "Parsing a URL and extracting search terms from the parameters." ;
    solveit-core:techniqueDetails """These may be `q=` strings or some other encoded parameters. 

This would include web search URLs such as Google searches but could also include search terms entered into other sites such as travel or shopping sites.""" ;
    solveit-core:hasExample "DuckDuckGo search URLs",
                            "Google search URLs" ;
    solveit-core:hasCASEInputClass uco-observable:URL,
                                   uco-observable:URLHistory,
                                   uco-observable:urlHistoryEntry ;
    solveit-core:hasCASEOutputClass uco-observable:keywordSearchTerm ;
    solveit-core:hasReference :citationDFCite-1065 .

:techniqueDFT-1168
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1168: Identify volumes"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1168" ;
    solveit-core:techniqueName "Identify volumes" ;
    solveit-core:techniqueDescription "From a partition or data from a full disk, identify volumes." ;
    solveit-core:hasCASEInputClass solveit-observable:BitstreamRandomAccessed,
                                   uco-observable:DiskPartition ;
    solveit-core:hasCASEOutputClass uco-observable:FileSystem ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1300 .

:techniqueDFT-1169
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1169: Filter files related to an application"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1169" ;
    solveit-core:techniqueName "Filter files related to an application" ;
    solveit-core:techniqueDescription "This technique takes a set of files and determines which are related to a specified application." ;
    solveit-core:techniqueDetails "A research process informs the set of files that are likely to be relevant to a particular application." ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-observable:AiChatAppFiles,
                                    solveit-observable:ApplicationFiles,
                                    solveit-observable:BrowserAppFiles,
                                    solveit-observable:BrowserCacheData,
                                    solveit-observable:CalendarAppFiles,
                                    solveit-observable:ChatAppFiles,
                                    solveit-observable:EmailAppFiles,
                                    solveit-observable:GamingAppFiles,
                                    solveit-observable:HealthAppFiles,
                                    solveit-observable:MapsAppFiles,
                                    solveit-observable:NavigationAppFiles,
                                    solveit-observable:PaymentAppFiles,
                                    solveit-observable:PhotosAppFiles,
                                    solveit-observable:RemindersAppFiles,
                                    solveit-observable:SocialMediaAppFiles .

:techniqueDFT-1170
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1170: Read contents from logical forensic container file(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1170" ;
    solveit-core:techniqueName "Read contents from logical forensic container file(s)" ;
    solveit-core:techniqueDescription "Decodes logical image formats such as L01, AD1, CTR, or AFF4-L. The output here is not an image file but rather a set of files and their metadata." ;
    solveit-core:hasSynonym "Logical image decoding",
                            "Read logical image" ;
    solveit-core:hasExample "AD1",
                            "AFF4-L",
                            "CTR",
                            "L01" ;
    solveit-core:hasCASEInputClass solveit-observable:LogicalImageContainer ;
    solveit-core:hasCASEOutputClass solveit-observable:FileSet ;
    solveit-core:hasReference :citationDFCite-1035,
                              :citationDFCite-1069 .

:techniqueDFT-1171
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1171: Access a file system via live operating system"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1171" ;
    solveit-core:techniqueName "Access a file system via live operating system" ;
    solveit-core:techniqueDescription "This involves accessing a live system and relying on the operating system's parsing of the file system to access files." ;
    solveit-core:hasSynonym "Access file system via the running operating system" ;
    solveit-core:hasCASEInputClass uco-observable:Computer ;
    solveit-core:hasCASEOutputClass solveit-observable:FileSet .

:techniqueDFT-1172
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1172: Read bitstream from raw image file(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1172" ;
    solveit-core:techniqueName "Read bitstream from raw image file(s)" ;
    solveit-core:techniqueDescription "This technique reads data from a raw image e.g. a dd image." ;
    solveit-core:techniqueDetails "This provides the 'raw' equivalent of reading data from a forensic image container e.g. EWF. This provides random access to the bitstream so the stored sectors can be processed further." ;
    solveit-core:hasSynonym "read dd file" ;
    solveit-core:hasCASEInputClass solveit-observable:RawImage ;
    solveit-core:hasCASEOutputClass solveit-observable:BitstreamRandomAccessed .

:techniqueDFT-1173
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1173: Extract data from captured screenshots"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1173" ;
    solveit-core:techniqueName "Extract data from captured screenshots" ;
    solveit-core:techniqueDescription "Processing a screenshot captured from a device to extract data for further processing." ;
    solveit-core:techniqueDetails "When data has been captured from devices as screenshots, data can be extracted from them using OCR techniques to incorporate into the broader case data e..g to make searchable." ;
    solveit-core:hasCASEInputClass solveit-observable:DeviceScreenshotCapture ;
    solveit-core:hasCASEOutputClass uco-observable:Contact,
                                    uco-observable:Message .

:techniqueDFT-1174
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1174: Read evidential files stored directly on local file system"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1174" ;
    solveit-core:techniqueName "Read evidential files stored directly on local file system" ;
    solveit-core:techniqueDescription "Represents reading files that have been acquired or extracted directly to the local file system." ;
    solveit-core:techniqueDetails "For example an ADB pull command against a directory can result in a set of files copied to the local file system. This represents reading those files directly to extract information." ;
    solveit-core:hasCASEInputClass solveit-observable:ADBPullData,
                                   solveit-observable:AFCExtractionData,
                                   uco-observable:File ;
    solveit-core:hasCASEOutputClass solveit-observable:FileSet .

:techniqueDFT-1175
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1175: Extract data from an Android device using content queries"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1175" ;
    solveit-core:techniqueName "Extract data from an Android device using content queries" ;
    solveit-core:techniqueDescription "Use of content queries on Android devices via adb to extract specific pieces of data exposed by content providers." ;
    solveit-core:hasCASEInputClass uco-observable:AndroidPhone ;
    solveit-core:hasCASEOutputClass uco-observable:Call,
                                    uco-observable:Contact,
                                    uco-observable:Message ;
    solveit-core:hasReference :citationDFCite-1047 .

:techniqueDFT-1176
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1176: Classify if an image is potentially synthetically generated"@en ;
    rdfs:subClassOf :techniqueDFT-1081 ;
    solveit-core:techniqueID "DFT-1176" ;
    solveit-core:techniqueName "Classify if an image is potentially synthetically generated" ;
    solveit-core:techniqueDescription "Classification of images with respect to their origin, i.e., whether they are synthetically generated or naturally captured by a camera." ;
    solveit-core:techniqueDetails "An image is analyzed using a method from the subtechniques. The output can be a classifier-predicted score of how many traces of synthetic origin can be found in an image, or extracted traces from the image that aid the analyst in their assessment of the image origin." ;
    solveit-core:hasSynonym "Deepfake Detection, Synthetic Image Detection, Image Source Attribution, Image Authentication, Image Source Classification" ;
    solveit-core:hasCASEInputClass uco-observable:RasterPicture ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification> .

:techniqueDFT-1177
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1177: Extract artifacts from multiplayer game app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1177" ;
    solveit-core:techniqueName "Extract artifacts from multiplayer game app(s)" ;
    solveit-core:techniqueDescription "Extracting artifacts from multiplayer gaming apps." ;
    solveit-core:techniqueDetails "Multiplayer game apps often offer messaging, contacts/friends, and other features that could contain data that may be relevant to many types of case." ;
    solveit-core:hasSynonym "gaming app examination" ;
    solveit-core:hasCASEInputClass solveit-observable:GamingAppFiles ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/configuration/Configuration>,
                                    uco-observable:Account,
                                    uco-observable:Contact,
                                    uco-observable:Message ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1279,
                                      :weaknessDFW-1280,
                                      :weaknessDFW-1281,
                                      :weaknessDFW-1282,
                                      :weaknessDFW-1283,
                                      :weaknessDFW-1284,
                                      :weaknessDFW-1285,
                                      :weaknessDFW-1286,
                                      :weaknessDFW-1287,
                                      :weaknessDFW-1288,
                                      :weaknessDFW-1289,
                                      :weaknessDFW-1290,
                                      :weaknessDFW-1291,
                                      :weaknessDFW-1292,
                                      :weaknessDFW-1293,
                                      :weaknessDFW-1294 ;
    solveit-core:hasReference :citationDFCite-1143 .

:techniqueDFT-1178
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1178: Store bitstream data in a raw image format"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1178" ;
    solveit-core:techniqueName "Store bitstream data in a raw image format" ;
    solveit-core:techniqueDescription "Storage of bitstream data recovered from a digital device as raw files." ;
    solveit-core:techniqueDetails "Bitstream data resulting from disk imaging stored in a raw format. The imaged data may be stored as one file or split into several segments. The raw files may also be accompanied by complementary separate metadata files." ;
    solveit-core:hasSynonym "store dd image",
                            "write dd image" ;
    solveit-core:hasCASEInputClass solveit-observable:Bitstream ;
    solveit-core:hasCASEOutputClass solveit-observable:RawImage .

:techniqueDFT-1179
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1179: Extract artifacts from drone/UAV app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1179" ;
    solveit-core:techniqueName "Extract artifacts from drone/UAV app(s)" ;
    solveit-core:techniqueDescription "The examination of a mobile app used to control Unmanned Areial Vehicles (UAVs) or 'drones'." ;
    solveit-core:hasSynonym "UAV app examination" .

:techniqueDFT-1180
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1180: Extract file(s) from a pre-deletion container"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1180" ;
    solveit-core:techniqueName "Extract file(s) from a pre-deletion container" ;
    solveit-core:techniqueDescription "An examination of the operating system structures that represent the 'pre-deletion' container (i.e. Recycle Bin/Trash) to extract those files and potentially additional metadata such as original path or date it was moved." ;
    solveit-core:techniqueDetails """Content in pre-deletion containers such as the recycle bin/trash is not always viewable in a useful form without further processing. 
This further processing should provide access to the file content but also potentially additional information such as data sent to recycle bin, or original path.""" ;
    solveit-core:hasSynonym "Recycle Bin examination",
                            "Trash examination" ;
    solveit-core:hasExample "Windows Recycle Bin",
                            "macOS Trash" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-observable:DateTimeStamp,
                                    uco-observable:File,
                                    uco-observable:path .

:techniqueDFT-1181
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1181: Extract artifacts from smart home app(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1181" ;
    solveit-core:techniqueName "Extract artifacts from smart home app(s)" ;
    solveit-core:techniqueDescription "Examine the data stored by an app designed to control, monitor or program smart home capabilities." ;
    solveit-core:techniqueDetails "There are many other components to a smart home system including the devices themselves (possibly different hubs and sensors), plus the online content. This technique focuses on the app." ;
    solveit-core:hasExample "Apple Home",
                            "Philips Hue",
                            "SmartThings" ;
    solveit-core:hasCASEInputClass solveit-observable:SmartHomeAppFiles ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/location/Location> .

:techniqueDFT-1182
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1182: Filter a timeline for relevant entries"@en ;
    rdfs:subClassOf :techniqueDFT-1086 ;
    solveit-core:techniqueID "DFT-1182" ;
    solveit-core:techniqueName "Filter a timeline for relevant entries" ;
    solveit-core:techniqueDescription "Provide some criteria that selects only a subset of timeline entries from a set. " ;
    solveit-core:techniqueDetails "Filtering might be on timestamp type, within a defined time range, related to a particular file, or matching against some other content associated with the timestamp entries. " ;
    solveit-core:hasExample "Plaso",
                            "TimeSketch" ;
    solveit-core:hasCASEInputClass solveit-observable:Timeline ;
    solveit-core:hasCASEOutputClass solveit-observable:Timeline ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1295,
                                      :weaknessDFW-1296,
                                      :weaknessDFW-1297,
                                      :weaknessDFW-1298,
                                      :weaknessDFW-1299 .

:techniqueDFT-1184
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1184: Sort a timeline so entries are ordered chronologically"@en ;
    rdfs:subClassOf :techniqueDFT-1086 ;
    solveit-core:techniqueID "DFT-1184" ;
    solveit-core:techniqueName "Sort a timeline so entries are ordered chronologically" ;
    solveit-core:techniqueDescription "Order a timeline based on the values in the timestamp entry." ;
    solveit-core:techniqueDetails "This may be applied automatically to a generated timeline or may be applied as a separate process. " ;
    solveit-core:hasExample "Plaso",
                            "TimeSketch" ;
    solveit-core:hasCASEInputClass solveit-observable:Timeline ;
    solveit-core:hasCASEOutputClass solveit-observable:SortedTimeline ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1308,
                                      :weaknessDFW-1309,
                                      :weaknessDFW-1310,
                                      :weaknessDFW-1311,
                                      :weaknessDFW-1312,
                                      :weaknessDFW-1313,
                                      :weaknessDFW-1314 .

:techniqueDFT-1185
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1185: Extract data from operating system notifications"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1185" ;
    solveit-core:techniqueName "Extract data from operating system notifications" ;
    solveit-core:techniqueDescription "Recovery of the notifications produced by applications that are stored by the operating system. " ;
    solveit-core:hasSynonym "Notification analysis",
                            "WPN analysis" ;
    solveit-core:hasCASEInputClass uco-observable:Message ;
    solveit-core:hasCASEOutputClass solveit-observable:DateTimeStamp,
                                    uco-observable:Message ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1315,
                                      :weaknessDFW-1316,
                                      :weaknessDFW-1317,
                                      :weaknessDFW-1318,
                                      :weaknessDFW-1319,
                                      :weaknessDFW-1320,
                                      :weaknessDFW-1321 ;
    solveit-core:hasReference :citationDFCite-1149,
                              :citationDFCite-1150 .

:techniqueDFT-1186
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1186: Compute per-file hash values"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1186" ;
    solveit-core:techniqueName "Compute per-file hash values" ;
    solveit-core:techniqueDescription "The process of computing one or more hash digests for each file in a set, producing per-file digests that can subsequently be used for matching, deduplication, or integrity comparison." ;
    solveit-core:techniqueDetails """This technique does vary based on the kind of digest produced: cryptographic-digest computation for exact matching, and fuzzy or similarity-digest computation for approximate matching. 

The output of this technique is typically consumed by hash-matching techniques including DFT-1047, DFT-1050, and DFT-1051. 

This technique is distinct from DFT-1042, which hashes the entire bitstream of a source device for acquisition integrity rather than individual files within the file system.""" ;
    solveit-core:hasSynonym "File hashing",
                            "Per-file hashing" ;
    solveit-core:hasExample "Autopsy hash lookup ingest module computing per-file hashes",
                            "md5sum / sha256sum applied recursively over a mounted forensic image" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass uco-observable:hash .

:techniqueDFT-1187
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1187: Extract content from compound files"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1187" ;
    solveit-core:techniqueName "Extract content from compound files" ;
    solveit-core:techniqueDescription "The process of extracting files and objects contained within compound files, including archives, Office documents, PDFs, and email containers, surfacing the contained items as first-class files for further analysis." ;
    solveit-core:techniqueDetails """'Compound file' is used here in the broad sense: any file format whose payload is one or more other files. 

This covers user-downloaded archives (.zip, .rar, .7z, .tar), images and objects embedded in Office documents (.docx / .xlsx / .pptx, and legacy .doc / .xls / .ppt that use the Microsoft Compound File Binary Format, attachments and embedded streams in PDFs, and attachments inside email containers. 

Extracting them surfaces each contained item as a first-class file so downstream techniques such as file-type identification, extension-mismatch detection, and hash matching can operate on the content. 

This is distinct from DFT-1045, which decodes archive containers produced by the forensic extraction pipeline (e.g. an iOS file-system extraction packaged as a TAR file); this technique is applied later in the workflow, against compound files encountered within user data. The technique should be applied recursively because extracted items may themselves be compound files.""" ;
    solveit-core:hasSynonym "Compound file expansion",
                            "Container file expansion",
                            "Embedded file extraction" ;
    solveit-core:hasExample "Autopsy Embedded File Extractor module" ;
    solveit-core:hasCASEInputClass uco-observable:File ;
    solveit-core:hasCASEOutputClass solveit-observable:FileSet .

:techniqueDFT-1190
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1190: Extract operating system version(s) from data source"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1190" ;
    solveit-core:techniqueName "Extract operating system version(s) from data source" ;
    solveit-core:techniqueDescription "The process of extracting and processing the artifacts that describe the current operating system version and associated version details e.g. build, service pack etc." ;
    solveit-core:techniqueDetails """Each operating system will have a specific artifact that allows this to be performed e.g. details from the Registry on Windows. 

It is also sometimes possible to determine older versions of the operating system which have been used, with timestamps, which may be useful for later functional reconstruction (DFT-1156)""" ;
    solveit-core:hasCASEInputClass solveit-observable:FileSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1324,
                                      :weaknessDFW-1325,
                                      :weaknessDFW-1326,
                                      :weaknessDFW-1327,
                                      :weaknessDFW-1328,
                                      :weaknessDFW-1329 ;
    solveit-core:hasReference :citationDFCite-1157 .

:techniqueDFT-1191
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1191: Parse allocated structures in Windows HIVE files"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1191" ;
    solveit-core:techniqueName "Parse allocated structures in Windows HIVE files" ;
    solveit-core:techniqueDescription "Enumerate the allocated structures within HIVE files (typically Windows Registry) to extract the tree structure along with keys and their values. " ;
    solveit-core:techniqueDetails "This focuses on the data structure enumeration only, rather than taking a specific key and performing analysis on the data contained within. It covers allocated keys and values only." ;
    solveit-core:hasSynonym "Registry analysis" ;
    solveit-core:hasCASEInputClass uco-observable:WindowsRegistryHive ;
    solveit-core:hasCASEOutputClass uco-observable:WindowsRegistryKey,
                                    uco-observable:WindowsRegistryValue ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1330,
                                      :weaknessDFW-1331,
                                      :weaknessDFW-1332,
                                      :weaknessDFW-1333,
                                      :weaknessDFW-1334,
                                      :weaknessDFW-1335,
                                      :weaknessDFW-1336,
                                      :weaknessDFW-1337 ;
    solveit-core:hasReference :citationDFCite-1158 .

:techniqueDFT-1192
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1192: Disable connectivity using device configuration settings"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1192" ;
    solveit-core:techniqueName "Disable connectivity using device configuration settings" ;
    solveit-core:techniqueDescription "This involves changing settings on a device to attempt to remove any connectivity options so that data cannot be sent or received over typical RF channels. This may involve multiple settings e.g. airplane mode and separate Bluetooth and WiFi toggles." ;
    solveit-core:hasExample "airplane mode",
                            "flight mode" ;
    solveit-core:hasCASEInputClass uco-observable:MobileDevice ;
    solveit-core:hasCASEOutputClass uco-observable:MobileDevice ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1340,
                                      :weaknessDFW-1341,
                                      :weaknessDFW-1342,
                                      :weaknessDFW-1343 .

:techniqueDFT-1193
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1193: Read metadata from within a forensic image container"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1193" ;
    solveit-core:techniqueName "Read metadata from within a forensic image container" ;
    solveit-core:techniqueDescription "The processes of reading the metadata values stored within forensic container formats" ;
    solveit-core:techniqueDetails "This has been differentiated from reading data from text files that accompany raw disk images, but includes metadata stored within logical formats. " ;
    solveit-core:hasExample "AFF4",
                            "EWF" ;
    solveit-core:hasCASEInputClass solveit-observable:LogicalImageContainer,
                                   solveit-observable:PhysicalImageContainer ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/types/Hash>,
                                    case-investigation:exhibitNumber,
                                    uco-core:description,
                                    uco-core:name,
                                    uco-observable:Note ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1344,
                                      :weaknessDFW-1345,
                                      :weaknessDFW-1346,
                                      :weaknessDFW-1347,
                                      :weaknessDFW-1348,
                                      :weaknessDFW-1349,
                                      :weaknessDFW-1350,
                                      :weaknessDFW-1351,
                                      :weaknessDFW-1352,
                                      :weaknessDFW-1353,
                                      :weaknessDFW-1354,
                                      :weaknessDFW-1355 .

:techniqueDFT-1194
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1194: Classify if audio is potentially synthetically generated"@en ;
    rdfs:subClassOf :techniqueDFT-1079 ;
    solveit-core:techniqueID "DFT-1194" ;
    solveit-core:techniqueName "Classify if audio is potentially synthetically generated" ;
    solveit-core:techniqueDescription "Classification of audio with respect to its origin, i.e., whether it is synthetically generated (e.g. text-to-speech synthesis or voice conversion) or naturally captured from a live speaker." ;
    solveit-core:techniqueDetails "Audio content is analyzed for traces of synthetic generation. Methods include neural anti-spoofing classifiers (e.g. spectro-temporal graph attention networks trained on spoofed/bona-fide speech corpora) and signal-level analyses such as higher-order spectral (bispectral) statistics. The output is typically a classifier-predicted score or confidence that the audio is synthetically generated, or extracted signal traces that aid the analyst in assessing the audio's origin. This completes the modality triad alongside the existing video (DFT-1106) and image (DFT-1176) synthetic-classification techniques." ;
    solveit-core:hasSynonym "Audio anti-spoofing",
                            "Audio deepfake detection",
                            "Speech spoofing countermeasure",
                            "Synthetic speech detection",
                            "Voice clone detection" ;
    solveit-core:hasExample "AASIST-family neural anti-spoofing classifiers",
                            "ASVspoof challenge countermeasure systems",
                            "Bispectral / higher-order spectral analysis of speech",
                            "Project VIC Media Authentication Analyzer (AASIST-L neural detector + bispectrum heuristic in production)" ;
    solveit-core:hasCASEInputClass solveit-observable:AudioFile ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification> .

:techniqueDFT-1195
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1195: Generate Alternative Hypotheses"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1195" ;
    solveit-core:techniqueName "Generate Alternative Hypotheses" ;
    solveit-core:techniqueDescription "The process of considering what are the alternative possibilities (other than the proposed hypothesis) for the digital forensic artifacts/traces that we are observing" ;
    solveit-core:techniqueDetails "Considering alternative hypotheses is fundamental to scientific practices, and assists in mitigating the potential influence of bias. In investigative mode, experts generate possible explanations. In evaluative mode for expert opinion in court proceedings, the expert focuses on disputed issues and evaluates their observations." ;
    solveit-core:hasSynonym "Claim",
                            "Proposition" ;
    solveit-core:hasCASEInputClass solveit-analysis:Hypothesis,
                                   uco-observable:Observable ;
    solveit-core:hasCASEOutputClass solveit-analysis:HypothesisSet ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1379,
                                      :weaknessDFW-1380,
                                      :weaknessDFW-1381,
                                      :weaknessDFW-1382,
                                      :weaknessDFW-1383,
                                      :weaknessDFW-1384,
                                      :weaknessDFW-1385,
                                      :weaknessDFW-1386 .

:techniqueDFT-1196
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1196: Extract operating system installation date"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1196" ;
    solveit-core:techniqueName "Extract operating system installation date" ;
    solveit-core:techniqueDescription "Extract the date and time recorded as the installation date of the operating system." ;
    solveit-core:hasCASEInputClass uco-observable:Observable ;
    solveit-core:hasCASEOutputClass uco-observable:installDate ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1387,
                                      :weaknessDFW-1388,
                                      :weaknessDFW-1389,
                                      :weaknessDFW-1390,
                                      :weaknessDFW-1391,
                                      :weaknessDFW-1392 ;
    solveit-core:hasReference :citationDFCite-1157 .

:techniqueDFT-1197
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1197: Determine mount point mappings within an operating system"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1197" ;
    solveit-core:techniqueName "Determine mount point mappings within an operating system" ;
    solveit-core:techniqueDescription "This involves establishing what mount points (including drive letters) within an operating system are mapped to, either a partition or device. " ;
    solveit-core:techniqueDetails """On Windows this will typically be mapping drive letters to specific partitions on local disks or removable media, DVD drives, or even mounted encrypted containers. 

The term 'mount point mapping' is used here to include drive letters on Windows and the use of folders as mount points on other operating systems.""" ;
    solveit-core:hasSynonym "drive letter mapping" ;
    solveit-core:hasCASEInputClass uco-observable:Observable ;
    solveit-core:hasCASEOutputClass solveit-analysis:HypothesisedRelationship,
                                    uco-observable:Device,
                                    uco-observable:DiskPartition,
                                    uco-observable:driveLetter,
                                    uco-observable:mountPoint ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1393,
                                      :weaknessDFW-1394,
                                      :weaknessDFW-1395,
                                      :weaknessDFW-1396 .

:techniqueDFT-1198
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1198: Compute hash of data read from source device"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1198" ;
    solveit-core:techniqueName "Compute hash of data read from source device" ;
    solveit-core:techniqueDescription "Process data accessed on a source device (e.g. attached disk or other media) and compute the cryptographic hash of the data" ;
    solveit-core:hasCASEInputClass solveit-observable:Bitstream ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/types/Hash> ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1397,
                                      :weaknessDFW-1398,
                                      :weaknessDFW-1399,
                                      :weaknessDFW-1400 .

:techniqueDFT-1199
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1199: Compute hash of stored bitstream data"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1199" ;
    solveit-core:techniqueName "Compute hash of stored bitstream data" ;
    solveit-core:techniqueDescription "Cryptographically hashing either data exposed directly from a raw image or a decompressed physical image from a container format." ;
    solveit-core:techniqueDetails "This is usually then compared with a hash stored internally in the disk image, or externally in a text file or another external source." ;
    solveit-core:hasCASEInputClass solveit-observable:BitstreamRandomAccessed ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/types/Hash> ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1401,
                                      :weaknessDFW-1402 .

:techniqueDFT-1200
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1200: Evaluate observations in light of hypotheses"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1200" ;
    solveit-core:techniqueName "Evaluate observations in light of hypotheses" ;
    solveit-core:techniqueDescription "The process of assessing the probability or strength of the observations under each of two or more competing hypotheses, and expressing the strength of support for one over another." ;
    solveit-core:techniqueDetails "In evaluative mode the hypotheses are fixed before evaluation begins and are taken as given, typically from DFT-1195; this technique does not formulate or revise them. The examiner assesses how probable or strong the observations are under each hypothesis in turn, assuming each to be true. Assigning a probability or strength to the observations under a hypothesis requires knowledge of how the system behaves under that hypothesis, drawn from DFT-1090 or from published data. The technique concludes with the strength of support expressed as a likelihood ratio, its verbal equivalent, or other method. Conveying that opinion is DFT-1093." ;
    solveit-core:hasSynonym "Evaluative interpretation",
                            "Evidence evaluation",
                            "Likelihood ratio assessment",
                            "Scientific interpretation" ;
    solveit-core:hasCASEInputClass solveit-analysis:HypothesisSet,
                                   uco-observable:Observable ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult> ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1403,
                                      :weaknessDFW-1404,
                                      :weaknessDFW-1405,
                                      :weaknessDFW-1406,
                                      :weaknessDFW-1407 ;
    solveit-core:hasReference :citationDFCite-1163,
                              :citationDFCite-1164,
                              :citationDFCite-1165 .

:techniqueDFT-1202
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1202: Verify automated results manually"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1202" ;
    solveit-core:techniqueName "Verify automated results manually" ;
    solveit-core:techniqueDescription "The process of manually reviewing the results from an automated process and checking the results are correct." ;
    solveit-core:hasSynonym "manual verification" ;
    solveit-core:hasExample "Checking that a recovered record exists",
                            "Checking the decoding of a timestamp" ;
    solveit-core:hasCASEInputClass <https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult>,
                                   uco-observable:ObservableObject ;
    solveit-core:hasCASEOutputClass <https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult> .

:techniqueDFT-1203
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1203: Use an AI-based prompt for interrogating case data"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1203" ;
    solveit-core:techniqueName "Use an AI-based prompt for interrogating case data" ;
    solveit-core:techniqueDescription "Using an AI-based chat interface to query the data within a case." ;
    solveit-core:techniqueDetails "Behind this interface this could include querying artefacts extracted into a database and/or running tools dynamically." ;
    solveit-core:hasCASEInputClass solveit-observable:ArtifactSet,
                                   solveit-observable:FileSet ;
    solveit-core:hasCASEOutputClass solveit-analysis:HypothesisedEvent,
                                    solveit-analysis:HypothesisedRelationship,
                                    solveit-observable:ArtifactSet,
                                    uco-core:Annotation ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1422,
                                      :weaknessDFW-1423,
                                      :weaknessDFW-1424,
                                      :weaknessDFW-1425,
                                      :weaknessDFW-1426,
                                      :weaknessDFW-1427,
                                      :weaknessDFW-1428,
                                      :weaknessDFW-1429,
                                      :weaknessDFW-1430,
                                      :weaknessDFW-1431,
                                      :weaknessDFW-1432,
                                      :weaknessDFW-1433,
                                      :weaknessDFW-1434,
                                      :weaknessDFW-1435,
                                      :weaknessDFW-1436,
                                      :weaknessDFW-1437,
                                      :weaknessDFW-1438,
                                      :weaknessDFW-1439,
                                      :weaknessDFW-1440,
                                      :weaknessDFW-1441,
                                      :weaknessDFW-1442,
                                      :weaknessDFW-1443,
                                      :weaknessDFW-1444,
                                      :weaknessDFW-1445,
                                      :weaknessDFW-1446,
                                      :weaknessDFW-1447,
                                      :weaknessDFW-1448,
                                      :weaknessDFW-1449,
                                      :weaknessDFW-1450,
                                      :weaknessDFW-1451,
                                      :weaknessDFW-1452,
                                      :weaknessDFW-1453,
                                      :weaknessDFW-1454,
                                      :weaknessDFW-1455 ;
    solveit-core:hasReference :citationDFCite-1169 .

:techniqueDFT-1204
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1204: Verify hash of stored bitstream data matches a stored hash"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1204" ;
    solveit-core:techniqueName "Verify hash of stored bitstream data matches a stored hash" ;
    solveit-core:techniqueDescription "Compares a hash computed over stored bitstream data against a recorded hash, to assess whether the stored data has changed since it was written." ;
    solveit-core:techniqueDetails """The stored hash may be held inside the forensic image container, in an associated text file, or in a separate trusted location. 

The same comparison applies in each case. The hash over the stored data is produced by DFT-1199 (Compute hash of stored bitstream data), and a hash held inside a container is read using DFT-1193 (Read metadata from within a forensic image container). 

This technique covers verification carried out after imaging has finished, whereas DFT-1042 (Verify hash of copied data matches the hash of the data read from source device) covers the comparison made *during imaging* against a hash of data read from the source device.""" ;
    solveit-core:hasExample "ewfverify" ;
    solveit-core:hasCASEInputClass <https://ontology.unifiedcyberontology.org/uco/types/Hash> ;
    solveit-core:hasCASEOutputClass solveit-observable:HashVerificationResult ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1042,
                                      :weaknessDFW-1127,
                                      :weaknessDFW-1128 ;
    solveit-core:hasReference :citationDFCite-1168 .

:techniqueDFT-1205
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1205: Decode raw data into data value(s)"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1205" ;
    solveit-core:techniqueName "Decode raw data into data value(s)" ;
    solveit-core:techniqueDescription "The process of interpreting a sequence of bytes as a typed value, such as a number, a string, or a date, under an assumed encoding." ;
    solveit-core:techniqueDetails """Decoding is performed inside many other techniques rather than as a separate examination step, which is why its failures are currently recorded against whichever technique consumed the value. This provides a generic version of the technique. 

Related techniques that depend on it include DFT-1191 (Parse allocated structures in Windows HIVE files), DFT-1071 (Extract data from SQLite database(s)) and DFT-1121 (Index a data source for keyword searching). DFT-1044 and DFT-1102 decode specific container formats rather than typed values. """ ;
    solveit-core:hasCASEInputClass uco-observable:ContentData ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1456 .

:techniqueDFT-1206
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1206: Decode a number from raw data"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1206" ;
    solveit-core:techniqueName "Decode a number from raw data" ;
    solveit-core:techniqueDescription "The process of interpreting a sequence of bytes as a numeric value under an assumed width, signedness, and byte order." ;
    solveit-core:techniqueDetails """Numeric decoding underlies most structured parsing, for example DFT-1191 (Parse allocated structures in Windows HIVE files), where values such as REG_DWORD and REG_QWORD are stored as raw integers. 

This technique groups numbers together to include signed and unsigned, integers and floats, different endianness, and number of bytes considered in the decoding.

Note that strings and timestamps are considered in separate techniques. 
""" ;
    solveit-core:hasCASEInputClass uco-observable:ContentData ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1457,
                                      :weaknessDFW-1458,
                                      :weaknessDFW-1459,
                                      :weaknessDFW-1460,
                                      :weaknessDFW-1461,
                                      :weaknessDFW-1462,
                                      :weaknessDFW-1463,
                                      :weaknessDFW-1464,
                                      :weaknessDFW-1465 .

:techniqueDFT-1208
    a owl:Class,
      solveit-core:Technique ;
    rdfs:label "DFT-1208: Store acquisition metadata along with a forensic image format"@en ;
    rdfs:subClassOf solveit-core:SolveitInvestigativeAction ;
    solveit-core:techniqueID "DFT-1208" ;
    solveit-core:techniqueName "Store acquisition metadata along with a forensic image format" ;
    solveit-core:techniqueDescription "Records details such as case and examiner details, and the acquisition hash, with a forensic image container alongside the bitstream data or logical files. " ;
    solveit-core:techniqueDetails """This is the counterpart of DFT-1193, which reads these same values back. 

Container formats such as EWF and AFF4 carry a case number, evidence number, examiner name, notes and description, together with the cryptographic hash computed during acquisition. 

DFT-1025 stores the bitstream itself, whereas this technique records the metadata that accompanies it. The hash written here is the value later verified against by DFT-1204. 

Metadata accompanying a raw image is held in a separate file rather than within a container, and is not covered by this technique.""" ;
    solveit-core:hasExample "ewfacquire" ;
    solveit-core:hasCASEInputClass <https://ontology.unifiedcyberontology.org/uco/types/Hash>,
                                   case-investigation:exhibitNumber,
                                   solveit-observable:LogicalImageContainer,
                                   solveit-observable:PhysicalImageContainer,
                                   uco-core:description,
                                   uco-core:name,
                                   uco-observable:Note ;
    solveit-core:hasCASEOutputClass solveit-observable:LogicalImageContainer,
                                    solveit-observable:PhysicalImageContainer ;
    solveit-core:hasPotentialWeakness :weaknessDFW-1473,
                                      :weaknessDFW-1474,
                                      :weaknessDFW-1475,
                                      :weaknessDFW-1476,
                                      :weaknessDFW-1477,
                                      :weaknessDFW-1478 .

#################################################################
#    Weaknesses (441)
#
#    Potential problems arising from a technique, classified against the
#    ASTM E3016-18 error categories.
#################################################################

:weaknessDFW-1001
    a solveit-core:Weakness ;
    rdfs:label "DFW-1001: Excluding a device during triage that contains relevant information"@en ;
    solveit-core:weaknessID "DFW-1001" ;
    solveit-core:weaknessName "Excluding a device during triage that contains relevant information" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1002
    a solveit-core:Weakness ;
    rdfs:label "DFW-1002: Use of triage technology results in changes to the target media"@en ;
    solveit-core:weaknessID "DFW-1002" ;
    solveit-core:weaknessName "Use of triage technology results in changes to the target media" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1007,
                                        :mitigationDFM-1008 .

:weaknessDFW-1003
    a solveit-core:Weakness ;
    rdfs:label "DFW-1003: Triage tool applies a simplification that does not correctly represent the meaning of the digital data"@en ;
    solveit-core:weaknessID "DFW-1003" ;
    solveit-core:weaknessName "Triage tool applies a simplification that does not correctly represent the meaning of the digital data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1001 .

:weaknessDFW-1004
    a solveit-core:Weakness ;
    rdfs:label "DFW-1004: Data copied does not include all sectors from LBA0 to LBA max due to the data copying process stopping prematurely"@en ;
    solveit-core:weaknessID "DFW-1004" ;
    solveit-core:weaknessName "Data copied does not include all sectors from LBA0 to LBA max due to the data copying process stopping prematurely" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1003,
                                        :mitigationDFM-1004,
                                        :mitigationDFM-1331 .

:weaknessDFW-1005
    a solveit-core:Weakness ;
    rdfs:label "DFW-1005: Dogs fail to find a digital device"@en ;
    solveit-core:weaknessID "DFW-1005" ;
    solveit-core:weaknessName "Dogs fail to find a digital device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1006
    a solveit-core:Weakness ;
    rdfs:label "DFW-1006: Acquisition tool does not copy data from HPA"@en ;
    solveit-core:weaknessID "DFW-1006" ;
    solveit-core:weaknessName "Acquisition tool does not copy data from HPA" ;
    solveit-core:weaknessDescription "Some forensic acquisition tools do not detect or acquire data stored within the HPA (Host Protected Area), resulting in an incomplete forensic image that omits potentially evidential data. This weakness arises because accessing the HPA typically requires issuing specific ATA commands (such as SET MAX ADDRESS) to temporarily remove the protection before imaging, a capability not universally implemented across acquisition tools (Gupta, Hoeschele and Rogers, 2006)." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1003,
                                        :mitigationDFM-1005 ;
    solveit-core:hasReference :citationDFCite-1052 .

:weaknessDFW-1007
    a solveit-core:Weakness ;
    rdfs:label "DFW-1007: Acquisition tool does not copy data from DCO"@en ;
    solveit-core:weaknessID "DFW-1007" ;
    solveit-core:weaknessName "Acquisition tool does not copy data from DCO" ;
    solveit-core:weaknessDescription "The Device Configuration Overlay (DCO) is a feature of the ATA standard that allows hardware vendors or system manufacturers to permanently hide a portion of a hard disk drive's capacity from the host system, including the operating system and forensic acquisition tools. Unlike the HPA, the DCO operates at a lower level and persists across power cycles, meaning that without issuing specific ATA commands (such as DEVICE CONFIGURATION RESTORE) the hidden area remains inaccessible. Acquisition tools that do not detect or interact with the DCO will produce an incomplete forensic image, potentially missing evidential data stored in this region (Gupta, Hoeschele and Rogers, 2006)." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1003,
                                        :mitigationDFM-1006 ;
    solveit-core:hasReference :citationDFCite-1052 .

:weaknessDFW-1008
    a solveit-core:Weakness ;
    rdfs:label "DFW-1008: Missing the existence of a device by missing synchronisation artefacts"@en ;
    solveit-core:weaknessID "DFW-1008" ;
    solveit-core:weaknessName "Missing the existence of a device by missing synchronisation artefacts" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1057,
                                        :mitigationDFM-1059 .

:weaknessDFW-1009
    a solveit-core:Weakness ;
    rdfs:label "DFW-1009: Missing the existence of a device by incorrectly parsing synchronisation artefacts"@en ;
    solveit-core:weaknessID "DFW-1009" ;
    solveit-core:weaknessName "Missing the existence of a device by incorrectly parsing synchronisation artefacts" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1057 .

:weaknessDFW-1010
    a solveit-core:Weakness ;
    rdfs:label "DFW-1010: Misattributing activity to the wrong device"@en ;
    solveit-core:weaknessID "DFW-1010" ;
    solveit-core:weaknessName "Misattributing activity to the wrong device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1058 .

:weaknessDFW-1011
    a solveit-core:Weakness ;
    rdfs:label "DFW-1011: Suggesting the existence of a device that does not exist"@en ;
    solveit-core:weaknessID "DFW-1011" ;
    solveit-core:weaknessName "Suggesting the existence of a device that does not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1058 .

:weaknessDFW-1012
    a solveit-core:Weakness ;
    rdfs:label "DFW-1012: Interaction with the target devices to read data causes changes"@en ;
    solveit-core:weaknessID "DFW-1012" ;
    solveit-core:weaknessName "Interaction with the target devices to read data causes changes" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1007,
                                        :mitigationDFM-1008 .

:weaknessDFW-1013
    a solveit-core:Weakness ;
    rdfs:label "DFW-1013: During acquisition the data copying process results in extra bytes"@en ;
    solveit-core:weaknessID "DFW-1013" ;
    solveit-core:weaknessName "During acquisition the data copying process results in extra bytes" ;
    solveit-core:weaknessDescription "These " ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1003,
                                        :mitigationDFM-1004 .

:weaknessDFW-1014
    a solveit-core:Weakness ;
    rdfs:label "DFW-1014: Accessing the drive to copy data changes original data"@en ;
    solveit-core:weaknessID "DFW-1014" ;
    solveit-core:weaknessName "Accessing the drive to copy data changes original data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1007,
                                        :mitigationDFM-1008 .

:weaknessDFW-1015
    a solveit-core:Weakness ;
    rdfs:label "DFW-1015: Powering on SSD results in sectors being wiped by TRIM operation"@en ;
    solveit-core:weaknessID "DFW-1015" ;
    solveit-core:weaknessName "Powering on SSD results in sectors being wiped by TRIM operation" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_COR,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasReference :citationDFCite-1036 .

:weaknessDFW-1016
    a solveit-core:Weakness ;
    rdfs:label "DFW-1016: Data copied from sectors on source device are not transferred correctly for storage"@en ;
    solveit-core:weaknessID "DFW-1016" ;
    solveit-core:weaknessName "Data copied from sectors on source device are not transferred correctly for storage" ;
    solveit-core:weaknessDescription "This describes some data transformation that happens inside the imaging tool that results in a mismatch between the source and destination data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1004,
                                        :mitigationDFM-1331 .

:weaknessDFW-1017
    a solveit-core:Weakness ;
    rdfs:label "DFW-1017: Files or data that is relevant to the investigation is missed"@en ;
    solveit-core:weaknessID "DFW-1017" ;
    solveit-core:weaknessName "Files or data that is relevant to the investigation is missed" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1018
    a solveit-core:Weakness ;
    rdfs:label "DFW-1018: Data is collected that is not relevant to the investigation"@en ;
    solveit-core:weaknessID "DFW-1018" ;
    solveit-core:weaknessName "Data is collected that is not relevant to the investigation" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS .

:weaknessDFW-1019
    a solveit-core:Weakness ;
    rdfs:label "DFW-1019: Data is collected and assigned to incorrect device"@en ;
    solveit-core:weaknessID "DFW-1019" ;
    solveit-core:weaknessName "Data is collected and assigned to incorrect device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS .

:weaknessDFW-1020
    a solveit-core:Weakness ;
    rdfs:label "DFW-1020: Content of data collected is incorrect"@en ;
    solveit-core:weaknessID "DFW-1020" ;
    solveit-core:weaknessName "Content of data collected is incorrect" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT .

:weaknessDFW-1021
    a solveit-core:Weakness ;
    rdfs:label "DFW-1021: Metadata of data collected is missing"@en ;
    solveit-core:weaknessID "DFW-1021" ;
    solveit-core:weaknessName "Metadata of data collected is missing" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1022
    a solveit-core:Weakness ;
    rdfs:label "DFW-1022: Metadata of data collected is incorrect"@en ;
    solveit-core:weaknessID "DFW-1022" ;
    solveit-core:weaknessName "Metadata of data collected is incorrect" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT .

:weaknessDFW-1023
    a solveit-core:Weakness ;
    rdfs:label "DFW-1023: Collection process changes content of data on target"@en ;
    solveit-core:weaknessID "DFW-1023" ;
    solveit-core:weaknessName "Collection process changes content of data on target" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1007,
                                        :mitigationDFM-1008 .

:weaknessDFW-1024
    a solveit-core:Weakness ;
    rdfs:label "DFW-1024: Collection process changes metadata of data on target"@en ;
    solveit-core:weaknessID "DFW-1024" ;
    solveit-core:weaknessName "Collection process changes metadata of data on target" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_COR .

:weaknessDFW-1025
    a solveit-core:Weakness ;
    rdfs:label "DFW-1025: Data relevant to the case is excluded as part of the filtering process"@en ;
    solveit-core:weaknessID "DFW-1025" ;
    solveit-core:weaknessName "Data relevant to the case is excluded as part of the filtering process" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1010,
                                        :mitigationDFM-1011 .

:weaknessDFW-1026
    a solveit-core:Weakness ;
    rdfs:label "DFW-1026: Selective extraction of a backup implies partial collection when it is in reality a full collection followed by deletion."@en ;
    solveit-core:weaknessID "DFW-1026" ;
    solveit-core:weaknessName "Selective extraction of a backup implies partial collection when it is in reality a full collection followed by deletion." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1012 .

:weaknessDFW-1027
    a solveit-core:Weakness ;
    rdfs:label "DFW-1027: Including data that was meant to be excluded with the selected filters"@en ;
    solveit-core:weaknessID "DFW-1027" ;
    solveit-core:weaknessName "Including data that was meant to be excluded with the selected filters" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS .

:weaknessDFW-1028
    a solveit-core:Weakness ;
    rdfs:label "DFW-1028: Due to the use of time based filters data extracted may be presented out of context"@en ;
    solveit-core:weaknessID "DFW-1028" ;
    solveit-core:weaknessName "Due to the use of time based filters data extracted may be presented out of context" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1010,
                                        :mitigationDFM-1011 .

:weaknessDFW-1029
    a solveit-core:Weakness ;
    rdfs:label "DFW-1029: Memory smearing may result in pointers being inconsistent within the memory image"@en ;
    solveit-core:weaknessID "DFW-1029" ;
    solveit-core:weaknessName "Memory smearing may result in pointers being inconsistent within the memory image" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1086,
                                        :mitigationDFM-1088 ;
    solveit-core:hasReference :citationDFCite-1072,
                              :citationDFCite-1110,
                              :citationDFCite-1111,
                              :citationDFCite-1116 .

:weaknessDFW-1030
    a solveit-core:Weakness ;
    rdfs:label "DFW-1030: Loading a memory imaging tool makes changes to the data in memory that is being acquired"@en ;
    solveit-core:weaknessID "DFW-1030" ;
    solveit-core:weaknessName "Loading a memory imaging tool makes changes to the data in memory that is being acquired" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1087 ;
    solveit-core:hasReference :citationDFCite-1023,
                              :citationDFCite-1051,
                              :citationDFCite-1128 .

:weaknessDFW-1031
    a solveit-core:Weakness ;
    rdfs:label "DFW-1031: Loading a memory imaging tool overwrites relevant data within memory"@en ;
    solveit-core:weaknessID "DFW-1031" ;
    solveit-core:weaknessName "Loading a memory imaging tool overwrites relevant data within memory" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1032
    a solveit-core:Weakness ;
    rdfs:label "DFW-1032: Not all memory is acquired"@en ;
    solveit-core:weaknessID "DFW-1032" ;
    solveit-core:weaknessName "Not all memory is acquired" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasReference :citationDFCite-1128 .

:weaknessDFW-1033
    a solveit-core:Weakness ;
    rdfs:label "DFW-1033: Data referenced in memory is located within pagefile or swapfile but is not collected"@en ;
    solveit-core:weaknessID "DFW-1033" ;
    solveit-core:weaknessName "Data referenced in memory is located within pagefile or swapfile but is not collected" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1240 ;
    solveit-core:hasReference :citationDFCite-1025 .

:weaknessDFW-1034
    a solveit-core:Weakness ;
    rdfs:label "DFW-1034: Missing data from the running system due to the device being compromised (e.g. rootkit)"@en ;
    solveit-core:weaknessID "DFW-1034" ;
    solveit-core:weaknessName "Missing data from the running system due to the device being compromised (e.g. rootkit)" ;
    solveit-core:weaknessDescription "Malicious software on a device may limit the data reported via queries made to a running device." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1013 .

:weaknessDFW-1035
    a solveit-core:Weakness ;
    rdfs:label "DFW-1035: Collecting incorrect data from a running system due to the device being compromised (e.g. rootkit)"@en ;
    solveit-core:weaknessID "DFW-1035" ;
    solveit-core:weaknessName "Collecting incorrect data from a running system due to the device being compromised (e.g. rootkit)" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_COR,
                                  solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1013 .

:weaknessDFW-1036
    a solveit-core:Weakness ;
    rdfs:label "DFW-1036: Overwriting relevant data with changes caused by running the live tools"@en ;
    solveit-core:weaknessID "DFW-1036" ;
    solveit-core:weaknessName "Overwriting relevant data with changes caused by running the live tools" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1014,
                                        :mitigationDFM-1015 ;
    solveit-core:hasReference :citationDFCite-1062 .

:weaknessDFW-1037
    a solveit-core:Weakness ;
    rdfs:label "DFW-1037: Presenting data from a mobile backup as complete, when it is in reality a partial set of files from the device"@en ;
    solveit-core:weaknessID "DFW-1037" ;
    solveit-core:weaknessName "Presenting data from a mobile backup as complete, when it is in reality a partial set of files from the device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1016,
                                        :mitigationDFM-1020 .

:weaknessDFW-1038
    a solveit-core:Weakness ;
    rdfs:label "DFW-1038: Backup process returns an incomplete set of backup data"@en ;
    solveit-core:weaknessID "DFW-1038" ;
    solveit-core:weaknessName "Backup process returns an incomplete set of backup data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1039
    a solveit-core:Weakness ;
    rdfs:label "DFW-1039: Backup data collection overwrites important data"@en ;
    solveit-core:weaknessID "DFW-1039" ;
    solveit-core:weaknessName "Backup data collection overwrites important data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP .

:weaknessDFW-1040
    a solveit-core:Weakness ;
    rdfs:label "DFW-1040: Not considering SD Card acquisition in addition to other extractions performed"@en ;
    solveit-core:weaknessID "DFW-1040" ;
    solveit-core:weaknessName "Not considering SD Card acquisition in addition to other extractions performed" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1017,
                                        :mitigationDFM-1018 .

:weaknessDFW-1041
    a solveit-core:Weakness ;
    rdfs:label "DFW-1041: Not considering file system acquisition as alternative"@en ;
    solveit-core:weaknessID "DFW-1041" ;
    solveit-core:weaknessName "Not considering file system acquisition as alternative" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1019 .

:weaknessDFW-1042
    a solveit-core:Weakness ;
    rdfs:label "DFW-1042: Disk image was tampered with, but manipulated to have a collision with original hash"@en ;
    solveit-core:weaknessID "DFW-1042" ;
    solveit-core:weaknessName "Disk image was tampered with, but manipulated to have a collision with original hash" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1021,
                                        :mitigationDFM-1022,
                                        :mitigationDFM-1023,
                                        :mitigationDFM-1070 .

:weaknessDFW-1043
    a solveit-core:Weakness ;
    rdfs:label "DFW-1043: Data is written to forensic format that does not preserve the original raw data"@en ;
    solveit-core:weaknessID "DFW-1043" ;
    solveit-core:weaknessName "Data is written to forensic format that does not preserve the original raw data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1009 .

:weaknessDFW-1044
    a solveit-core:Weakness ;
    rdfs:label "DFW-1044: Failing to extract a decryption key that is present"@en ;
    solveit-core:weaknessID "DFW-1044" ;
    solveit-core:weaknessName "Failing to extract a decryption key that is present" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1025 .

:weaknessDFW-1045
    a solveit-core:Weakness ;
    rdfs:label "DFW-1045: Extracting an incorrect decryption key"@en ;
    solveit-core:weaknessID "DFW-1045" ;
    solveit-core:weaknessName "Extracting an incorrect decryption key" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1024 .

:weaknessDFW-1046
    a solveit-core:Weakness ;
    rdfs:label "DFW-1046: File not recovered from the stored backup"@en ;
    solveit-core:weaknessID "DFW-1046" ;
    solveit-core:weaknessName "File not recovered from the stored backup" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1026,
                                        :mitigationDFM-1027 .

:weaknessDFW-1047
    a solveit-core:Weakness ;
    rdfs:label "DFW-1047: File recovered from backup that did not exist"@en ;
    solveit-core:weaknessID "DFW-1047" ;
    solveit-core:weaknessName "File recovered from backup that did not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1026,
                                        :mitigationDFM-1027 .

:weaknessDFW-1048
    a solveit-core:Weakness ;
    rdfs:label "DFW-1048: File recovered from backup but presented in the wrong location"@en ;
    solveit-core:weaknessID "DFW-1048" ;
    solveit-core:weaknessName "File recovered from backup but presented in the wrong location" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1026,
                                        :mitigationDFM-1027 .

:weaknessDFW-1049
    a solveit-core:Weakness ;
    rdfs:label "DFW-1049: File content recovered incorrectly from backup"@en ;
    solveit-core:weaknessID "DFW-1049" ;
    solveit-core:weaknessName "File content recovered incorrectly from backup" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1026,
                                        :mitigationDFM-1027 .

:weaknessDFW-1050
    a solveit-core:Weakness ;
    rdfs:label "DFW-1050: Failure to highlight that there are other apps present for which data is not available"@en ;
    solveit-core:weaknessID "DFW-1050" ;
    solveit-core:weaknessName "Failure to highlight that there are other apps present for which data is not available" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1028 .

:weaknessDFW-1051
    a solveit-core:Weakness ;
    rdfs:label "DFW-1051: Failure to highlight that not all app data may be present in a backup"@en ;
    solveit-core:weaknessID "DFW-1051" ;
    solveit-core:weaknessName "Failure to highlight that not all app data may be present in a backup" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1028 .

:weaknessDFW-1052
    a solveit-core:Weakness ;
    rdfs:label "DFW-1052: Incorrect retrieval of results from an index"@en ;
    solveit-core:weaknessID "DFW-1052" ;
    solveit-core:weaknessName "Incorrect retrieval of results from an index" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1030,
                                        :mitigationDFM-1034 .

:weaknessDFW-1053
    a solveit-core:Weakness ;
    rdfs:label "DFW-1053: Incorrect parsing of a supplied regular expression used for keyword searching"@en ;
    solveit-core:weaknessID "DFW-1053" ;
    solveit-core:weaknessName "Incorrect parsing of a supplied regular expression used for keyword searching" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1035,
                                        :mitigationDFM-1036 .

:weaknessDFW-1054
    a solveit-core:Weakness ;
    rdfs:label "DFW-1054: Data not indexed for keyword searching due to text encoding"@en ;
    solveit-core:weaknessID "DFW-1054" ;
    solveit-core:weaknessName "Data not indexed for keyword searching due to text encoding" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1029,
                                        :mitigationDFM-1034,
                                        :mitigationDFM-1146 .

:weaknessDFW-1055
    a solveit-core:Weakness ;
    rdfs:label "DFW-1055: Data not indexed for keyword searching due to missing substring feature"@en ;
    solveit-core:weaknessID "DFW-1055" ;
    solveit-core:weaknessName "Data not indexed for keyword searching due to missing substring feature" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1029,
                                        :mitigationDFM-1034,
                                        :mitigationDFM-1147 .

:weaknessDFW-1056
    a solveit-core:Weakness ;
    rdfs:label "DFW-1056: Data not indexed for keyword searching due to case sensitivity problem"@en ;
    solveit-core:weaknessID "DFW-1056" ;
    solveit-core:weaknessName "Data not indexed for keyword searching due to case sensitivity problem" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1029,
                                        :mitigationDFM-1034,
                                        :mitigationDFM-1148 .

:weaknessDFW-1057
    a solveit-core:Weakness ;
    rdfs:label "DFW-1057: Relevant keyword results not captured by the case-type keyword list used"@en ;
    solveit-core:weaknessID "DFW-1057" ;
    solveit-core:weaknessName "Relevant keyword results not captured by the case-type keyword list used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1031,
                                        :mitigationDFM-1032 .

:weaknessDFW-1058
    a solveit-core:Weakness ;
    rdfs:label "DFW-1058: Results appear in an ‘artefact’ or ‘result’ but the context, source or provenance of result is unclear"@en ;
    solveit-core:weaknessID "DFW-1058" ;
    solveit-core:weaknessName "Results appear in an ‘artefact’ or ‘result’ but the context, source or provenance of result is unclear" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1037 .

:weaknessDFW-1059
    a solveit-core:Weakness ;
    rdfs:label "DFW-1059: Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical"@en ;
    solveit-core:weaknessID "DFW-1059" ;
    solveit-core:weaknessName "Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1032,
                                        :mitigationDFM-1033,
                                        :mitigationDFM-1038 .

:weaknessDFW-1060
    a solveit-core:Weakness ;
    rdfs:label "DFW-1060: A relevant piece of media was not flagged as relevant"@en ;
    solveit-core:weaknessID "DFW-1060" ;
    solveit-core:weaknessName "A relevant piece of media was not flagged as relevant" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1039,
                                        :mitigationDFM-1040,
                                        :mitigationDFM-1041 .

:weaknessDFW-1061
    a solveit-core:Weakness ;
    rdfs:label "DFW-1061: An irrelevant piece of media was flagged as relevant"@en ;
    solveit-core:weaknessID "DFW-1061" ;
    solveit-core:weaknessName "An irrelevant piece of media was flagged as relevant" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1039,
                                        :mitigationDFM-1040,
                                        :mitigationDFM-1041,
                                        :mitigationDFM-1042 .

:weaknessDFW-1062
    a solveit-core:Weakness ;
    rdfs:label "DFW-1062: The grade or specific tag given to item is incorrect"@en ;
    solveit-core:weaknessID "DFW-1062" ;
    solveit-core:weaknessName "The grade or specific tag given to item is incorrect" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1039,
                                        :mitigationDFM-1040,
                                        :mitigationDFM-1041,
                                        :mitigationDFM-1042 .

:weaknessDFW-1063
    a solveit-core:Weakness ;
    rdfs:label "DFW-1063: Incorrectly parsing the partitions table(s)"@en ;
    solveit-core:weaknessID "DFW-1063" ;
    solveit-core:weaknessName "Incorrectly parsing the partitions table(s)" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1047,
                                        :mitigationDFM-1050 .

:weaknessDFW-1064
    a solveit-core:Weakness ;
    rdfs:label "DFW-1064: Making incorrect assumptions about sector size e.g. 512 rather than 4096"@en ;
    solveit-core:weaknessID "DFW-1064" ;
    solveit-core:weaknessName "Making incorrect assumptions about sector size e.g. 512 rather than 4096" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1045,
                                        :mitigationDFM-1046 ;
    solveit-core:hasReference :citationDFCite-1126 .

:weaknessDFW-1065
    a solveit-core:Weakness ;
    rdfs:label "DFW-1065: Failing to correctly parse start sector pointers from partition tables"@en ;
    solveit-core:weaknessID "DFW-1065" ;
    solveit-core:weaknessName "Failing to correctly parse start sector pointers from partition tables" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1047 .

:weaknessDFW-1066
    a solveit-core:Weakness ;
    rdfs:label "DFW-1066: Missing deleted but recoverable partitions from unpartitioned space"@en ;
    solveit-core:weaknessID "DFW-1066" ;
    solveit-core:weaknessName "Missing deleted but recoverable partitions from unpartitioned space" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1043,
                                        :mitigationDFM-1044 ;
    solveit-core:hasReference :citationDFCite-1060,
                              :citationDFCite-1061 .

:weaknessDFW-1067
    a solveit-core:Weakness ;
    rdfs:label "DFW-1067: Failure to check the integrity of partition table (where possible e.g. GPT)"@en ;
    solveit-core:weaknessID "DFW-1067" ;
    solveit-core:weaknessName "Failure to check the integrity of partition table (where possible e.g. GPT)" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1048,
                                        :mitigationDFM-1049 .

:weaknessDFW-1068
    a solveit-core:Weakness ;
    rdfs:label "DFW-1068: Failing to identify the existence of an allocated file"@en ;
    solveit-core:weaknessID "DFW-1068" ;
    solveit-core:weaknessName "Failing to identify the existence of an allocated file" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1069
    a solveit-core:Weakness ;
    rdfs:label "DFW-1069: Failing to identify the existence of an allocated directory"@en ;
    solveit-core:weaknessID "DFW-1069" ;
    solveit-core:weaknessName "Failing to identify the existence of an allocated directory" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1070
    a solveit-core:Weakness ;
    rdfs:label "DFW-1070: Failing to recover the complete contents of an allocated file"@en ;
    solveit-core:weaknessID "DFW-1070" ;
    solveit-core:weaknessName "Failing to recover the complete contents of an allocated file" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1071
    a solveit-core:Weakness ;
    rdfs:label "DFW-1071: Failing to recover a complete listing of an allocated directory"@en ;
    solveit-core:weaknessID "DFW-1071" ;
    solveit-core:weaknessName "Failing to recover a complete listing of an allocated directory" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1072
    a solveit-core:Weakness ;
    rdfs:label "DFW-1072: Recovering incorrect contents of an allocated file"@en ;
    solveit-core:weaknessID "DFW-1072" ;
    solveit-core:weaknessName "Recovering incorrect contents of an allocated file" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1073
    a solveit-core:Weakness ;
    rdfs:label "DFW-1073: Recovering an incorrect listing of an allocated directory"@en ;
    solveit-core:weaknessID "DFW-1073" ;
    solveit-core:weaknessName "Recovering an incorrect listing of an allocated directory" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1074
    a solveit-core:Weakness ;
    rdfs:label "DFW-1074: Attributing a file to the wrong directory"@en ;
    solveit-core:weaknessID "DFW-1074" ;
    solveit-core:weaknessName "Attributing a file to the wrong directory" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1075
    a solveit-core:Weakness ;
    rdfs:label "DFW-1075: Presenting a file that does not exist"@en ;
    solveit-core:weaknessID "DFW-1075" ;
    solveit-core:weaknessName "Presenting a file that does not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1076
    a solveit-core:Weakness ;
    rdfs:label "DFW-1076: Presenting a directory that does not exist"@en ;
    solveit-core:weaknessID "DFW-1076" ;
    solveit-core:weaknessName "Presenting a directory that does not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1077
    a solveit-core:Weakness ;
    rdfs:label "DFW-1077: Presenting a non-allocated file as an allocated file"@en ;
    solveit-core:weaknessID "DFW-1077" ;
    solveit-core:weaknessName "Presenting a non-allocated file as an allocated file" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1078
    a solveit-core:Weakness ;
    rdfs:label "DFW-1078: Presenting an allocated file as non-allocated"@en ;
    solveit-core:weaknessID "DFW-1078" ;
    solveit-core:weaknessName "Presenting an allocated file as non-allocated" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1079
    a solveit-core:Weakness ;
    rdfs:label "DFW-1079: Recovering incorrect metadata about a file"@en ;
    solveit-core:weaknessID "DFW-1079" ;
    solveit-core:weaknessName "Recovering incorrect metadata about a file" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1080
    a solveit-core:Weakness ;
    rdfs:label "DFW-1080: Recovering incorrect metadata about a directory"@en ;
    solveit-core:weaknessID "DFW-1080" ;
    solveit-core:weaknessName "Recovering incorrect metadata about a directory" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1081
    a solveit-core:Weakness ;
    rdfs:label "DFW-1081: Failing to recover file system metadata"@en ;
    solveit-core:weaknessID "DFW-1081" ;
    solveit-core:weaknessName "Failing to recover file system metadata" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1082
    a solveit-core:Weakness ;
    rdfs:label "DFW-1082: Recovering file system metadata incorrectly"@en ;
    solveit-core:weaknessID "DFW-1082" ;
    solveit-core:weaknessName "Recovering file system metadata incorrectly" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1083
    a solveit-core:Weakness ;
    rdfs:label "DFW-1083: Failure to recover additional specialised file system specific content e.g. Alternate Data Streams"@en ;
    solveit-core:weaknessID "DFW-1083" ;
    solveit-core:weaknessName "Failure to recover additional specialised file system specific content e.g. Alternate Data Streams" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1084
    a solveit-core:Weakness ;
    rdfs:label "DFW-1084: Failure to correctly recover specialised file system specific content e.g. Alternate Data Streams"@en ;
    solveit-core:weaknessID "DFW-1084" ;
    solveit-core:weaknessName "Failure to correctly recover specialised file system specific content e.g. Alternate Data Streams" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1051,
                                        :mitigationDFM-1052,
                                        :mitigationDFM-1053 .

:weaknessDFW-1085
    a solveit-core:Weakness ;
    rdfs:label "DFW-1085: Missing messages from the live set of messages"@en ;
    solveit-core:weaknessID "DFW-1085" ;
    solveit-core:weaknessName "Missing messages from the live set of messages" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1054,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1056 ;
    solveit-core:hasReference :citationDFCite-1105 .

:weaknessDFW-1086
    a solveit-core:Weakness ;
    rdfs:label "DFW-1086: Failing to recover deleted but recoverable messages"@en ;
    solveit-core:weaknessID "DFW-1086" ;
    solveit-core:weaknessName "Failing to recover deleted but recoverable messages" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1054,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1056,
                                        :mitigationDFM-1077 .

:weaknessDFW-1087
    a solveit-core:Weakness ;
    rdfs:label "DFW-1087: Presenting a live message that did not exist"@en ;
    solveit-core:weaknessID "DFW-1087" ;
    solveit-core:weaknessName "Presenting a live message that did not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054 .

:weaknessDFW-1088
    a solveit-core:Weakness ;
    rdfs:label "DFW-1088: Presenting a deleted message that did not exist"@en ;
    solveit-core:weaknessID "DFW-1088" ;
    solveit-core:weaknessName "Presenting a deleted message that did not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054 .

:weaknessDFW-1089
    a solveit-core:Weakness ;
    rdfs:label "DFW-1089: Recovering a live message with incorrect content"@en ;
    solveit-core:weaknessID "DFW-1089" ;
    solveit-core:weaknessName "Recovering a live message with incorrect content" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1056 .

:weaknessDFW-1090
    a solveit-core:Weakness ;
    rdfs:label "DFW-1090: Recovering a live message with incorrect metadata"@en ;
    solveit-core:weaknessID "DFW-1090" ;
    solveit-core:weaknessName "Recovering a live message with incorrect metadata" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1056 ;
    solveit-core:hasReference :citationDFCite-1123 .

:weaknessDFW-1091
    a solveit-core:Weakness ;
    rdfs:label "DFW-1091: Recovering a deleted message with incorrect content"@en ;
    solveit-core:weaknessID "DFW-1091" ;
    solveit-core:weaknessName "Recovering a deleted message with incorrect content" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1056 .

:weaknessDFW-1092
    a solveit-core:Weakness ;
    rdfs:label "DFW-1092: Recovering a deleted message with incorrect metadata"@en ;
    solveit-core:weaknessID "DFW-1092" ;
    solveit-core:weaknessName "Recovering a deleted message with incorrect metadata" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1056 .

:weaknessDFW-1093
    a solveit-core:Weakness ;
    rdfs:label "DFW-1093: Presenting a deleted message as live"@en ;
    solveit-core:weaknessID "DFW-1093" ;
    solveit-core:weaknessName "Presenting a deleted message as live" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054 .

:weaknessDFW-1094
    a solveit-core:Weakness ;
    rdfs:label "DFW-1094: Attributing a message to the incorrect sender"@en ;
    solveit-core:weaknessID "DFW-1094" ;
    solveit-core:weaknessName "Attributing a message to the incorrect sender" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054 .

:weaknessDFW-1095
    a solveit-core:Weakness ;
    rdfs:label "DFW-1095: Attributing a message to the incorrect thread"@en ;
    solveit-core:weaknessID "DFW-1095" ;
    solveit-core:weaknessName "Attributing a message to the incorrect thread" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054 .

:weaknessDFW-1096
    a solveit-core:Weakness ;
    rdfs:label "DFW-1096: Failing to recover attachments for a live message"@en ;
    solveit-core:weaknessID "DFW-1096" ;
    solveit-core:weaknessName "Failing to recover attachments for a live message" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1054,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1056 .

:weaknessDFW-1097
    a solveit-core:Weakness ;
    rdfs:label "DFW-1097: Failing to recover attachment for a deleted message"@en ;
    solveit-core:weaknessID "DFW-1097" ;
    solveit-core:weaknessName "Failing to recover attachment for a deleted message" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1054,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1056 .

:weaknessDFW-1098
    a solveit-core:Weakness ;
    rdfs:label "DFW-1098: Assigning incorrect metadata to a message attachment"@en ;
    solveit-core:weaknessID "DFW-1098" ;
    solveit-core:weaknessName "Assigning incorrect metadata to a message attachment" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054 .

:weaknessDFW-1099
    a solveit-core:Weakness ;
    rdfs:label "DFW-1099: Assigning an attachment to an incorrect messages"@en ;
    solveit-core:weaknessID "DFW-1099" ;
    solveit-core:weaknessName "Assigning an attachment to an incorrect messages" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054 .

:weaknessDFW-1100
    a solveit-core:Weakness ;
    rdfs:label "DFW-1100: Tool fails to display special effects or highlight within a message"@en ;
    solveit-core:weaknessID "DFW-1100" ;
    solveit-core:weaknessName "Tool fails to display special effects or highlight within a message" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054 .

:weaknessDFW-1101
    a solveit-core:Weakness ;
    rdfs:label "DFW-1101: Failure to recover message edits if available"@en ;
    solveit-core:weaknessID "DFW-1101" ;
    solveit-core:weaknessName "Failure to recover message edits if available" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054 .

:weaknessDFW-1102
    a solveit-core:Weakness ;
    rdfs:label "DFW-1102: Failure to display that a message had a previous state"@en ;
    solveit-core:weaknessID "DFW-1102" ;
    solveit-core:weaknessName "Failure to display that a message had a previous state" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1054 .

:weaknessDFW-1103
    a solveit-core:Weakness ;
    rdfs:label "DFW-1103: Failure to carve salvageable content"@en ;
    solveit-core:weaknessID "DFW-1103" ;
    solveit-core:weaknessName "Failure to carve salvageable content" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1078 .

:weaknessDFW-1104
    a solveit-core:Weakness ;
    rdfs:label "DFW-1104: Incorrect carving of a complete file"@en ;
    solveit-core:weaknessID "DFW-1104" ;
    solveit-core:weaknessName "Incorrect carving of a complete file" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1062,
                                        :mitigationDFM-1063,
                                        :mitigationDFM-1064,
                                        :mitigationDFM-1090 .

:weaknessDFW-1105
    a solveit-core:Weakness ;
    rdfs:label "DFW-1105: Incorrect reassembly of a file"@en ;
    solveit-core:weaknessID "DFW-1105" ;
    solveit-core:weaknessName "Incorrect reassembly of a file" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1062,
                                        :mitigationDFM-1063,
                                        :mitigationDFM-1064,
                                        :mitigationDFM-1090 .

:weaknessDFW-1106
    a solveit-core:Weakness ;
    rdfs:label "DFW-1106: Incorrect attribution of salvaged content to a current file system rather than a previous one"@en ;
    solveit-core:weaknessID "DFW-1106" ;
    solveit-core:weaknessName "Incorrect attribution of salvaged content to a current file system rather than a previous one" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1061 .

:weaknessDFW-1107
    a solveit-core:Weakness ;
    rdfs:label "DFW-1107: Failure to repair a content fragment"@en ;
    solveit-core:weaknessID "DFW-1107" ;
    solveit-core:weaknessName "Failure to repair a content fragment" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1060,
                                        :mitigationDFM-1065 .

:weaknessDFW-1108
    a solveit-core:Weakness ;
    rdfs:label "DFW-1108: Failure to recover history resulting from private browsing"@en ;
    solveit-core:weaknessID "DFW-1108" ;
    solveit-core:weaknessName "Failure to recover history resulting from private browsing" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1066,
                                        :mitigationDFM-1067 ;
    solveit-core:hasReference :citationDFCite-1066 .

:weaknessDFW-1109
    a solveit-core:Weakness ;
    rdfs:label "DFW-1109: Incorrect recovery of information regarding a web visit from allocated data"@en ;
    solveit-core:weaknessID "DFW-1109" ;
    solveit-core:weaknessName "Incorrect recovery of information regarding a web visit from allocated data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT .

:weaknessDFW-1110
    a solveit-core:Weakness ;
    rdfs:label "DFW-1110: Failure to recover browser history from live data"@en ;
    solveit-core:weaknessID "DFW-1110" ;
    solveit-core:weaknessName "Failure to recover browser history from live data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1111
    a solveit-core:Weakness ;
    rdfs:label "DFW-1111: Incorrect recovery of information regarding a web visit from non-allocated data"@en ;
    solveit-core:weaknessID "DFW-1111" ;
    solveit-core:weaknessName "Incorrect recovery of information regarding a web visit from non-allocated data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT .

:weaknessDFW-1112
    a solveit-core:Weakness ;
    rdfs:label "DFW-1112: Failure to recover browser history from non-allocated data"@en ;
    solveit-core:weaknessID "DFW-1112" ;
    solveit-core:weaknessName "Failure to recover browser history from non-allocated data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1113
    a solveit-core:Weakness ;
    rdfs:label "DFW-1113: Misinterpretation a URL located on disk/memory as a web visit"@en ;
    solveit-core:weaknessID "DFW-1113" ;
    solveit-core:weaknessName "Misinterpretation a URL located on disk/memory as a web visit" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1190 .

:weaknessDFW-1114
    a solveit-core:Weakness ;
    rdfs:label "DFW-1114: Failure to locate a relevant device at a physical crime scene"@en ;
    solveit-core:weaknessID "DFW-1114" ;
    solveit-core:weaknessName "Failure to locate a relevant device at a physical crime scene" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1068,
                                        :mitigationDFM-1069,
                                        :mitigationDFM-1231,
                                        :mitigationDFM-1232 .

:weaknessDFW-1115
    a solveit-core:Weakness ;
    rdfs:label "DFW-1115: Device is remote wiped because faraday environment was insufficient."@en ;
    solveit-core:weaknessID "DFW-1115" ;
    solveit-core:weaknessName "Device is remote wiped because faraday environment was insufficient." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1002 .

:weaknessDFW-1116
    a solveit-core:Weakness ;
    rdfs:label "DFW-1116: Last wifi connection is overwritten because faraday environment was insufficient."@en ;
    solveit-core:weaknessID "DFW-1116" ;
    solveit-core:weaknessName "Last wifi connection is overwritten because faraday environment was insufficient." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1002 .

:weaknessDFW-1117
    a solveit-core:Weakness ;
    rdfs:label "DFW-1117: Calls, messages or other data was received and overwrote relevant data because faraday environment was insufficient."@en ;
    solveit-core:weaknessID "DFW-1117" ;
    solveit-core:weaknessName "Calls, messages or other data was received and overwrote relevant data because faraday environment was insufficient." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1002 .

:weaknessDFW-1118
    a solveit-core:Weakness ;
    rdfs:label "DFW-1118: Hardware write blocker fails to prevent modifications to the attached device."@en ;
    solveit-core:weaknessID "DFW-1118" ;
    solveit-core:weaknessName "Hardware write blocker fails to prevent modifications to the attached device." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1071,
                                        :mitigationDFM-1072,
                                        :mitigationDFM-1073 .

:weaknessDFW-1119
    a solveit-core:Weakness ;
    rdfs:label "DFW-1119: Hardware write blocker hides the existence of an HPA."@en ;
    solveit-core:weaknessID "DFW-1119" ;
    solveit-core:weaknessName "Hardware write blocker hides the existence of an HPA." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1005 .

:weaknessDFW-1120
    a solveit-core:Weakness ;
    rdfs:label "DFW-1120: Hardware write blocker hides the existence of an DCO."@en ;
    solveit-core:weaknessID "DFW-1120" ;
    solveit-core:weaknessName "Hardware write blocker hides the existence of an DCO." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1006 .

:weaknessDFW-1121
    a solveit-core:Weakness ;
    rdfs:label "DFW-1121: Image format parsing fails to to present all blocks from within a forensic container image in their ‘flat’ (dd) representation"@en ;
    solveit-core:weaknessID "DFW-1121" ;
    solveit-core:weaknessName "Image format parsing fails to to present all blocks from within a forensic container image in their ‘flat’ (dd) representation" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasReference :citationDFCite-1060 .

:weaknessDFW-1122
    a solveit-core:Weakness ;
    rdfs:label "DFW-1122: Image format parsing presents incorrect data within sectors of the image"@en ;
    solveit-core:weaknessID "DFW-1122" ;
    solveit-core:weaknessName "Image format parsing presents incorrect data within sectors of the image" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasReference :citationDFCite-1060 .

:weaknessDFW-1123
    a solveit-core:Weakness ;
    rdfs:label "DFW-1123: Image format parsing presents incorrect forensic image metadata"@en ;
    solveit-core:weaknessID "DFW-1123" ;
    solveit-core:weaknessName "Image format parsing presents incorrect forensic image metadata" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT ;
    solveit-core:hasReference :citationDFCite-1060 .

:weaknessDFW-1124
    a solveit-core:Weakness ;
    rdfs:label "DFW-1124: Failure to compute hash of source device correctly during disk image verification"@en ;
    solveit-core:weaknessID "DFW-1124" ;
    solveit-core:weaknessName "Failure to compute hash of source device correctly during disk image verification" ;
    solveit-core:weaknessDescription "This could result in a message indicating corrupt evidence, thus stopping or delaying further investigation" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1075,
                                        :mitigationDFM-1085 ;
    solveit-core:hasReference :citationDFCite-1060 .

:weaknessDFW-1125
    a solveit-core:Weakness ;
    rdfs:label "DFW-1125: Failure to validate hash properly during disk image verification"@en ;
    solveit-core:weaknessID "DFW-1125" ;
    solveit-core:weaknessName "Failure to validate hash properly during disk image verification" ;
    solveit-core:weaknessDescription "This could allow errors from earlier to propagate e.g. incorrect sectors" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1075,
                                        :mitigationDFM-1085 ;
    solveit-core:hasReference :citationDFCite-1060 .

:weaknessDFW-1126
    a solveit-core:Weakness ;
    rdfs:label "DFW-1126: Failure to validate hash properly allowing an incomplete disk image to present as validated"@en ;
    solveit-core:weaknessID "DFW-1126" ;
    solveit-core:weaknessName "Failure to validate hash properly allowing an incomplete disk image to present as validated" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1075,
                                        :mitigationDFM-1085 ;
    solveit-core:hasReference :citationDFCite-1060 .

:weaknessDFW-1127
    a solveit-core:Weakness ;
    rdfs:label "DFW-1127: Failure to validate disk image metadata"@en ;
    solveit-core:weaknessID "DFW-1127" ;
    solveit-core:weaknessName "Failure to validate disk image metadata" ;
    solveit-core:weaknessDescription "This could allow details such as acquisition date to be changed" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1076 ;
    solveit-core:hasReference :citationDFCite-1060 .

:weaknessDFW-1128
    a solveit-core:Weakness ;
    rdfs:label "DFW-1128: Disk image has been replaced with tampered version along with updated stored hash"@en ;
    solveit-core:weaknessID "DFW-1128" ;
    solveit-core:weaknessName "Disk image has been replaced with tampered version along with updated stored hash" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1022,
                                        :mitigationDFM-1023,
                                        :mitigationDFM-1074 ;
    solveit-core:hasReference :citationDFCite-1060,
                              :citationDFCite-1079 .

:weaknessDFW-1129
    a solveit-core:Weakness ;
    rdfs:label "DFW-1129: File type is incorrectly identified"@en ;
    solveit-core:weaknessID "DFW-1129" ;
    solveit-core:weaknessName "File type is incorrectly identified" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1109,
                                        :mitigationDFM-1111,
                                        :mitigationDFM-1112 ;
    solveit-core:hasReference :citationDFCite-1060 .

:weaknessDFW-1130
    a solveit-core:Weakness ;
    rdfs:label "DFW-1130: Missing assignment of a file type: reporting a file as unknown when it has a known type within the digital forensic science body of knowledge "@en ;
    solveit-core:weaknessID "DFW-1130" ;
    solveit-core:weaknessName "Missing assignment of a file type: reporting a file as unknown when it has a known type within the digital forensic science body of knowledge " ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1109,
                                        :mitigationDFM-1110,
                                        :mitigationDFM-1111,
                                        :mitigationDFM-1112 ;
    solveit-core:hasReference :citationDFCite-1060 .

:weaknessDFW-1131
    a solveit-core:Weakness ;
    rdfs:label "DFW-1131: Missing recognition of multiple file types: reporting a file as a limited set of types, or a single type, when it can be interpreted as having more than one, such as a GIF and Java Jar"@en ;
    solveit-core:weaknessID "DFW-1131" ;
    solveit-core:weaknessName "Missing recognition of multiple file types: reporting a file as a limited set of types, or a single type, when it can be interpreted as having more than one, such as a GIF and Java Jar" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1109,
                                        :mitigationDFM-1111,
                                        :mitigationDFM-1112 ;
    solveit-core:hasReference :citationDFCite-1060,
                              :citationDFCite-1090 .

:weaknessDFW-1132
    a solveit-core:Weakness ;
    rdfs:label "DFW-1132: Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation"@en ;
    solveit-core:weaknessID "DFW-1132" ;
    solveit-core:weaknessName "Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_AS ;
    solveit-core:hasReference :citationDFCite-1060 .

:weaknessDFW-1133
    a solveit-core:Weakness ;
    rdfs:label "DFW-1133: Tool fails to express uncertainty in the classification of file recovery results, e.g., where content may be partly overwritten."@en ;
    solveit-core:weaknessID "DFW-1133" ;
    solveit-core:weaknessName "Tool fails to express uncertainty in the classification of file recovery results, e.g., where content may be partly overwritten." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1084 ;
    solveit-core:hasReference :citationDFCite-1030,
                              :citationDFCite-1060 .

:weaknessDFW-1134
    a solveit-core:Weakness ;
    rdfs:label "DFW-1134: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected "@en ;
    solveit-core:weaknessID "DFW-1134" ;
    solveit-core:weaknessName "Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected " ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1079,
                                        :mitigationDFM-1080,
                                        :mitigationDFM-1081,
                                        :mitigationDFM-1082,
                                        :mitigationDFM-1083 ;
    solveit-core:hasReference :citationDFCite-1030 .

:weaknessDFW-1135
    a solveit-core:Weakness ;
    rdfs:label "DFW-1135: Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected "@en ;
    solveit-core:weaknessID "DFW-1135" ;
    solveit-core:weaknessName "Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected " ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1079,
                                        :mitigationDFM-1080,
                                        :mitigationDFM-1081,
                                        :mitigationDFM-1082,
                                        :mitigationDFM-1083 ;
    solveit-core:hasReference :citationDFCite-1030 .

:weaknessDFW-1136
    a solveit-core:Weakness ;
    rdfs:label "DFW-1136: Data cannot be read from a device due to the device having failed physically"@en ;
    solveit-core:weaknessID "DFW-1136" ;
    solveit-core:weaknessName "Data cannot be read from a device due to the device having failed physically" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1089 .

:weaknessDFW-1137
    a solveit-core:Weakness ;
    rdfs:label "DFW-1137: Failing to determine password as it is not in the dictionary used"@en ;
    solveit-core:weaknessID "DFW-1137" ;
    solveit-core:weaknessName "Failing to determine password as it is not in the dictionary used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1091,
                                        :mitigationDFM-1092,
                                        :mitigationDFM-1093,
                                        :mitigationDFM-1094,
                                        :mitigationDFM-1205,
                                        :mitigationDFM-1231 .

:weaknessDFW-1138
    a solveit-core:Weakness ;
    rdfs:label "DFW-1138: Failing to identify password in the time available"@en ;
    solveit-core:weaknessID "DFW-1138" ;
    solveit-core:weaknessName "Failing to identify password in the time available" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1092,
                                        :mitigationDFM-1095,
                                        :mitigationDFM-1096,
                                        :mitigationDFM-1097,
                                        :mitigationDFM-1205,
                                        :mitigationDFM-1231 .

:weaknessDFW-1139
    a solveit-core:Weakness ;
    rdfs:label "DFW-1139: System locks after X failed dictionary attempts"@en ;
    solveit-core:weaknessID "DFW-1139" ;
    solveit-core:weaknessName "System locks after X failed dictionary attempts" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1094,
                                        :mitigationDFM-1095,
                                        :mitigationDFM-1097,
                                        :mitigationDFM-1231 .

:weaknessDFW-1140
    a solveit-core:Weakness ;
    rdfs:label "DFW-1140: Failing to determine password as it is not in the search space"@en ;
    solveit-core:weaknessID "DFW-1140" ;
    solveit-core:weaknessName "Failing to determine password as it is not in the search space" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1097,
                                        :mitigationDFM-1098,
                                        :mitigationDFM-1099,
                                        :mitigationDFM-1231 .

:weaknessDFW-1141
    a solveit-core:Weakness ;
    rdfs:label "DFW-1141: Failing to determine password via brute force in the time available"@en ;
    solveit-core:weaknessID "DFW-1141" ;
    solveit-core:weaknessName "Failing to determine password via brute force in the time available" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1097,
                                        :mitigationDFM-1098,
                                        :mitigationDFM-1099,
                                        :mitigationDFM-1100,
                                        :mitigationDFM-1231 .

:weaknessDFW-1142
    a solveit-core:Weakness ;
    rdfs:label "DFW-1142: System locks after X failed brute force attempts"@en ;
    solveit-core:weaknessID "DFW-1142" ;
    solveit-core:weaknessName "System locks after X failed brute force attempts" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1097,
                                        :mitigationDFM-1098,
                                        :mitigationDFM-1099,
                                        :mitigationDFM-1231 .

:weaknessDFW-1143
    a solveit-core:Weakness ;
    rdfs:label "DFW-1143: Data is not read from remapped sectors e.g. G-Lists during the acquisition process"@en ;
    solveit-core:weaknessID "DFW-1143" ;
    solveit-core:weaknessName "Data is not read from remapped sectors e.g. G-Lists during the acquisition process" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1102 ;
    solveit-core:hasReference :citationDFCite-1124 .

:weaknessDFW-1144
    a solveit-core:Weakness ;
    rdfs:label "DFW-1144: Failure to identify timestamps in a data source"@en ;
    solveit-core:weaknessID "DFW-1144" ;
    solveit-core:weaknessName "Failure to identify timestamps in a data source" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1145
    a solveit-core:Weakness ;
    rdfs:label "DFW-1145: Failure to extract timestamps from a data source"@en ;
    solveit-core:weaknessID "DFW-1145" ;
    solveit-core:weaknessName "Failure to extract timestamps from a data source" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1146
    a solveit-core:Weakness ;
    rdfs:label "DFW-1146: Failure to consider non-timestamp based timing information"@en ;
    solveit-core:weaknessID "DFW-1146" ;
    solveit-core:weaknessName "Failure to consider non-timestamp based timing information" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasReference :citationDFCite-1039 .

:weaknessDFW-1147
    a solveit-core:Weakness ;
    rdfs:label "DFW-1147: Failure to normalise timestamps correctly during timeline generation"@en ;
    solveit-core:weaknessID "DFW-1147" ;
    solveit-core:weaknessName "Failure to normalise timestamps correctly during timeline generation" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_EX .

:weaknessDFW-1148
    a solveit-core:Weakness ;
    rdfs:label "DFW-1148: Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock"@en ;
    solveit-core:weaknessID "DFW-1148" ;
    solveit-core:weaknessName "Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1101,
                                        :mitigationDFM-1225,
                                        :mitigationDFM-1227,
                                        :mitigationDFM-1228 .

:weaknessDFW-1149
    a solveit-core:Weakness ;
    rdfs:label "DFW-1149: Failure to consider timestamp inaccuracy at time of inferred event"@en ;
    solveit-core:weaknessID "DFW-1149" ;
    solveit-core:weaknessName "Failure to consider timestamp inaccuracy at time of inferred event" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_INCOMP,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1103 .

:weaknessDFW-1150
    a solveit-core:Weakness ;
    rdfs:label "DFW-1150: Misinterpreting events from automated processes as user generated ones"@en ;
    solveit-core:weaknessID "DFW-1150" ;
    solveit-core:weaknessName "Misinterpreting events from automated processes as user generated ones" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasReference :citationDFCite-1073 .

:weaknessDFW-1151
    a solveit-core:Weakness ;
    rdfs:label "DFW-1151: Incorrectly decoding a timestamp from a data source"@en ;
    solveit-core:weaknessID "DFW-1151" ;
    solveit-core:weaknessName "Incorrectly decoding a timestamp from a data source" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT .

:weaknessDFW-1152
    a solveit-core:Weakness ;
    rdfs:label "DFW-1152: Generated report does not include all bookmarks"@en ;
    solveit-core:weaknessID "DFW-1152" ;
    solveit-core:weaknessName "Generated report does not include all bookmarks" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1104,
                                        :mitigationDFM-1105 .

:weaknessDFW-1153
    a solveit-core:Weakness ;
    rdfs:label "DFW-1153: Report generated from bookmarks does not render all content (e.g. previews, string extracts) correctly"@en ;
    solveit-core:weaknessID "DFW-1153" ;
    solveit-core:weaknessName "Report generated from bookmarks does not render all content (e.g. previews, string extracts) correctly" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1106,
                                        :mitigationDFM-1107 .

:weaknessDFW-1154
    a solveit-core:Weakness ;
    rdfs:label "DFW-1154: Report generated from bookmarks stored in manner that does not prevent tampering or corruption"@en ;
    solveit-core:weaknessID "DFW-1154" ;
    solveit-core:weaknessName "Report generated from bookmarks stored in manner that does not prevent tampering or corruption" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1108,
                                        :mitigationDFM-1299 .

:weaknessDFW-1155
    a solveit-core:Weakness ;
    rdfs:label "DFW-1155: Bookmark added by examiner is not recorded"@en ;
    solveit-core:weaknessID "DFW-1155" ;
    solveit-core:weaknessName "Bookmark added by examiner is not recorded" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1156
    a solveit-core:Weakness ;
    rdfs:label "DFW-1156: Bookmark added by examiner is is recorded with incorrect tag/label/category"@en ;
    solveit-core:weaknessID "DFW-1156" ;
    solveit-core:weaknessName "Bookmark added by examiner is is recorded with incorrect tag/label/category" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS .

:weaknessDFW-1157
    a solveit-core:Weakness ;
    rdfs:label "DFW-1157: Use of mobile exploit changes/overwrites data that was relevant to the investigation"@en ;
    solveit-core:weaknessID "DFW-1157" ;
    solveit-core:weaknessName "Use of mobile exploit changes/overwrites data that was relevant to the investigation" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasReference :citationDFCite-1042,
                              :citationDFCite-1049 .

:weaknessDFW-1158
    a solveit-core:Weakness ;
    rdfs:label "DFW-1158: Use of mobile exploit renders device unusable or 'bricked'"@en ;
    solveit-core:weaknessID "DFW-1158" ;
    solveit-core:weaknessName "Use of mobile exploit renders device unusable or 'bricked'" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasReference :citationDFCite-1125 .

:weaknessDFW-1159
    a solveit-core:Weakness ;
    rdfs:label "DFW-1159: Presenting a mobile file system acquisition as a bitwise copy of the device"@en ;
    solveit-core:weaknessID "DFW-1159" ;
    solveit-core:weaknessName "Presenting a mobile file system acquisition as a bitwise copy of the device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1114 .

:weaknessDFW-1160
    a solveit-core:Weakness ;
    rdfs:label "DFW-1160: Failure to copy relevant files from the mobile device"@en ;
    solveit-core:weaknessID "DFW-1160" ;
    solveit-core:weaknessName "Failure to copy relevant files from the mobile device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1161
    a solveit-core:Weakness ;
    rdfs:label "DFW-1161: Lack of privileges for file system acquisition"@en ;
    solveit-core:weaknessID "DFW-1161" ;
    solveit-core:weaknessName "Lack of privileges for file system acquisition" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1113 .

:weaknessDFW-1162
    a solveit-core:Weakness ;
    rdfs:label "DFW-1162: Changing relevant files during file system acquisition"@en ;
    solveit-core:weaknessID "DFW-1162" ;
    solveit-core:weaknessName "Changing relevant files during file system acquisition" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP .

:weaknessDFW-1163
    a solveit-core:Weakness ;
    rdfs:label "DFW-1163: Changing relevant file metadata during file system acquisition"@en ;
    solveit-core:weaknessID "DFW-1163" ;
    solveit-core:weaknessName "Changing relevant file metadata during file system acquisition" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP .

:weaknessDFW-1164
    a solveit-core:Weakness ;
    rdfs:label "DFW-1164: Files are still encrypted using file-based encryption so inaccessible"@en ;
    solveit-core:weaknessID "DFW-1164" ;
    solveit-core:weaknessName "Files are still encrypted using file-based encryption so inaccessible" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1115,
                                        :mitigationDFM-1116,
                                        :mitigationDFM-1117 .

:weaknessDFW-1165
    a solveit-core:Weakness ;
    rdfs:label "DFW-1165: Failure to preserve original timestamps from the data source in an archive"@en ;
    solveit-core:weaknessID "DFW-1165" ;
    solveit-core:weaknessName "Failure to preserve original timestamps from the data source in an archive" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP,
                                  solveit-core:ASTM_MISINT .

:weaknessDFW-1166
    a solveit-core:Weakness ;
    rdfs:label "DFW-1166: Consideration of live database content only"@en ;
    solveit-core:weaknessID "DFW-1166" ;
    solveit-core:weaknessName "Consideration of live database content only" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1122,
                                        :mitigationDFM-1123 ;
    solveit-core:hasReference :citationDFCite-1113 .

:weaknessDFW-1167
    a solveit-core:Weakness ;
    rdfs:label "DFW-1167: Combining data from multiple tables that should not be joined"@en ;
    solveit-core:weaknessID "DFW-1167" ;
    solveit-core:weaknessName "Combining data from multiple tables that should not be joined" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1118,
                                        :mitigationDFM-1119,
                                        :mitigationDFM-1120,
                                        :mitigationDFM-1121 .

:weaknessDFW-1168
    a solveit-core:Weakness ;
    rdfs:label "DFW-1168: Data extracted from a table is assigned an incorrect interpretation"@en ;
    solveit-core:weaknessID "DFW-1168" ;
    solveit-core:weaknessName "Data extracted from a table is assigned an incorrect interpretation" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_MISINT .

:weaknessDFW-1169
    a solveit-core:Weakness ;
    rdfs:label "DFW-1169: Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value"@en ;
    solveit-core:weaknessID "DFW-1169" ;
    solveit-core:weaknessName "Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT .

:weaknessDFW-1170
    a solveit-core:Weakness ;
    rdfs:label "DFW-1170: Failure to recover data stored in Write Ahead Log (WAL) files"@en ;
    solveit-core:weaknessID "DFW-1170" ;
    solveit-core:weaknessName "Failure to recover data stored in Write Ahead Log (WAL) files" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1124 ;
    solveit-core:hasReference :citationDFCite-1021 .

:weaknessDFW-1171
    a solveit-core:Weakness ;
    rdfs:label "DFW-1171: Failure to recover data stored in database journal files"@en ;
    solveit-core:weaknessID "DFW-1171" ;
    solveit-core:weaknessName "Failure to recover data stored in database journal files" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1125 ;
    solveit-core:hasReference :citationDFCite-1021 .

:weaknessDFW-1172
    a solveit-core:Weakness ;
    rdfs:label "DFW-1172: Relevant reference data missed as its necessity was not known at time of preservation"@en ;
    solveit-core:weaknessID "DFW-1172" ;
    solveit-core:weaknessName "Relevant reference data missed as its necessity was not known at time of preservation" ;
    solveit-core:weaknessDescription "Missing reference data means inference of event that did not happen" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1139 .

:weaknessDFW-1173
    a solveit-core:Weakness ;
    rdfs:label "DFW-1173: The recorded time offset is incorrect because the trusted time source used for reference was incorrect"@en ;
    solveit-core:weaknessID "DFW-1173" ;
    solveit-core:weaknessName "The recorded time offset is incorrect because the trusted time source used for reference was incorrect" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX .

:weaknessDFW-1174
    a solveit-core:Weakness ;
    rdfs:label "DFW-1174: Failure to find internal attached storage media"@en ;
    solveit-core:weaknessID "DFW-1174" ;
    solveit-core:weaknessName "Failure to find internal attached storage media" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1175
    a solveit-core:Weakness ;
    rdfs:label "DFW-1175: Failure to find internal unattached storage media"@en ;
    solveit-core:weaknessID "DFW-1175" ;
    solveit-core:weaknessName "Failure to find internal unattached storage media" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1176
    a solveit-core:Weakness ;
    rdfs:label "DFW-1176: Unable to physically remove/detach internal storage media"@en ;
    solveit-core:weaknessID "DFW-1176" ;
    solveit-core:weaknessName "Unable to physically remove/detach internal storage media" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1126 ;
    solveit-core:hasReference :citationDFCite-1071 .

:weaknessDFW-1177
    a solveit-core:Weakness ;
    rdfs:label "DFW-1177: Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence"@en ;
    solveit-core:weaknessID "DFW-1177" ;
    solveit-core:weaknessName "Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1126,
                                        :mitigationDFM-1127 .

:weaknessDFW-1178
    a solveit-core:Weakness ;
    rdfs:label "DFW-1178: Inability to load the forensic bootable environment due to system configuration"@en ;
    solveit-core:weaknessID "DFW-1178" ;
    solveit-core:weaknessName "Inability to load the forensic bootable environment due to system configuration" ;
    solveit-core:weaknessDescription "System configuration may not permit alternative booting e.g., Secureboot is enabled" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1128,
                                        :mitigationDFM-1129,
                                        :mitigationDFM-1130 .

:weaknessDFW-1179
    a solveit-core:Weakness ;
    rdfs:label "DFW-1179: Failure to detect internal disk from bootable environment"@en ;
    solveit-core:weaknessID "DFW-1179" ;
    solveit-core:weaknessName "Failure to detect internal disk from bootable environment" ;
    solveit-core:weaknessDescription "For example this may be due to missing drivers" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1131 .

:weaknessDFW-1180
    a solveit-core:Weakness ;
    rdfs:label "DFW-1180: Failing to decrypt internal disk using the bootable environment"@en ;
    solveit-core:weaknessID "DFW-1180" ;
    solveit-core:weaknessName "Failing to decrypt internal disk using the bootable environment" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1132,
                                        :mitigationDFM-1133 .

:weaknessDFW-1182
    a solveit-core:Weakness ;
    rdfs:label "DFW-1182: Bootable environment overwrites relevant data on the target device"@en ;
    solveit-core:weaknessID "DFW-1182" ;
    solveit-core:weaknessName "Bootable environment overwrites relevant data on the target device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1008,
                                        :mitigationDFM-1014,
                                        :mitigationDFM-1015 .

:weaknessDFW-1183
    a solveit-core:Weakness ;
    rdfs:label "DFW-1183: Failure to identify the existence of a connected device"@en ;
    solveit-core:weaknessID "DFW-1183" ;
    solveit-core:weaknessName "Failure to identify the existence of a connected device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1134 .

:weaknessDFW-1184
    a solveit-core:Weakness ;
    rdfs:label "DFW-1184: Presenting devices 'seen' as devices connected"@en ;
    solveit-core:weaknessID "DFW-1184" ;
    solveit-core:weaknessName "Presenting devices 'seen' as devices connected" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1135 .

:weaknessDFW-1185
    a solveit-core:Weakness ;
    rdfs:label "DFW-1185: Failure to enumerate all files in a standard archive format"@en ;
    solveit-core:weaknessID "DFW-1185" ;
    solveit-core:weaknessName "Failure to enumerate all files in a standard archive format" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1136,
                                        :mitigationDFM-1137 .

:weaknessDFW-1186
    a solveit-core:Weakness ;
    rdfs:label "DFW-1186: Missing files with file name/path-based pattern matching due to renaming"@en ;
    solveit-core:weaknessID "DFW-1186" ;
    solveit-core:weaknessName "Missing files with file name/path-based pattern matching due to renaming" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1187
    a solveit-core:Weakness ;
    rdfs:label "DFW-1187: Failure to match file name/path pattern due to mismatch of search term used and pattern match engine."@en ;
    solveit-core:weaknessID "DFW-1187" ;
    solveit-core:weaknessName "Failure to match file name/path pattern due to mismatch of search term used and pattern match engine." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1188
    a solveit-core:Weakness ;
    rdfs:label "DFW-1188: Failure to match file name/path pattern due to implementation error in matching engine."@en ;
    solveit-core:weaknessID "DFW-1188" ;
    solveit-core:weaknessName "Failure to match file name/path pattern due to implementation error in matching engine." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1138 .

:weaknessDFW-1189
    a solveit-core:Weakness ;
    rdfs:label "DFW-1189: Artifact extraction is incomplete due to app version changes."@en ;
    solveit-core:weaknessID "DFW-1189" ;
    solveit-core:weaknessName "Artifact extraction is incomplete due to app version changes." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1139 .

:weaknessDFW-1190
    a solveit-core:Weakness ;
    rdfs:label "DFW-1190: Interpretation of app data is incorrect due to app version changes."@en ;
    solveit-core:weaknessID "DFW-1190" ;
    solveit-core:weaknessName "Interpretation of app data is incorrect due to app version changes." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1139 .

:weaknessDFW-1191
    a solveit-core:Weakness ;
    rdfs:label "DFW-1191: Missing changes in app artifacts during research since app interaction is needed to cause changes"@en ;
    solveit-core:weaknessID "DFW-1191" ;
    solveit-core:weaknessName "Missing changes in app artifacts during research since app interaction is needed to cause changes" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1140 .

:weaknessDFW-1192
    a solveit-core:Weakness ;
    rdfs:label "DFW-1192: Relevant results not captured by the case-specific keywords used"@en ;
    solveit-core:weaknessID "DFW-1192" ;
    solveit-core:weaknessName "Relevant results not captured by the case-specific keywords used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1031,
                                        :mitigationDFM-1141,
                                        :mitigationDFM-1142,
                                        :mitigationDFM-1152 .

:weaknessDFW-1193
    a solveit-core:Weakness ;
    rdfs:label "DFW-1193: Keyword results missed since relevant keyword is split over a sector or cluster boundary"@en ;
    solveit-core:weaknessID "DFW-1193" ;
    solveit-core:weaknessName "Keyword results missed since relevant keyword is split over a sector or cluster boundary" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1143,
                                        :mitigationDFM-1144 .

:weaknessDFW-1194
    a solveit-core:Weakness ;
    rdfs:label "DFW-1194: Keyword results missed since relevant keyword is inside compressed or encoded data"@en ;
    solveit-core:weaknessID "DFW-1194" ;
    solveit-core:weaknessName "Keyword results missed since relevant keyword is inside compressed or encoded data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1143,
                                        :mitigationDFM-1144 .

:weaknessDFW-1195
    a solveit-core:Weakness ;
    rdfs:label "DFW-1195: Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file"@en ;
    solveit-core:weaknessID "DFW-1195" ;
    solveit-core:weaknessName "Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1151 .

:weaknessDFW-1196
    a solveit-core:Weakness ;
    rdfs:label "DFW-1196: One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image"@en ;
    solveit-core:weaknessID "DFW-1196" ;
    solveit-core:weaknessName "One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1145 .

:weaknessDFW-1197
    a solveit-core:Weakness ;
    rdfs:label "DFW-1197: Data not indexed for keyword searching due to compression"@en ;
    solveit-core:weaknessID "DFW-1197" ;
    solveit-core:weaknessName "Data not indexed for keyword searching due to compression" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1029,
                                        :mitigationDFM-1034,
                                        :mitigationDFM-1149 .

:weaknessDFW-1198
    a solveit-core:Weakness ;
    rdfs:label "DFW-1198: Data not indexed for keyword searching due to file or content encoding"@en ;
    solveit-core:weaknessID "DFW-1198" ;
    solveit-core:weaknessName "Data not indexed for keyword searching due to file or content encoding" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1029,
                                        :mitigationDFM-1034,
                                        :mitigationDFM-1150 .

:weaknessDFW-1199
    a solveit-core:Weakness ;
    rdfs:label "DFW-1199: Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical"@en ;
    solveit-core:weaknessID "DFW-1199" ;
    solveit-core:weaknessName "Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1033,
                                        :mitigationDFM-1038,
                                        :mitigationDFM-1142,
                                        :mitigationDFM-1152 .

:weaknessDFW-1200
    a solveit-core:Weakness ;
    rdfs:label "DFW-1200: Failure to conduct iterative keyword searching due to excessive time taken per search"@en ;
    solveit-core:weaknessID "DFW-1200" ;
    solveit-core:weaknessName "Failure to conduct iterative keyword searching due to excessive time taken per search" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1153 .

:weaknessDFW-1201
    a solveit-core:Weakness ;
    rdfs:label "DFW-1201: Failure to recover live messages to or from the AI companion app"@en ;
    solveit-core:weaknessID "DFW-1201" ;
    solveit-core:weaknessName "Failure to recover live messages to or from the AI companion app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1154 .

:weaknessDFW-1202
    a solveit-core:Weakness ;
    rdfs:label "DFW-1202: Failure to recover deleted but recoverable messages to or from the AI companion app"@en ;
    solveit-core:weaknessID "DFW-1202" ;
    solveit-core:weaknessName "Failure to recover deleted but recoverable messages to or from the AI companion app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1155 .

:weaknessDFW-1203
    a solveit-core:Weakness ;
    rdfs:label "DFW-1203: Presenting a message from the user or AI companion app that did not exist"@en ;
    solveit-core:weaknessID "DFW-1203" ;
    solveit-core:weaknessName "Presenting a message from the user or AI companion app that did not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1154 .

:weaknessDFW-1204
    a solveit-core:Weakness ;
    rdfs:label "DFW-1204: Presenting a deleted message to the AI companion app as a live one, or vice versa"@en ;
    solveit-core:weaknessID "DFW-1204" ;
    solveit-core:weaknessName "Presenting a deleted message to the AI companion app as a live one, or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1155 .

:weaknessDFW-1205
    a solveit-core:Weakness ;
    rdfs:label "DFW-1205: Presenting a message to the AI chat app as from the AI companion app, or vice versa"@en ;
    solveit-core:weaknessID "DFW-1205" ;
    solveit-core:weaknessName "Presenting a message to the AI chat app as from the AI companion app, or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1154,
                                        :mitigationDFM-1155,
                                        :mitigationDFM-1156 .

:weaknessDFW-1206
    a solveit-core:Weakness ;
    rdfs:label "DFW-1206: Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app"@en ;
    solveit-core:weaknessID "DFW-1206" ;
    solveit-core:weaknessName "Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1155 .

:weaknessDFW-1207
    a solveit-core:Weakness ;
    rdfs:label "DFW-1207: Failure to display a message to or from the AI companion app in the context of other messages"@en ;
    solveit-core:weaknessID "DFW-1207" ;
    solveit-core:weaknessName "Failure to display a message to or from the AI companion app in the context of other messages" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1157 .

:weaknessDFW-1208
    a solveit-core:Weakness ;
    rdfs:label "DFW-1208: Failure to recover live images sent to or from the AI companion app"@en ;
    solveit-core:weaknessID "DFW-1208" ;
    solveit-core:weaknessName "Failure to recover live images sent to or from the AI companion app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1158 .

:weaknessDFW-1209
    a solveit-core:Weakness ;
    rdfs:label "DFW-1209: Failure to recover deleted but recoverable images sent to or from the AI companion app"@en ;
    solveit-core:weaknessID "DFW-1209" ;
    solveit-core:weaknessName "Failure to recover deleted but recoverable images sent to or from the AI companion app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1159 .

:weaknessDFW-1210
    a solveit-core:Weakness ;
    rdfs:label "DFW-1210: Presenting an image sent from the user or AI companion app that did not exist"@en ;
    solveit-core:weaknessID "DFW-1210" ;
    solveit-core:weaknessName "Presenting an image sent from the user or AI companion app that did not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1158,
                                        :mitigationDFM-1159 .

:weaknessDFW-1211
    a solveit-core:Weakness ;
    rdfs:label "DFW-1211: Presenting a deleted image sent to the AI companion app as a live one, or vice versa"@en ;
    solveit-core:weaknessID "DFW-1211" ;
    solveit-core:weaknessName "Presenting a deleted image sent to the AI companion app as a live one, or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1158,
                                        :mitigationDFM-1159 .

:weaknessDFW-1212
    a solveit-core:Weakness ;
    rdfs:label "DFW-1212: Presenting an image sent to the AI chat app as from the AI companion app, or vice versa"@en ;
    solveit-core:weaknessID "DFW-1212" ;
    solveit-core:weaknessName "Presenting an image sent to the AI chat app as from the AI companion app, or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1158,
                                        :mitigationDFM-1159,
                                        :mitigationDFM-1160 .

:weaknessDFW-1213
    a solveit-core:Weakness ;
    rdfs:label "DFW-1213: Failure to display an image to or from the AI companion app in the context of other messages"@en ;
    solveit-core:weaknessID "DFW-1213" ;
    solveit-core:weaknessName "Failure to display an image to or from the AI companion app in the context of other messages" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1157 .

:weaknessDFW-1214
    a solveit-core:Weakness ;
    rdfs:label "DFW-1214: Failure to recover live records of calls to or from the AI companion app"@en ;
    solveit-core:weaknessID "DFW-1214" ;
    solveit-core:weaknessName "Failure to recover live records of calls to or from the AI companion app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1161 .

:weaknessDFW-1215
    a solveit-core:Weakness ;
    rdfs:label "DFW-1215: Failure to recover deleted but recoverable records of calls to or from the AI companion app"@en ;
    solveit-core:weaknessID "DFW-1215" ;
    solveit-core:weaknessName "Failure to recover deleted but recoverable records of calls to or from the AI companion app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1162 .

:weaknessDFW-1216
    a solveit-core:Weakness ;
    rdfs:label "DFW-1216: Presenting a call to or from the AI companion app that did not exist"@en ;
    solveit-core:weaknessID "DFW-1216" ;
    solveit-core:weaknessName "Presenting a call to or from the AI companion app that did not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1161,
                                        :mitigationDFM-1162 .

:weaknessDFW-1217
    a solveit-core:Weakness ;
    rdfs:label "DFW-1217: Presenting a deleted call to the AI companion app as a live one, or vice versa"@en ;
    solveit-core:weaknessID "DFW-1217" ;
    solveit-core:weaknessName "Presenting a deleted call to the AI companion app as a live one, or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1161,
                                        :mitigationDFM-1162 .

:weaknessDFW-1218
    a solveit-core:Weakness ;
    rdfs:label "DFW-1218: Presenting a call to the AI companion app as from the AI companion app, or vice versa"@en ;
    solveit-core:weaknessID "DFW-1218" ;
    solveit-core:weaknessName "Presenting a call to the AI companion app as from the AI companion app, or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1161,
                                        :mitigationDFM-1162,
                                        :mitigationDFM-1163 .

:weaknessDFW-1219
    a solveit-core:Weakness ;
    rdfs:label "DFW-1219: Failure to recover metadata associated with an interaction with the AI companion app"@en ;
    solveit-core:weaknessID "DFW-1219" ;
    solveit-core:weaknessName "Failure to recover metadata associated with an interaction with the AI companion app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1154,
                                        :mitigationDFM-1155,
                                        :mitigationDFM-1158,
                                        :mitigationDFM-1159,
                                        :mitigationDFM-1161,
                                        :mitigationDFM-1162 .

:weaknessDFW-1220
    a solveit-core:Weakness ;
    rdfs:label "DFW-1220: Presenting an incorrect timestamp associated with an interaction with the AI companion app"@en ;
    solveit-core:weaknessID "DFW-1220" ;
    solveit-core:weaknessName "Presenting an incorrect timestamp associated with an interaction with the AI companion app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1154,
                                        :mitigationDFM-1155,
                                        :mitigationDFM-1158,
                                        :mitigationDFM-1159,
                                        :mitigationDFM-1161,
                                        :mitigationDFM-1162 .

:weaknessDFW-1221
    a solveit-core:Weakness ;
    rdfs:label "DFW-1221: Failure to recover account details from the AI app data"@en ;
    solveit-core:weaknessID "DFW-1221" ;
    solveit-core:weaknessName "Failure to recover account details from the AI app data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1164 .

:weaknessDFW-1222
    a solveit-core:Weakness ;
    rdfs:label "DFW-1222: Presenting account details that did not exist"@en ;
    solveit-core:weaknessID "DFW-1222" ;
    solveit-core:weaknessName "Presenting account details that did not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1164 .

:weaknessDFW-1223
    a solveit-core:Weakness ;
    rdfs:label "DFW-1223: Live access to the device (for extraction) updates last access times for an account"@en ;
    solveit-core:weaknessID "DFW-1223" ;
    solveit-core:weaknessName "Live access to the device (for extraction) updates last access times for an account" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1165,
                                        :mitigationDFM-1166,
                                        :mitigationDFM-1167,
                                        :mitigationDFM-1168 .

:weaknessDFW-1224
    a solveit-core:Weakness ;
    rdfs:label "DFW-1224: Presenting a deleted account as live, or vice versa"@en ;
    solveit-core:weaknessID "DFW-1224" ;
    solveit-core:weaknessName "Presenting a deleted account as live, or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1164 .

:weaknessDFW-1225
    a solveit-core:Weakness ;
    rdfs:label "DFW-1225: Failure to recover relevant app settings"@en ;
    solveit-core:weaknessID "DFW-1225" ;
    solveit-core:weaknessName "Failure to recover relevant app settings" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1169,
                                        :mitigationDFM-1170 .

:weaknessDFW-1226
    a solveit-core:Weakness ;
    rdfs:label "DFW-1226: Failure to recover relevant AI bot settings"@en ;
    solveit-core:weaknessID "DFW-1226" ;
    solveit-core:weaknessName "Failure to recover relevant AI bot settings" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1170,
                                        :mitigationDFM-1171 .

:weaknessDFW-1227
    a solveit-core:Weakness ;
    rdfs:label "DFW-1227: Associating a configured bot with the wrong account"@en ;
    solveit-core:weaknessID "DFW-1227" ;
    solveit-core:weaknessName "Associating a configured bot with the wrong account" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1055,
                                        :mitigationDFM-1171 .

:weaknessDFW-1228
    a solveit-core:Weakness ;
    rdfs:label "DFW-1228: Log entry missing due to incorrect parsing of logfile"@en ;
    solveit-core:weaknessID "DFW-1228" ;
    solveit-core:weaknessName "Log entry missing due to incorrect parsing of logfile" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1181 .

:weaknessDFW-1229
    a solveit-core:Weakness ;
    rdfs:label "DFW-1229: Log entry missing due to being stored in archived copies of logs"@en ;
    solveit-core:weaknessID "DFW-1229" ;
    solveit-core:weaknessName "Log entry missing due to being stored in archived copies of logs" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1175 .

:weaknessDFW-1230
    a solveit-core:Weakness ;
    rdfs:label "DFW-1230: Log entry missing due to rotation size or timing"@en ;
    solveit-core:weaknessID "DFW-1230" ;
    solveit-core:weaknessName "Log entry missing due to rotation size or timing" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1172,
                                        :mitigationDFM-1173,
                                        :mitigationDFM-1175 ;
    solveit-core:hasReference :citationDFCite-1140 .

:weaknessDFW-1231
    a solveit-core:Weakness ;
    rdfs:label "DFW-1231: Interpreting log entry absence as evidence of deletion rather than logging configuration"@en ;
    solveit-core:weaknessID "DFW-1231" ;
    solveit-core:weaknessName "Interpreting log entry absence as evidence of deletion rather than logging configuration" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1174 .

:weaknessDFW-1232
    a solveit-core:Weakness ;
    rdfs:label "DFW-1232: Failure to extract log entry timestamp"@en ;
    solveit-core:weaknessID "DFW-1232" ;
    solveit-core:weaknessName "Failure to extract log entry timestamp" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1180 .

:weaknessDFW-1233
    a solveit-core:Weakness ;
    rdfs:label "DFW-1233: Failure to communicate imprecision in log entry timestamp"@en ;
    solveit-core:weaknessID "DFW-1233" ;
    solveit-core:weaknessName "Failure to communicate imprecision in log entry timestamp" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1177 .

:weaknessDFW-1234
    a solveit-core:Weakness ;
    rdfs:label "DFW-1234: Event time presented incorrectly due to incorrect timezone handling"@en ;
    solveit-core:weaknessID "DFW-1234" ;
    solveit-core:weaknessName "Event time presented incorrectly due to incorrect timezone handling" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_INCOMP,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1178,
                                        :mitigationDFM-1179 .

:weaknessDFW-1235
    a solveit-core:Weakness ;
    rdfs:label "DFW-1235: Failure to extract log entry type"@en ;
    solveit-core:weaknessID "DFW-1235" ;
    solveit-core:weaknessName "Failure to extract log entry type" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1182 .

:weaknessDFW-1236
    a solveit-core:Weakness ;
    rdfs:label "DFW-1236: Incorrectly interpreting a log entry type based on a different version of the generating software or operating system"@en ;
    solveit-core:weaknessID "DFW-1236" ;
    solveit-core:weaknessName "Incorrectly interpreting a log entry type based on a different version of the generating software or operating system" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1176 .

:weaknessDFW-1243
    a solveit-core:Weakness ;
    rdfs:label "DFW-1243: Missing browser history data as it was conducted outside of configured retention period"@en ;
    solveit-core:weaknessID "DFW-1243" ;
    solveit-core:weaknessName "Missing browser history data as it was conducted outside of configured retention period" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1192,
                                        :mitigationDFM-1193 .

:weaknessDFW-1244
    a solveit-core:Weakness ;
    rdfs:label "DFW-1244: Missing browser history data as it was cleared by user"@en ;
    solveit-core:weaknessID "DFW-1244" ;
    solveit-core:weaknessName "Missing browser history data as it was cleared by user" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasReference :citationDFCite-1109 .

:weaknessDFW-1245
    a solveit-core:Weakness ;
    rdfs:label "DFW-1245: Relying on times stored in browser history that are not representative of exact web page visit time"@en ;
    solveit-core:weaknessID "DFW-1245" ;
    solveit-core:weaknessName "Relying on times stored in browser history that are not representative of exact web page visit time" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasReference :citationDFCite-1050 .

:weaknessDFW-1246
    a solveit-core:Weakness ;
    rdfs:label "DFW-1246: Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database"@en ;
    solveit-core:weaknessID "DFW-1246" ;
    solveit-core:weaknessName "Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1193,
                                        :mitigationDFM-1194,
                                        :mitigationDFM-1195 .

:weaknessDFW-1247
    a solveit-core:Weakness ;
    rdfs:label "DFW-1247: Attributing saved browser bookmarks to a user but they were bundled with the browser installation"@en ;
    solveit-core:weaknessID "DFW-1247" ;
    solveit-core:weaknessName "Attributing saved browser bookmarks to a user but they were bundled with the browser installation" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS .

:weaknessDFW-1248
    a solveit-core:Weakness ;
    rdfs:label "DFW-1248: Missing browser downloads as the files were saved to a non-standard location"@en ;
    solveit-core:weaknessID "DFW-1248" ;
    solveit-core:weaknessName "Missing browser downloads as the files were saved to a non-standard location" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1249
    a solveit-core:Weakness ;
    rdfs:label "DFW-1249: Missing a web browser profile as it was stored outside of the usual browser profile folders"@en ;
    solveit-core:weaknessID "DFW-1249" ;
    solveit-core:weaknessName "Missing a web browser profile as it was stored outside of the usual browser profile folders" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1191 .

:weaknessDFW-1250
    a solveit-core:Weakness ;
    rdfs:label "DFW-1250: Incomplete browser activity extraction due to not considering the browser cache artifacts"@en ;
    solveit-core:weaknessID "DFW-1250" ;
    solveit-core:weaknessName "Incomplete browser activity extraction due to not considering the browser cache artifacts" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1187 .

:weaknessDFW-1251
    a solveit-core:Weakness ;
    rdfs:label "DFW-1251: Incomplete browser activity extraction due to failure to consider multiple profiles"@en ;
    solveit-core:weaknessID "DFW-1251" ;
    solveit-core:weaknessName "Incomplete browser activity extraction due to failure to consider multiple profiles" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1188 .

:weaknessDFW-1252
    a solveit-core:Weakness ;
    rdfs:label "DFW-1252: Assuming that data stored in the cache was viewed by the user"@en ;
    solveit-core:weaknessID "DFW-1252" ;
    solveit-core:weaknessName "Assuming that data stored in the cache was viewed by the user" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1189 ;
    solveit-core:hasReference :citationDFCite-1064 .

:weaknessDFW-1253
    a solveit-core:Weakness ;
    rdfs:label "DFW-1253: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information"@en ;
    solveit-core:weaknessID "DFW-1253" ;
    solveit-core:weaknessName "Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1079,
                                        :mitigationDFM-1080,
                                        :mitigationDFM-1081,
                                        :mitigationDFM-1083 .

:weaknessDFW-1254
    a solveit-core:Weakness ;
    rdfs:label "DFW-1254: Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information"@en ;
    solveit-core:weaknessID "DFW-1254" ;
    solveit-core:weaknessName "Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1079,
                                        :mitigationDFM-1080,
                                        :mitigationDFM-1081,
                                        :mitigationDFM-1196,
                                        :mitigationDFM-1197 .

:weaknessDFW-1255
    a solveit-core:Weakness ;
    rdfs:label "DFW-1255: Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL)"@en ;
    solveit-core:weaknessID "DFW-1255" ;
    solveit-core:weaknessName "Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL)" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1079,
                                        :mitigationDFM-1080,
                                        :mitigationDFM-1081,
                                        :mitigationDFM-1198,
                                        :mitigationDFM-1199,
                                        :mitigationDFM-1200 .

:weaknessDFW-1256
    a solveit-core:Weakness ;
    rdfs:label "DFW-1256: Incorrect attribution of metadata to file content that was the result of 'file tunnelling'"@en ;
    solveit-core:weaknessID "DFW-1256" ;
    solveit-core:weaknessName "Incorrect attribution of metadata to file content that was the result of 'file tunnelling'" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1079,
                                        :mitigationDFM-1080,
                                        :mitigationDFM-1081 .

:weaknessDFW-1257
    a solveit-core:Weakness ;
    rdfs:label "DFW-1257: Missing content that is relevant to a keyword search but it has not been extracted as 'artifacts'"@en ;
    solveit-core:weaknessID "DFW-1257" ;
    solveit-core:weaknessName "Missing content that is relevant to a keyword search but it has not been extracted as 'artifacts'" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1203,
                                        :mitigationDFM-1204 .

:weaknessDFW-1258
    a solveit-core:Weakness ;
    rdfs:label "DFW-1258: Failure to present uncertainty associated with automated interpretation of data into artifacts"@en ;
    solveit-core:weaknessID "DFW-1258" ;
    solveit-core:weaknessName "Failure to present uncertainty associated with automated interpretation of data into artifacts" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1206,
                                        :mitigationDFM-1207,
                                        :mitigationDFM-1208,
                                        :mitigationDFM-1209 .

:weaknessDFW-1259
    a solveit-core:Weakness ;
    rdfs:label "DFW-1259: Image format parsing fails to identify or assemble split forensic images"@en ;
    solveit-core:weaknessID "DFW-1259" ;
    solveit-core:weaknessName "Image format parsing fails to identify or assemble split forensic images" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_COR,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1004,
                                        :mitigationDFM-1009,
                                        :mitigationDFM-1210,
                                        :mitigationDFM-1211,
                                        :mitigationDFM-1212,
                                        :mitigationDFM-1213,
                                        :mitigationDFM-1214,
                                        :mitigationDFM-1215 .

:weaknessDFW-1260
    a solveit-core:Weakness ;
    rdfs:label "DFW-1260: Failure to derive clock offset due to inability to locate a suitable time anchor"@en ;
    solveit-core:weaknessID "DFW-1260" ;
    solveit-core:weaknessName "Failure to derive clock offset due to inability to locate a suitable time anchor" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1218,
                                        :mitigationDFM-1222 .

:weaknessDFW-1261
    a solveit-core:Weakness ;
    rdfs:label "DFW-1261: Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring"@en ;
    solveit-core:weaknessID "DFW-1261" ;
    solveit-core:weaknessName "Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1217,
                                        :mitigationDFM-1220 .

:weaknessDFW-1262
    a solveit-core:Weakness ;
    rdfs:label "DFW-1262: Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time"@en ;
    solveit-core:weaknessID "DFW-1262" ;
    solveit-core:weaknessName "Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1216 .

:weaknessDFW-1263
    a solveit-core:Weakness ;
    rdfs:label "DFW-1263: Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring"@en ;
    solveit-core:weaknessID "DFW-1263" ;
    solveit-core:weaknessName "Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1219,
                                        :mitigationDFM-1221 .

:weaknessDFW-1264
    a solveit-core:Weakness ;
    rdfs:label "DFW-1264: Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp"@en ;
    solveit-core:weaknessID "DFW-1264" ;
    solveit-core:weaknessName "Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1223,
                                        :mitigationDFM-1226 .

:weaknessDFW-1265
    a solveit-core:Weakness ;
    rdfs:label "DFW-1265: Offset applied to timestamp is incorrect due to variations in time zone over the history of data source"@en ;
    solveit-core:weaknessID "DFW-1265" ;
    solveit-core:weaknessName "Offset applied to timestamp is incorrect due to variations in time zone over the history of data source" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1224 .

:weaknessDFW-1266
    a solveit-core:Weakness ;
    rdfs:label "DFW-1266: Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings"@en ;
    solveit-core:weaknessID "DFW-1266" ;
    solveit-core:weaknessName "Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1101,
                                        :mitigationDFM-1224,
                                        :mitigationDFM-1229,
                                        :mitigationDFM-1230 .

:weaknessDFW-1267
    a solveit-core:Weakness ;
    rdfs:label "DFW-1267: Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source"@en ;
    solveit-core:weaknessID "DFW-1267" ;
    solveit-core:weaknessName "Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1225 .

:weaknessDFW-1268
    a solveit-core:Weakness ;
    rdfs:label "DFW-1268: Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used"@en ;
    solveit-core:weaknessID "DFW-1268" ;
    solveit-core:weaknessName "Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1224 .

:weaknessDFW-1269
    a solveit-core:Weakness ;
    rdfs:label "DFW-1269: Failure to apply time offset to a timeline entry"@en ;
    solveit-core:weaknessID "DFW-1269" ;
    solveit-core:weaknessName "Failure to apply time offset to a timeline entry" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_INCOMP,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1101 .

:weaknessDFW-1270
    a solveit-core:Weakness ;
    rdfs:label "DFW-1270: Inability to create a device backup due to locked device"@en ;
    solveit-core:weaknessID "DFW-1270" ;
    solveit-core:weaknessName "Inability to create a device backup due to locked device" ;
    solveit-core:weaknessDescription "In most cases to create a backup the passcode must be provided to unlock the device." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1097,
                                        :mitigationDFM-1234,
                                        :mitigationDFM-1235,
                                        :mitigationDFM-1236 .

:weaknessDFW-1271
    a solveit-core:Weakness ;
    rdfs:label "DFW-1271: Inability to access required service as it is not enabled"@en ;
    solveit-core:weaknessID "DFW-1271" ;
    solveit-core:weaknessName "Inability to access required service as it is not enabled" ;
    solveit-core:weaknessDescription "For example, Developer Mode may not be enabled on an Android device, or iOS services stopped due to USB Restricted Mode" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1232 ;
    solveit-core:hasReference :citationDFCite-1004,
                              :citationDFCite-1015 .

:weaknessDFW-1272
    a solveit-core:Weakness ;
    rdfs:label "DFW-1272: Failure to preserve all relevant timestamps of files obtained using exposed services on a device"@en ;
    solveit-core:weaknessID "DFW-1272" ;
    solveit-core:weaknessName "Failure to preserve all relevant timestamps of files obtained using exposed services on a device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1233 .

:weaknessDFW-1273
    a solveit-core:Weakness ;
    rdfs:label "DFW-1273: Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device"@en ;
    solveit-core:weaknessID "DFW-1273" ;
    solveit-core:weaknessName "Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1233 .

:weaknessDFW-1274
    a solveit-core:Weakness ;
    rdfs:label "DFW-1274: Inability to enable required service due to locked device"@en ;
    solveit-core:weaknessID "DFW-1274" ;
    solveit-core:weaknessName "Inability to enable required service due to locked device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1097,
                                        :mitigationDFM-1234,
                                        :mitigationDFM-1235,
                                        :mitigationDFM-1236,
                                        :mitigationDFM-1239 .

:weaknessDFW-1275
    a solveit-core:Weakness ;
    rdfs:label "DFW-1275: Failure to store data due to size limitations of archive format used"@en ;
    solveit-core:weaknessID "DFW-1275" ;
    solveit-core:weaknessName "Failure to store data due to size limitations of archive format used" ;
    solveit-core:weaknessDescription "Some archive file formats have limitations on the size of files that can be contained within them (Wikipedia 2026). If this is not considered and compensated for then large files that need to be stored may be skipped or cause other errors." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1237 ;
    solveit-core:hasReference :citationDFCite-1130 .

:weaknessDFW-1276
    a solveit-core:Weakness ;
    rdfs:label "DFW-1276: Relevant data is overwritten by deploying an agent to a mobile device"@en ;
    solveit-core:weaknessID "DFW-1276" ;
    solveit-core:weaknessName "Relevant data is overwritten by deploying an agent to a mobile device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1014 .

:weaknessDFW-1277
    a solveit-core:Weakness ;
    rdfs:label "DFW-1277: Connection over a direct media interface causes changes to the target media"@en ;
    solveit-core:weaknessID "DFW-1277" ;
    solveit-core:weaknessName "Connection over a direct media interface causes changes to the target media" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_COR,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1008,
                                        :mitigationDFM-1241 .

:weaknessDFW-1278
    a solveit-core:Weakness ;
    rdfs:label "DFW-1278: Data copied does not include all sectors from LBA0 to LBA max due to the data copying process skipping some sectors or bytes"@en ;
    solveit-core:weaknessID "DFW-1278" ;
    solveit-core:weaknessName "Data copied does not include all sectors from LBA0 to LBA max due to the data copying process skipping some sectors or bytes" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1003,
                                        :mitigationDFM-1004,
                                        :mitigationDFM-1331 .

:weaknessDFW-1279
    a solveit-core:Weakness ;
    rdfs:label "DFW-1279: Failure to recover live message from a multiplayer gaming app"@en ;
    solveit-core:weaknessID "DFW-1279" ;
    solveit-core:weaknessName "Failure to recover live message from a multiplayer gaming app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1242,
                                        :mitigationDFM-1243 .

:weaknessDFW-1280
    a solveit-core:Weakness ;
    rdfs:label "DFW-1280: Presenting a live contact from a gaming app as a deleted one or vice versa"@en ;
    solveit-core:weaknessID "DFW-1280" ;
    solveit-core:weaknessName "Presenting a live contact from a gaming app as a deleted one or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1243,
                                        :mitigationDFM-1244,
                                        :mitigationDFM-1245 .

:weaknessDFW-1281
    a solveit-core:Weakness ;
    rdfs:label "DFW-1281: Failure to recover the gaming app configuration"@en ;
    solveit-core:weaknessID "DFW-1281" ;
    solveit-core:weaknessName "Failure to recover the gaming app configuration" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1247 .

:weaknessDFW-1282
    a solveit-core:Weakness ;
    rdfs:label "DFW-1282: Recovering the gaming app configuration incorrectly"@en ;
    solveit-core:weaknessID "DFW-1282" ;
    solveit-core:weaknessName "Recovering the gaming app configuration incorrectly" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1247 .

:weaknessDFW-1283
    a solveit-core:Weakness ;
    rdfs:label "DFW-1283: Failure to recover a live account used in a gaming application"@en ;
    solveit-core:weaknessID "DFW-1283" ;
    solveit-core:weaknessName "Failure to recover a live account used in a gaming application" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1248 .

:weaknessDFW-1284
    a solveit-core:Weakness ;
    rdfs:label "DFW-1284: Failure to recover a previous but removed account used in a gaming application"@en ;
    solveit-core:weaknessID "DFW-1284" ;
    solveit-core:weaknessName "Failure to recover a previous but removed account used in a gaming application" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1249 .

:weaknessDFW-1285
    a solveit-core:Weakness ;
    rdfs:label "DFW-1285: Recovering an account used for a gaming application that was not actually used"@en ;
    solveit-core:weaknessID "DFW-1285" ;
    solveit-core:weaknessName "Recovering an account used for a gaming application that was not actually used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1050,
                                        :mitigationDFM-1248 .

:weaknessDFW-1286
    a solveit-core:Weakness ;
    rdfs:label "DFW-1286: Describing a live gaming app account as deleted/removed or vice versa"@en ;
    solveit-core:weaknessID "DFW-1286" ;
    solveit-core:weaknessName "Describing a live gaming app account as deleted/removed or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1248,
                                        :mitigationDFM-1249 .

:weaknessDFW-1287
    a solveit-core:Weakness ;
    rdfs:label "DFW-1287: Failure to recover deleted message from a multiplayer gaming app"@en ;
    solveit-core:weaknessID "DFW-1287" ;
    solveit-core:weaknessName "Failure to recover deleted message from a multiplayer gaming app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1243,
                                        :mitigationDFM-1244 .

:weaknessDFW-1288
    a solveit-core:Weakness ;
    rdfs:label "DFW-1288: Presenting a live message from a gaming app that does not exist"@en ;
    solveit-core:weaknessID "DFW-1288" ;
    solveit-core:weaknessName "Presenting a live message from a gaming app that does not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1242,
                                        :mitigationDFM-1243 .

:weaknessDFW-1289
    a solveit-core:Weakness ;
    rdfs:label "DFW-1289: Presenting a deleted message from a gaming app that does not exist"@en ;
    solveit-core:weaknessID "DFW-1289" ;
    solveit-core:weaknessName "Presenting a deleted message from a gaming app that does not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1243,
                                        :mitigationDFM-1244 .

:weaknessDFW-1290
    a solveit-core:Weakness ;
    rdfs:label "DFW-1290: Presenting a live message from a gaming app as deleted or vice versa"@en ;
    solveit-core:weaknessID "DFW-1290" ;
    solveit-core:weaknessName "Presenting a live message from a gaming app as deleted or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1242,
                                        :mitigationDFM-1243,
                                        :mitigationDFM-1244 .

:weaknessDFW-1291
    a solveit-core:Weakness ;
    rdfs:label "DFW-1291: Failure to recover a live contact from a gaming app"@en ;
    solveit-core:weaknessID "DFW-1291" ;
    solveit-core:weaknessName "Failure to recover a live contact from a gaming app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1243,
                                        :mitigationDFM-1245 .

:weaknessDFW-1292
    a solveit-core:Weakness ;
    rdfs:label "DFW-1292: Failure to recover a deleted contact from a gaming app"@en ;
    solveit-core:weaknessID "DFW-1292" ;
    solveit-core:weaknessName "Failure to recover a deleted contact from a gaming app" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1243,
                                        :mitigationDFM-1246 .

:weaknessDFW-1293
    a solveit-core:Weakness ;
    rdfs:label "DFW-1293: Presenting a live contact from a gaming app that does not exist"@en ;
    solveit-core:weaknessID "DFW-1293" ;
    solveit-core:weaknessName "Presenting a live contact from a gaming app that does not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1243,
                                        :mitigationDFM-1245 .

:weaknessDFW-1294
    a solveit-core:Weakness ;
    rdfs:label "DFW-1294: Presenting a deleted contact from a gaming app that does not exist"@en ;
    solveit-core:weaknessID "DFW-1294" ;
    solveit-core:weaknessName "Presenting a deleted contact from a gaming app that does not exist" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1243,
                                        :mitigationDFM-1246 .

:weaknessDFW-1295
    a solveit-core:Weakness ;
    rdfs:label "DFW-1295: The filtered timeline misses relevant entries because filtering criteria was too strict"@en ;
    solveit-core:weaknessID "DFW-1295" ;
    solveit-core:weaknessName "The filtered timeline misses relevant entries because filtering criteria was too strict" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INCOMP .

:weaknessDFW-1296
    a solveit-core:Weakness ;
    rdfs:label "DFW-1296: The filtered timeline misses relevant entries because the tool did not filter correctly"@en ;
    solveit-core:weaknessID "DFW-1296" ;
    solveit-core:weaknessName "The filtered timeline misses relevant entries because the tool did not filter correctly" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1250 .

:weaknessDFW-1297
    a solveit-core:Weakness ;
    rdfs:label "DFW-1297: The filtered timeline includes entries that are not relevant because the filtering criteria was too broad"@en ;
    solveit-core:weaknessID "DFW-1297" ;
    solveit-core:weaknessName "The filtered timeline includes entries that are not relevant because the filtering criteria was too broad" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1251,
                                        :mitigationDFM-1252 .

:weaknessDFW-1298
    a solveit-core:Weakness ;
    rdfs:label "DFW-1298: The filtered timeline includes entries that are not relevant because the tool did not filter correctly"@en ;
    solveit-core:weaknessID "DFW-1298" ;
    solveit-core:weaknessName "The filtered timeline includes entries that are not relevant because the tool did not filter correctly" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1250 .

:weaknessDFW-1299
    a solveit-core:Weakness ;
    rdfs:label "DFW-1299: A filtered timeline is presented as a full timeline"@en ;
    solveit-core:weaknessID "DFW-1299" ;
    solveit-core:weaknessName "A filtered timeline is presented as a full timeline" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1253 .

:weaknessDFW-1300
    a solveit-core:Weakness ;
    rdfs:label "DFW-1300: Missing deleted but recoverable volumes from unpartitioned space"@en ;
    solveit-core:weaknessID "DFW-1300" ;
    solveit-core:weaknessName "Missing deleted but recoverable volumes from unpartitioned space" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1044 .

:weaknessDFW-1308
    a solveit-core:Weakness ;
    rdfs:label "DFW-1308: Sorted timeline is missing timeline entries due to tool error during sort process"@en ;
    solveit-core:weaknessID "DFW-1308" ;
    solveit-core:weaknessName "Sorted timeline is missing timeline entries due to tool error during sort process" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1259,
                                        :mitigationDFM-1268,
                                        :mitigationDFM-1269 .

:weaknessDFW-1309
    a solveit-core:Weakness ;
    rdfs:label "DFW-1309: Sorted timeline is missing timeline entries because timeline contained entries not based on timestamps"@en ;
    solveit-core:weaknessID "DFW-1309" ;
    solveit-core:weaknessName "Sorted timeline is missing timeline entries because timeline contained entries not based on timestamps" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1260 .

:weaknessDFW-1310
    a solveit-core:Weakness ;
    rdfs:label "DFW-1310: Sorted timeline has additional timeline entries due to tool error during sort process"@en ;
    solveit-core:weaknessID "DFW-1310" ;
    solveit-core:weaknessName "Sorted timeline has additional timeline entries due to tool error during sort process" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1259 .

:weaknessDFW-1311
    a solveit-core:Weakness ;
    rdfs:label "DFW-1311: Timeline entry is in an incorrect sequence due to resolution of the timestamp used"@en ;
    solveit-core:weaknessID "DFW-1311" ;
    solveit-core:weaknessName "Timeline entry is in an incorrect sequence due to resolution of the timestamp used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1261,
                                        :mitigationDFM-1262 ;
    solveit-core:hasReference :citationDFCite-1019 .

:weaknessDFW-1312
    a solveit-core:Weakness ;
    rdfs:label "DFW-1312: Timeline entry is in an incorrect sequence due to underlying timestamp being based on an incorrect clock"@en ;
    solveit-core:weaknessID "DFW-1312" ;
    solveit-core:weaknessName "Timeline entry is in an incorrect sequence due to underlying timestamp being based on an incorrect clock" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1225 ;
    solveit-core:hasReference :citationDFCite-1019,
                              :citationDFCite-1020 .

:weaknessDFW-1313
    a solveit-core:Weakness ;
    rdfs:label "DFW-1313: Timeline entry is in an incorrect sequence due to timezone already applied to timestamp"@en ;
    solveit-core:weaknessID "DFW-1313" ;
    solveit-core:weaknessName "Timeline entry is in an incorrect sequence due to timezone already applied to timestamp" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1263 .

:weaknessDFW-1314
    a solveit-core:Weakness ;
    rdfs:label "DFW-1314: Timeline entry is in an incorrect sequence due to a time offset being applied that is incorrect for the timeline entry"@en ;
    solveit-core:weaknessID "DFW-1314" ;
    solveit-core:weaknessName "Timeline entry is in an incorrect sequence due to a time offset being applied that is incorrect for the timeline entry" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1225 .

:weaknessDFW-1315
    a solveit-core:Weakness ;
    rdfs:label "DFW-1315: Failure to recover a notification due to not attempting to parse the relevant data"@en ;
    solveit-core:weaknessID "DFW-1315" ;
    solveit-core:weaknessName "Failure to recover a notification due to not attempting to parse the relevant data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1264 .

:weaknessDFW-1316
    a solveit-core:Weakness ;
    rdfs:label "DFW-1316: Failure to recover a notification due to a tool error parsing the relevant data"@en ;
    solveit-core:weaknessID "DFW-1316" ;
    solveit-core:weaknessName "Failure to recover a notification due to a tool error parsing the relevant data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1265 .

:weaknessDFW-1317
    a solveit-core:Weakness ;
    rdfs:label "DFW-1317: Failure to recover a notification due to it being deleted because of the expiry time set"@en ;
    solveit-core:weaknessID "DFW-1317" ;
    solveit-core:weaknessName "Failure to recover a notification due to it being deleted because of the expiry time set" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1125,
                                        :mitigationDFM-1266 .

:weaknessDFW-1318
    a solveit-core:Weakness ;
    rdfs:label "DFW-1318: Failure to recover a notification due to it being deleted because of it being viewed and cleared"@en ;
    solveit-core:weaknessID "DFW-1318" ;
    solveit-core:weaknessName "Failure to recover a notification due to it being deleted because of it being viewed and cleared" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1125,
                                        :mitigationDFM-1266 .

:weaknessDFW-1319
    a solveit-core:Weakness ;
    rdfs:label "DFW-1319: Associating a notification with an incorrect application due to tool error"@en ;
    solveit-core:weaknessID "DFW-1319" ;
    solveit-core:weaknessName "Associating a notification with an incorrect application due to tool error" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1265 .

:weaknessDFW-1320
    a solveit-core:Weakness ;
    rdfs:label "DFW-1320: Failure to extract the creation time of a notification due to tool error"@en ;
    solveit-core:weaknessID "DFW-1320" ;
    solveit-core:weaknessName "Failure to extract the creation time of a notification due to tool error" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1267 .

:weaknessDFW-1321
    a solveit-core:Weakness ;
    rdfs:label "DFW-1321: Presenting the incorrect time for a notification due to tool error"@en ;
    solveit-core:weaknessID "DFW-1321" ;
    solveit-core:weaknessName "Presenting the incorrect time for a notification due to tool error" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1267 .

:weaknessDFW-1324
    a solveit-core:Weakness ;
    rdfs:label "DFW-1324: Failure to extract the operating system version due to a tool accessing the wrong artifact"@en ;
    solveit-core:weaknessID "DFW-1324" ;
    solveit-core:weaknessName "Failure to extract the operating system version due to a tool accessing the wrong artifact" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1272 .

:weaknessDFW-1325
    a solveit-core:Weakness ;
    rdfs:label "DFW-1325: Failure to extract the operating system version because a tool parses the relevant artefact incorrectly"@en ;
    solveit-core:weaknessID "DFW-1325" ;
    solveit-core:weaknessName "Failure to extract the operating system version because a tool parses the relevant artefact incorrectly" ;
    solveit-core:weaknessDescription "This weakness captures failing to extract a version at all, contrasted with extracting an incorrect version covered elsewhere. " ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1272 .

:weaknessDFW-1326
    a solveit-core:Weakness ;
    rdfs:label "DFW-1326: Extracting an incorrect operating system version because a tool uses an incorrect or outdated artifact"@en ;
    solveit-core:weaknessID "DFW-1326" ;
    solveit-core:weaknessName "Extracting an incorrect operating system version because a tool uses an incorrect or outdated artifact" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1272 .

:weaknessDFW-1327
    a solveit-core:Weakness ;
    rdfs:label "DFW-1327: Extracting an incorrect operating system version because a tool parses the relevant artefact incorrectly"@en ;
    solveit-core:weaknessID "DFW-1327" ;
    solveit-core:weaknessName "Extracting an incorrect operating system version because a tool parses the relevant artefact incorrectly" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1272 .

:weaknessDFW-1328
    a solveit-core:Weakness ;
    rdfs:label "DFW-1328: Extracting a previous operating system version as if it were the current because a tool uses an incorrect or outdated artifact"@en ;
    solveit-core:weaknessID "DFW-1328" ;
    solveit-core:weaknessName "Extracting a previous operating system version as if it were the current because a tool uses an incorrect or outdated artifact" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1272 .

:weaknessDFW-1329
    a solveit-core:Weakness ;
    rdfs:label "DFW-1329: Failure to highlight previous versions of the operating system that were used on the device"@en ;
    solveit-core:weaknessID "DFW-1329" ;
    solveit-core:weaknessName "Failure to highlight previous versions of the operating system that were used on the device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1273 .

:weaknessDFW-1330
    a solveit-core:Weakness ;
    rdfs:label "DFW-1330: Failure to recover an allocated Registry key because of a parsing error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1330" ;
    solveit-core:weaknessName "Failure to recover an allocated Registry key because of a parsing error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1274 .

:weaknessDFW-1331
    a solveit-core:Weakness ;
    rdfs:label "DFW-1331: Failure to recover last modified time associated with an allocated Registry key because of a parsing error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1331" ;
    solveit-core:weaknessName "Failure to recover last modified time associated with an allocated Registry key because of a parsing error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1274 .

:weaknessDFW-1332
    a solveit-core:Weakness ;
    rdfs:label "DFW-1332: Presenting an allocated Registry key that does not exist because of a parsing error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1332" ;
    solveit-core:weaknessName "Presenting an allocated Registry key that does not exist because of a parsing error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1274 .

:weaknessDFW-1333
    a solveit-core:Weakness ;
    rdfs:label "DFW-1333: Mapping an allocated Registry key to an incorrect point in the Registry tree structure because of a parsing error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1333" ;
    solveit-core:weaknessName "Mapping an allocated Registry key to an incorrect point in the Registry tree structure because of a parsing error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1274 .

:weaknessDFW-1334
    a solveit-core:Weakness ;
    rdfs:label "DFW-1334: Failure to recover allocated values associated with a Registry key because of a parsing error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1334" ;
    solveit-core:weaknessName "Failure to recover allocated values associated with a Registry key because of a parsing error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1274 .

:weaknessDFW-1335
    a solveit-core:Weakness ;
    rdfs:label "DFW-1335: Presenting an allocated Registry value that does not exist because of a parsing error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1335" ;
    solveit-core:weaknessName "Presenting an allocated Registry value that does not exist because of a parsing error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1274 .

:weaknessDFW-1336
    a solveit-core:Weakness ;
    rdfs:label "DFW-1336: Associating an allocated Registry value with an incorrect key because of a parsing error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1336" ;
    solveit-core:weaknessName "Associating an allocated Registry value with an incorrect key because of a parsing error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1274 .

:weaknessDFW-1337
    a solveit-core:Weakness ;
    rdfs:label "DFW-1337: Presenting an allocated Registry key's modification time as the modification time for a specific value."@en ;
    solveit-core:weaknessID "DFW-1337" ;
    solveit-core:weaknessName "Presenting an allocated Registry key's modification time as the modification time for a specific value." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1275 .

:weaknessDFW-1338
    a solveit-core:Weakness ;
    rdfs:label "DFW-1338: Failing to acquire data due to omission of undocumented endpoints"@en ;
    solveit-core:weaknessID "DFW-1338" ;
    solveit-core:weaknessName "Failing to acquire data due to omission of undocumented endpoints" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1276,
                                        :mitigationDFM-1277 ;
    solveit-core:hasReference :citationDFCite-1159 .

:weaknessDFW-1339
    a solveit-core:Weakness ;
    rdfs:label "DFW-1339: Failing to acquire data because of filtering"@en ;
    solveit-core:weaknessID "DFW-1339" ;
    solveit-core:weaknessName "Failing to acquire data because of filtering" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1276,
                                        :mitigationDFM-1277 ;
    solveit-core:hasReference :citationDFCite-1159 .

:weaknessDFW-1340
    a solveit-core:Weakness ;
    rdfs:label "DFW-1340: Data on a mobile device is overwritten because not all relevant connectivity settings were configured correctly"@en ;
    solveit-core:weaknessID "DFW-1340" ;
    solveit-core:weaknessName "Data on a mobile device is overwritten because not all relevant connectivity settings were configured correctly" ;
    solveit-core:weaknessDescription "This might include setting airplane mode only rather than WiFi and/or Bluetooth separately. This would also include the extreme case of a remote wipe being performed" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1278,
                                        :mitigationDFM-1279 .

:weaknessDFW-1341
    a solveit-core:Weakness ;
    rdfs:label "DFW-1341: Data on a mobile device is overwritten because the connectivity settings were subsequently reset by an automated process"@en ;
    solveit-core:weaknessID "DFW-1341" ;
    solveit-core:weaknessName "Data on a mobile device is overwritten because the connectivity settings were subsequently reset by an automated process" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1278 .

:weaknessDFW-1342
    a solveit-core:Weakness ;
    rdfs:label "DFW-1342: Data is added to a mobile device because not all relevant connectivity settings were configured correctly"@en ;
    solveit-core:weaknessID "DFW-1342" ;
    solveit-core:weaknessName "Data is added to a mobile device because not all relevant connectivity settings were configured correctly" ;
    solveit-core:weaknessDescription "Data on a mobile device is added post-seizure because not all relevant connectivity settings were configured correctly" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1278,
                                        :mitigationDFM-1279 .

:weaknessDFW-1343
    a solveit-core:Weakness ;
    rdfs:label "DFW-1343: Data is added to a mobile device because the connectivity settings were subsequently reset by an automated process"@en ;
    solveit-core:weaknessID "DFW-1343" ;
    solveit-core:weaknessName "Data is added to a mobile device because the connectivity settings were subsequently reset by an automated process" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1278 .

:weaknessDFW-1344
    a solveit-core:Weakness ;
    rdfs:label "DFW-1344: The case number is not retrieved from the metadata inside a forensic container because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1344" ;
    solveit-core:weaknessName "The case number is not retrieved from the metadata inside a forensic container because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027 .

:weaknessDFW-1345
    a solveit-core:Weakness ;
    rdfs:label "DFW-1345: The case description retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1345" ;
    solveit-core:weaknessName "The case description retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1280 .

:weaknessDFW-1346
    a solveit-core:Weakness ;
    rdfs:label "DFW-1346: The cryptographic hash is not retrieved from the metadata inside a forensic container because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1346" ;
    solveit-core:weaknessName "The cryptographic hash is not retrieved from the metadata inside a forensic container because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027 .

:weaknessDFW-1347
    a solveit-core:Weakness ;
    rdfs:label "DFW-1347: The cryptographic hash retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1347" ;
    solveit-core:weaknessName "The cryptographic hash retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1281 .

:weaknessDFW-1348
    a solveit-core:Weakness ;
    rdfs:label "DFW-1348: The case number retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1348" ;
    solveit-core:weaknessName "The case number retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1280 .

:weaknessDFW-1349
    a solveit-core:Weakness ;
    rdfs:label "DFW-1349: The evidence number is not retrieved from the metadata inside a forensic container because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1349" ;
    solveit-core:weaknessName "The evidence number is not retrieved from the metadata inside a forensic container because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027 .

:weaknessDFW-1350
    a solveit-core:Weakness ;
    rdfs:label "DFW-1350: The evidence number retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1350" ;
    solveit-core:weaknessName "The evidence number retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1280 .

:weaknessDFW-1351
    a solveit-core:Weakness ;
    rdfs:label "DFW-1351: The examiner name is not retrieved from the metadata inside a forensic container because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1351" ;
    solveit-core:weaknessName "The examiner name is not retrieved from the metadata inside a forensic container because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027 .

:weaknessDFW-1352
    a solveit-core:Weakness ;
    rdfs:label "DFW-1352: The examiner name retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1352" ;
    solveit-core:weaknessName "The examiner name retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1280 .

:weaknessDFW-1353
    a solveit-core:Weakness ;
    rdfs:label "DFW-1353: The notes field is not retrieved from the metadata inside a forensic container because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1353" ;
    solveit-core:weaknessName "The notes field is not retrieved from the metadata inside a forensic container because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027 .

:weaknessDFW-1354
    a solveit-core:Weakness ;
    rdfs:label "DFW-1354: The notes field retrieved from the metadata inside a forensic container are incorrect because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1354" ;
    solveit-core:weaknessName "The notes field retrieved from the metadata inside a forensic container are incorrect because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1280 .

:weaknessDFW-1355
    a solveit-core:Weakness ;
    rdfs:label "DFW-1355: The case description is not retrieved from the metadata inside a forensic container because of a programming error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1355" ;
    solveit-core:weaknessName "The case description is not retrieved from the metadata inside a forensic container because of a programming error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027 .

:weaknessDFW-1356
    a solveit-core:Weakness ;
    rdfs:label "DFW-1356: Failing to acquire data due to omission of undocumented endpoints"@en ;
    solveit-core:weaknessID "DFW-1356" ;
    solveit-core:weaknessName "Failing to acquire data due to omission of undocumented endpoints" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1276,
                                        :mitigationDFM-1277 ;
    solveit-core:hasReference :citationDFCite-1159 .

:weaknessDFW-1357
    a solveit-core:Weakness ;
    rdfs:label "DFW-1357: Failing to acquire data because of timeout"@en ;
    solveit-core:weaknessID "DFW-1357" ;
    solveit-core:weaknessName "Failing to acquire data because of timeout" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1296 .

:weaknessDFW-1358
    a solveit-core:Weakness ;
    rdfs:label "DFW-1358: Failing to acquire data because historical records were not acquired"@en ;
    solveit-core:weaknessID "DFW-1358" ;
    solveit-core:weaknessName "Failing to acquire data because historical records were not acquired" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1297 .

:weaknessDFW-1359
    a solveit-core:Weakness ;
    rdfs:label "DFW-1359: Failing to acquire data because of truncation during format conversions"@en ;
    solveit-core:weaknessID "DFW-1359" ;
    solveit-core:weaknessName "Failing to acquire data because of truncation during format conversions" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1283,
                                        :mitigationDFM-1298 .

:weaknessDFW-1360
    a solveit-core:Weakness ;
    rdfs:label "DFW-1360: Failing to acquire data because historical records were lost during format conversions"@en ;
    solveit-core:weaknessID "DFW-1360" ;
    solveit-core:weaknessName "Failing to acquire data because historical records were lost during format conversions" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1297,
                                        :mitigationDFM-1298 .

:weaknessDFW-1361
    a solveit-core:Weakness ;
    rdfs:label "DFW-1361: Failing to acquire data because of provider-side outages or interruptions"@en ;
    solveit-core:weaknessID "DFW-1361" ;
    solveit-core:weaknessName "Failing to acquire data because of provider-side outages or interruptions" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1296 .

:weaknessDFW-1362
    a solveit-core:Weakness ;
    rdfs:label "DFW-1362: Failing to acquire data because of client-side network outages or interruptions"@en ;
    solveit-core:weaknessID "DFW-1362" ;
    solveit-core:weaknessName "Failing to acquire data because of client-side network outages or interruptions" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1296 .

:weaknessDFW-1363
    a solveit-core:Weakness ;
    rdfs:label "DFW-1363: Failing to acquire data because of acquisition tool misconfigurations"@en ;
    solveit-core:weaknessID "DFW-1363" ;
    solveit-core:weaknessName "Failing to acquire data because of acquisition tool misconfigurations" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1284 .

:weaknessDFW-1364
    a solveit-core:Weakness ;
    rdfs:label "DFW-1364: Failing to acquire data because of acquisition tool bugs or limitations"@en ;
    solveit-core:weaknessID "DFW-1364" ;
    solveit-core:weaknessName "Failing to acquire data because of acquisition tool bugs or limitations" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1285 .

:weaknessDFW-1365
    a solveit-core:Weakness ;
    rdfs:label "DFW-1365: Failing to acquire data because of acquisition of non-production environment\""@en ;
    solveit-core:weaknessID "DFW-1365" ;
    solveit-core:weaknessName "Failing to acquire data because of acquisition of non-production environment\"" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1286,
                                        :mitigationDFM-1287 .

:weaknessDFW-1366
    a solveit-core:Weakness ;
    rdfs:label "DFW-1366: Inaccurate information collected resulting from data format conversions"@en ;
    solveit-core:weaknessID "DFW-1366" ;
    solveit-core:weaknessName "Inaccurate information collected resulting from data format conversions" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT .

:weaknessDFW-1367
    a solveit-core:Weakness ;
    rdfs:label "DFW-1367: Failing to acquire data because of filtering"@en ;
    solveit-core:weaknessID "DFW-1367" ;
    solveit-core:weaknessName "Failing to acquire data because of filtering" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1050,
                                        :mitigationDFM-1276,
                                        :mitigationDFM-1277 ;
    solveit-core:hasReference :citationDFCite-1159 .

:weaknessDFW-1368
    a solveit-core:Weakness ;
    rdfs:label "DFW-1368: Inaccurate information collected resulting from timestamp format conversions"@en ;
    solveit-core:weaknessID "DFW-1368" ;
    solveit-core:weaknessName "Inaccurate information collected resulting from timestamp format conversions" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT .

:weaknessDFW-1369
    a solveit-core:Weakness ;
    rdfs:label "DFW-1369: Failing to acquire data structure because metadata and relationships were not acquired"@en ;
    solveit-core:weaknessID "DFW-1369" ;
    solveit-core:weaknessName "Failing to acquire data structure because metadata and relationships were not acquired" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1288 .

:weaknessDFW-1370
    a solveit-core:Weakness ;
    rdfs:label "DFW-1370: Failing to acquire cloud service logs because they are stored separately from data"@en ;
    solveit-core:weaknessID "DFW-1370" ;
    solveit-core:weaknessName "Failing to acquire cloud service logs because they are stored separately from data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1289,
                                        :mitigationDFM-1290 .

:weaknessDFW-1371
    a solveit-core:Weakness ;
    rdfs:label "DFW-1371: Failing to acquire data because an outdated API was used"@en ;
    solveit-core:weaknessID "DFW-1371" ;
    solveit-core:weaknessName "Failing to acquire data because an outdated API was used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1282 .

:weaknessDFW-1372
    a solveit-core:Weakness ;
    rdfs:label "DFW-1372: Failing to acquire data because an outdated or incomplete schema was used"@en ;
    solveit-core:weaknessID "DFW-1372" ;
    solveit-core:weaknessName "Failing to acquire data because an outdated or incomplete schema was used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1291 .

:weaknessDFW-1373
    a solveit-core:Weakness ;
    rdfs:label "DFW-1373: Failing to acquire data because of provider-side API limiting or throttling"@en ;
    solveit-core:weaknessID "DFW-1373" ;
    solveit-core:weaknessName "Failing to acquire data because of provider-side API limiting or throttling" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1292,
                                        :mitigationDFM-1293 .

:weaknessDFW-1374
    a solveit-core:Weakness ;
    rdfs:label "DFW-1374: Failing to acquire data because of client-side API limiting or throttling"@en ;
    solveit-core:weaknessID "DFW-1374" ;
    solveit-core:weaknessName "Failing to acquire data because of client-side API limiting or throttling" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1292 .

:weaknessDFW-1375
    a solveit-core:Weakness ;
    rdfs:label "DFW-1375: Failing to acquire data because of errors accessing cloud service"@en ;
    solveit-core:weaknessID "DFW-1375" ;
    solveit-core:weaknessName "Failing to acquire data because of errors accessing cloud service" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1137 .

:weaknessDFW-1376
    a solveit-core:Weakness ;
    rdfs:label "DFW-1376: Failing to acquire data because credentials used do not have sufficient permissions"@en ;
    solveit-core:weaknessID "DFW-1376" ;
    solveit-core:weaknessName "Failing to acquire data because credentials used do not have sufficient permissions" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1294 .

:weaknessDFW-1377
    a solveit-core:Weakness ;
    rdfs:label "DFW-1377: Failing to acquire data because credentials used have expired or were revoked"@en ;
    solveit-core:weaknessID "DFW-1377" ;
    solveit-core:weaknessName "Failing to acquire data because credentials used have expired or were revoked" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1295 .

:weaknessDFW-1378
    a solveit-core:Weakness ;
    rdfs:label "DFW-1378: Relevant keywords not returned by live search due to improper handling of character encoding"@en ;
    solveit-core:weaknessID "DFW-1378" ;
    solveit-core:weaknessName "Relevant keywords not returned by live search due to improper handling of character encoding" ;
    solveit-core:weaknessDescription "Keyword searching (live) does not handle character encoding properly, causing search terms to miss content and fail to find relevant data (false negative)." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1027,
                                        :mitigationDFM-1034 .

:weaknessDFW-1379
    a solveit-core:Weakness ;
    rdfs:label "DFW-1379: One or more proposed hypotheses are not mutually exclusive"@en ;
    solveit-core:weaknessID "DFW-1379" ;
    solveit-core:weaknessName "One or more proposed hypotheses are not mutually exclusive" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1300 .

:weaknessDFW-1380
    a solveit-core:Weakness ;
    rdfs:label "DFW-1380: A proposed hypothesis suffers from a lack of falsifiability"@en ;
    solveit-core:weaknessID "DFW-1380" ;
    solveit-core:weaknessName "A proposed hypothesis suffers from a lack of falsifiability" ;
    solveit-core:weaknessDescription "A scientifically valid hypothesis must present an outcome that can be definitively proven false." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1301 .

:weaknessDFW-1381
    a solveit-core:Weakness ;
    rdfs:label "DFW-1381: A proposed hypothesis equates correlation with causation"@en ;
    solveit-core:weaknessID "DFW-1381" ;
    solveit-core:weaknessName "A proposed hypothesis equates correlation with causation" ;
    solveit-core:weaknessDescription "Causal mechanisms are not explicitly established" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1302 .

:weaknessDFW-1382
    a solveit-core:Weakness ;
    rdfs:label "DFW-1382: A hypothesis refers to \"device user\" rather than \"suspect\" when a specific individual is under investigation"@en ;
    solveit-core:weaknessID "DFW-1382" ;
    solveit-core:weaknessName "A hypothesis refers to \"device user\" rather than \"suspect\" when a specific individual is under investigation" ;
    solveit-core:weaknessDescription "When a specific individual is under investigation, address this fact. If the individual's use of a device is challenged, this should be explicitly addressed in hypothesis generation." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1303 .

:weaknessDFW-1383
    a solveit-core:Weakness ;
    rdfs:label "DFW-1383: A proposed hypothesis uses judgmental or loaded terminology"@en ;
    solveit-core:weaknessID "DFW-1383" ;
    solveit-core:weaknessName "A proposed hypothesis uses judgmental or loaded terminology" ;
    solveit-core:weaknessDescription "Judgmental or loaded terminology is outside the scope of digital forensics and could reflect bias" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1304 .

:weaknessDFW-1384
    a solveit-core:Weakness ;
    rdfs:label "DFW-1384: Addressing the wrong level of the hierarchy of hypotheses required for the case"@en ;
    solveit-core:weaknessID "DFW-1384" ;
    solveit-core:weaknessName "Addressing the wrong level of the hierarchy of hypotheses required for the case" ;
    solveit-core:weaknessDescription "The hierarchy of hypotheses (a.k.a. hierarchy of propositions) are: 1) source level concerns where a trace came from (e.g., which device produced contraband), 2) activity level concerns what act produced it (e.g., who produced contraband), and 3) offense level concerns the criminal issue itself (e.g., whether the suspect knowingly produced contraband) — with higher levels being more relevant to decision-makers but requiring more case information to evaluate." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1305 .

:weaknessDFW-1385
    a solveit-core:Weakness ;
    rdfs:label "DFW-1385: A proposed hypothesis uses vague or complex phrasing"@en ;
    solveit-core:weaknessID "DFW-1385" ;
    solveit-core:weaknessName "A proposed hypothesis uses vague or complex phrasing" ;
    solveit-core:weaknessDescription "Hypotheses are declarative statements written in the present tense, without ambiguous language, multiple conditions, or conditional verbs (e.g., \"if-then\" or \"would\"). " ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1306 .

:weaknessDFW-1386
    a solveit-core:Weakness ;
    rdfs:label "DFW-1386: A proposed hypothesis is overly specific to details in the case"@en ;
    solveit-core:weaknessID "DFW-1386" ;
    solveit-core:weaknessName "A proposed hypothesis is overly specific to details in the case" ;
    solveit-core:weaknessDescription "Generating hypotheses that focus on specific details available early in an investigation can be too narrow to accomodate new details found later, and increases the risk of confirmation bias, such as focusing on the use of a specific wiping tool rather than any wiping tool being used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1307 .

:weaknessDFW-1387
    a solveit-core:Weakness ;
    rdfs:label "DFW-1387: The operating system installation date is not recovered because the tool fails while decoding the value"@en ;
    solveit-core:weaknessID "DFW-1387" ;
    solveit-core:weaknessName "The operating system installation date is not recovered because the tool fails while decoding the value" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1308 .

:weaknessDFW-1388
    a solveit-core:Weakness ;
    rdfs:label "DFW-1388: The operating system installation date is not recovered because the tool examines an incorrect artifact"@en ;
    solveit-core:weaknessID "DFW-1388" ;
    solveit-core:weaknessName "The operating system installation date is not recovered because the tool examines an incorrect artifact" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1308 .

:weaknessDFW-1389
    a solveit-core:Weakness ;
    rdfs:label "DFW-1389: The operating system installation date extracted does not reflect the time it was installed because the artifact represents an software update, or some other event"@en ;
    solveit-core:weaknessID "DFW-1389" ;
    solveit-core:weaknessName "The operating system installation date extracted does not reflect the time it was installed because the artifact represents an software update, or some other event" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1308 .

:weaknessDFW-1390
    a solveit-core:Weakness ;
    rdfs:label "DFW-1390: The operating system installation date extracted does not reflect the time it was installed because the timezone conversion was applied incorrectly"@en ;
    solveit-core:weaknessID "DFW-1390" ;
    solveit-core:weaknessName "The operating system installation date extracted does not reflect the time it was installed because the timezone conversion was applied incorrectly" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1308 .

:weaknessDFW-1391
    a solveit-core:Weakness ;
    rdfs:label "DFW-1391: The operating system installation date extracted does not reflect the time it was installed because the tool incorrectly decoded the timestamp"@en ;
    solveit-core:weaknessID "DFW-1391" ;
    solveit-core:weaknessName "The operating system installation date extracted does not reflect the time it was installed because the tool incorrectly decoded the timestamp" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1308 .

:weaknessDFW-1392
    a solveit-core:Weakness ;
    rdfs:label "DFW-1392: Presentation of the extracted operating system installation date does not highlight that there were previous operating systems installed prior to this date"@en ;
    solveit-core:weaknessID "DFW-1392" ;
    solveit-core:weaknessName "Presentation of the extracted operating system installation date does not highlight that there were previous operating systems installed prior to this date" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1309 ;
    solveit-core:hasReference :citationDFCite-1157 .

:weaknessDFW-1393
    a solveit-core:Weakness ;
    rdfs:label "DFW-1393: Failure to recover mount point mapping because multiple devices have used the mount point and older data has been overwritten"@en ;
    solveit-core:weaknessID "DFW-1393" ;
    solveit-core:weaknessName "Failure to recover mount point mapping because multiple devices have used the mount point and older data has been overwritten" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1310,
                                        :mitigationDFM-1311 .

:weaknessDFW-1394
    a solveit-core:Weakness ;
    rdfs:label "DFW-1394: Failure to recover mount point mapping because of a tool processing error"@en ;
    solveit-core:weaknessID "DFW-1394" ;
    solveit-core:weaknessName "Failure to recover mount point mapping because of a tool processing error" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1312 .

:weaknessDFW-1395
    a solveit-core:Weakness ;
    rdfs:label "DFW-1395: Failure to recover mount point mapping because multiple operating systems are present and they use different mappings"@en ;
    solveit-core:weaknessID "DFW-1395" ;
    solveit-core:weaknessName "Failure to recover mount point mapping because multiple operating systems are present and they use different mappings" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1313 .

:weaknessDFW-1396
    a solveit-core:Weakness ;
    rdfs:label "DFW-1396: Extracting a relationship between a mount point and device/partition that is incorrect because of a tool processing error"@en ;
    solveit-core:weaknessID "DFW-1396" ;
    solveit-core:weaknessName "Extracting a relationship between a mount point and device/partition that is incorrect because of a tool processing error" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1312 .

:weaknessDFW-1397
    a solveit-core:Weakness ;
    rdfs:label "DFW-1397: Cryptographic hash of the source data is incorrect because not all data was read from the device"@en ;
    solveit-core:weaknessID "DFW-1397" ;
    solveit-core:weaknessName "Cryptographic hash of the source data is incorrect because not all data was read from the device" ;
    solveit-core:weaknessDescription "A failure in reading the data part way through would result in a hash of only some of the data." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1003 .

:weaknessDFW-1398
    a solveit-core:Weakness ;
    rdfs:label "DFW-1398: Cryptographic hash of the source data is incorrect because of a hash computation error"@en ;
    solveit-core:weaknessID "DFW-1398" ;
    solveit-core:weaknessName "Cryptographic hash of the source data is incorrect because of a hash computation error" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1085,
                                        :mitigationDFM-1314 .

:weaknessDFW-1399
    a solveit-core:Weakness ;
    rdfs:label "DFW-1399: Source data is changed when cryptographic hash is being computed because of writes made to the source device"@en ;
    solveit-core:weaknessID "DFW-1399" ;
    solveit-core:weaknessName "Source data is changed when cryptographic hash is being computed because of writes made to the source device" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1007,
                                        :mitigationDFM-1008 .

:weaknessDFW-1400
    a solveit-core:Weakness ;
    rdfs:label "DFW-1400: Source data is changed when cryptographic hash is being computed because of SSD TRIM operations clearing data"@en ;
    solveit-core:weaknessID "DFW-1400" ;
    solveit-core:weaknessName "Source data is changed when cryptographic hash is being computed because of SSD TRIM operations clearing data" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_ALT,
                                  solveit-core:ASTM_INCOMP .

:weaknessDFW-1401
    a solveit-core:Weakness ;
    rdfs:label "DFW-1401: Calculating an incorrect hash of data stored within a forensic image because internally stored data was not decompressed correctly"@en ;
    solveit-core:weaknessID "DFW-1401" ;
    solveit-core:weaknessName "Calculating an incorrect hash of data stored within a forensic image because internally stored data was not decompressed correctly" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1315 .

:weaknessDFW-1402
    a solveit-core:Weakness ;
    rdfs:label "DFW-1402: Calculating an incorrect hash of data stored within a forensic image because it is split over multiple files and not all were included"@en ;
    solveit-core:weaknessID "DFW-1402" ;
    solveit-core:weaknessName "Calculating an incorrect hash of data stored within a forensic image because it is split over multiple files and not all were included" ;
    solveit-core:weaknessDescription "For example hashing data only in an E01 file when there was also an E02." ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1316 .

:weaknessDFW-1403
    a solveit-core:Weakness ;
    rdfs:label "DFW-1403: Failure to evaluate observations in light of the hypotheses because the examination was scoped to extracting and reporting artifacts, with no evaluative question posed"@en ;
    solveit-core:weaknessID "DFW-1403" ;
    solveit-core:weaknessName "Failure to evaluate observations in light of the hypotheses because the examination was scoped to extracting and reporting artifacts, with no evaluative question posed" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1317 .

:weaknessDFW-1404
    a solveit-core:Weakness ;
    rdfs:label "DFW-1404: Failure to evaluate observations in light of the hypotheses because the meaning of the observations was treated as self-evident"@en ;
    solveit-core:weaknessID "DFW-1404" ;
    solveit-core:weaknessName "Failure to evaluate observations in light of the hypotheses because the meaning of the observations was treated as self-evident" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1318 ;
    solveit-core:hasReference :citationDFCite-1165 .

:weaknessDFW-1405
    a solveit-core:Weakness ;
    rdfs:label "DFW-1405: Failure to evaluate observations in light of the hypotheses because analytic output is delivered as fact"@en ;
    solveit-core:weaknessID "DFW-1405" ;
    solveit-core:weaknessName "Failure to evaluate observations in light of the hypotheses because analytic output is delivered as fact" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1208 .

:weaknessDFW-1406
    a solveit-core:Weakness ;
    rdfs:label "DFW-1406: Failure to consider alternative hypotheses because the examination was framed by the instructing party's proposition alone"@en ;
    solveit-core:weaknessID "DFW-1406" ;
    solveit-core:weaknessName "Failure to consider alternative hypotheses because the examination was framed by the instructing party's proposition alone" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1319 .

:weaknessDFW-1407
    a solveit-core:Weakness ;
    rdfs:label "DFW-1407: Failure to consider alternative hypotheses because the observations were assessed for how well they fitted the proposed hypothesis, a one-conditional judgment that never requires an alternative to be stated"@en ;
    solveit-core:weaknessID "DFW-1407" ;
    solveit-core:weaknessName "Failure to consider alternative hypotheses because the observations were assessed for how well they fitted the proposed hypothesis, a one-conditional judgment that never requires an alternative to be stated" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1318 ;
    solveit-core:hasReference :citationDFCite-1165 .

:weaknessDFW-1422
    a solveit-core:Weakness ;
    rdfs:label "DFW-1422: An AI response to a question does not return a relevant event because it found something else relevant and stopped searching"@en ;
    solveit-core:weaknessID "DFW-1422" ;
    solveit-core:weaknessName "An AI response to a question does not return a relevant event because it found something else relevant and stopped searching" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1423
    a solveit-core:Weakness ;
    rdfs:label "DFW-1423: An AI response to a question returns an event with one or more incorrect details because the supporting data was unreliable, but that was not recognised"@en ;
    solveit-core:weaknessID "DFW-1423" ;
    solveit-core:weaknessName "An AI response to a question returns an event with one or more incorrect details because the supporting data was unreliable, but that was not recognised" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1350 .

:weaknessDFW-1424
    a solveit-core:Weakness ;
    rdfs:label "DFW-1424: An AI response returns a sequence of events that do not reflect the true ordering of events that occurred because of failure to consider clock inaccuracies"@en ;
    solveit-core:weaknessID "DFW-1424" ;
    solveit-core:weaknessName "An AI response returns a sequence of events that do not reflect the true ordering of events that occurred because of failure to consider clock inaccuracies" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1225,
                                        :mitigationDFM-1227 .

:weaknessDFW-1425
    a solveit-core:Weakness ;
    rdfs:label "DFW-1425: An AI response to a question presents an assertion that an event occurred as a fact not a hypothesis"@en ;
    solveit-core:weaknessID "DFW-1425" ;
    solveit-core:weaknessName "An AI response to a question presents an assertion that an event occurred as a fact not a hypothesis" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT .

:weaknessDFW-1426
    a solveit-core:Weakness ;
    rdfs:label "DFW-1426: An AI response to a query takes a biased tone because of the phrasing of the user's prompting"@en ;
    solveit-core:weaknessID "DFW-1426" ;
    solveit-core:weaknessName "An AI response to a query takes a biased tone because of the phrasing of the user's prompting" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT .

:weaknessDFW-1427
    a solveit-core:Weakness ;
    rdfs:label "DFW-1427: An AI response to a query takes a biased tone because of inherent bias in the data the model was trained on"@en ;
    solveit-core:weaknessID "DFW-1427" ;
    solveit-core:weaknessName "An AI response to a query takes a biased tone because of inherent bias in the data the model was trained on" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT .

:weaknessDFW-1428
    a solveit-core:Weakness ;
    rdfs:label "DFW-1428: An AI response to a query takes a biased tone because of phrasing in an embedded system prompt"@en ;
    solveit-core:weaknessID "DFW-1428" ;
    solveit-core:weaknessName "An AI response to a query takes a biased tone because of phrasing in an embedded system prompt" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_MISINT .

:weaknessDFW-1429
    a solveit-core:Weakness ;
    rdfs:label "DFW-1429: An AI response to a query for relevant artifacts is missing one or more relevant artifacts because it found something else relevant and stopped searching"@en ;
    solveit-core:weaknessID "DFW-1429" ;
    solveit-core:weaknessName "An AI response to a query for relevant artifacts is missing one or more relevant artifacts because it found something else relevant and stopped searching" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1430
    a solveit-core:Weakness ;
    rdfs:label "DFW-1430: An AI response to a query for relevant artifacts is missing one or more relevant artifacts because the results exceed a context window"@en ;
    solveit-core:weaknessID "DFW-1430" ;
    solveit-core:weaknessName "An AI response to a query for relevant artifacts is missing one or more relevant artifacts because the results exceed a context window" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1332 .

:weaknessDFW-1431
    a solveit-core:Weakness ;
    rdfs:label "DFW-1431: An AI response to a query for relevant artifacts is missing one or more relevant artifacts because some were not recognised as relevant"@en ;
    solveit-core:weaknessID "DFW-1431" ;
    solveit-core:weaknessName "An AI response to a query for relevant artifacts is missing one or more relevant artifacts because some were not recognised as relevant" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1333,
                                        :mitigationDFM-1334,
                                        :mitigationDFM-1335 .

:weaknessDFW-1432
    a solveit-core:Weakness ;
    rdfs:label "DFW-1432: An AI response to a query for relevant artifacts includes reporting artifacts that are not relevant because the model could not successfully differentiate relevance"@en ;
    solveit-core:weaknessID "DFW-1432" ;
    solveit-core:weaknessName "An AI response to a query for relevant artifacts includes reporting artifacts that are not relevant because the model could not successfully differentiate relevance" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1336 .

:weaknessDFW-1433
    a solveit-core:Weakness ;
    rdfs:label "DFW-1433: An AI response to a question does not return a relevant event because the data needed to reconstruct the event was lost due to context window overflow"@en ;
    solveit-core:weaknessID "DFW-1433" ;
    solveit-core:weaknessName "An AI response to a question does not return a relevant event because the data needed to reconstruct the event was lost due to context window overflow" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1332 .

:weaknessDFW-1434
    a solveit-core:Weakness ;
    rdfs:label "DFW-1434: An AI response to a query for relevant artifacts includes reporting artifacts that do not exist because of model hallucinations"@en ;
    solveit-core:weaknessID "DFW-1434" ;
    solveit-core:weaknessName "An AI response to a query for relevant artifacts includes reporting artifacts that do not exist because of model hallucinations" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1337,
                                        :mitigationDFM-1338 .

:weaknessDFW-1435
    a solveit-core:Weakness ;
    rdfs:label "DFW-1435: An AI response to a query does not provide the reasoning behind the results generated because the system is not capable of producing it"@en ;
    solveit-core:weaknessID "DFW-1435" ;
    solveit-core:weaknessName "An AI response to a query does not provide the reasoning behind the results generated because the system is not capable of producing it" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1339,
                                        :mitigationDFM-1340 .

:weaknessDFW-1436
    a solveit-core:Weakness ;
    rdfs:label "DFW-1436: An AI response to a query does not provide the reasoning behind the results generated because it was not requested"@en ;
    solveit-core:weaknessID "DFW-1436" ;
    solveit-core:weaknessName "An AI response to a query does not provide the reasoning behind the results generated because it was not requested" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1437
    a solveit-core:Weakness ;
    rdfs:label "DFW-1437: An AI response to a query does not provide a measure of confidence in the reasoning provided because the system is not capable of producing it"@en ;
    solveit-core:weaknessID "DFW-1437" ;
    solveit-core:weaknessName "An AI response to a query does not provide a measure of confidence in the reasoning provided because the system is not capable of producing it" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1438
    a solveit-core:Weakness ;
    rdfs:label "DFW-1438: An AI response to a query does not provide a measure of confidence in the reasoning provided because it was not requested"@en ;
    solveit-core:weaknessID "DFW-1438" ;
    solveit-core:weaknessName "An AI response to a query does not provide a measure of confidence in the reasoning provided because it was not requested" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1439
    a solveit-core:Weakness ;
    rdfs:label "DFW-1439: An AI response to a query provides an inaccurate reasoning behind the results generated"@en ;
    solveit-core:weaknessID "DFW-1439" ;
    solveit-core:weaknessName "An AI response to a query provides an inaccurate reasoning behind the results generated" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX .

:weaknessDFW-1440
    a solveit-core:Weakness ;
    rdfs:label "DFW-1440: An observation referred to in the reasoning provided by an AI system does not exist because of model hallucinations"@en ;
    solveit-core:weaknessID "DFW-1440" ;
    solveit-core:weaknessName "An observation referred to in the reasoning provided by an AI system does not exist because of model hallucinations" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1341 .

:weaknessDFW-1441
    a solveit-core:Weakness ;
    rdfs:label "DFW-1441: An observation that contradicts the conclusions drawn by an AI system are not presented when presenting reasoning because contradictory observations were not requested"@en ;
    solveit-core:weaknessID "DFW-1441" ;
    solveit-core:weaknessName "An observation that contradicts the conclusions drawn by an AI system are not presented when presenting reasoning because contradictory observations were not requested" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX .

:weaknessDFW-1442
    a solveit-core:Weakness ;
    rdfs:label "DFW-1442: An observation that contradicts the conclusions drawn by an AI system are not included when presenting reasoning because the system stopped searching for relevant data once it found sufficient supporting information"@en ;
    solveit-core:weaknessID "DFW-1442" ;
    solveit-core:weaknessName "An observation that contradicts the conclusions drawn by an AI system are not included when presenting reasoning because the system stopped searching for relevant data once it found sufficient supporting information" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX .

:weaknessDFW-1443
    a solveit-core:Weakness ;
    rdfs:label "DFW-1443: An AI response to a query does not provide an accurate confidence in the reasoning provided because the confidence value is fabricated"@en ;
    solveit-core:weaknessID "DFW-1443" ;
    solveit-core:weaknessName "An AI response to a query does not provide an accurate confidence in the reasoning provided because the confidence value is fabricated" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX .

:weaknessDFW-1444
    a solveit-core:Weakness ;
    rdfs:label "DFW-1444: An AI response to a question does not return a relevant event because it was not recognised as relevant"@en ;
    solveit-core:weaknessID "DFW-1444" ;
    solveit-core:weaknessName "An AI response to a question does not return a relevant event because it was not recognised as relevant" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1343 .

:weaknessDFW-1445
    a solveit-core:Weakness ;
    rdfs:label "DFW-1445: An observation referred to in the reasoning provided by and AI system does not support the conclusions drawn because the system is unable to accurately reason with the observable data that is available but does so anyway"@en ;
    solveit-core:weaknessID "DFW-1445" ;
    solveit-core:weaknessName "An observation referred to in the reasoning provided by and AI system does not support the conclusions drawn because the system is unable to accurately reason with the observable data that is available but does so anyway" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS .

:weaknessDFW-1446
    a solveit-core:Weakness ;
    rdfs:label "DFW-1446: An AI response to a question does not return a relevant link because it found something else relevant and stopped searching"@en ;
    solveit-core:weaknessID "DFW-1446" ;
    solveit-core:weaknessName "An AI response to a question does not return a relevant link because it found something else relevant and stopped searching" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1447
    a solveit-core:Weakness ;
    rdfs:label "DFW-1447: An AI response to a question does not return a relevant link because it could not correctly interpret the data needed to make the link"@en ;
    solveit-core:weaknessID "DFW-1447" ;
    solveit-core:weaknessName "An AI response to a question does not return a relevant link because it could not correctly interpret the data needed to make the link" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1448
    a solveit-core:Weakness ;
    rdfs:label "DFW-1448: An AI response to a question asserts a link that does not exist because because of model hallucinations"@en ;
    solveit-core:weaknessID "DFW-1448" ;
    solveit-core:weaknessName "An AI response to a question asserts a link that does not exist because because of model hallucinations" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1342 .

:weaknessDFW-1449
    a solveit-core:Weakness ;
    rdfs:label "DFW-1449: An AI response to a question asserts a link that does not exist because the supporting data was unreliable but that was not recognised"@en ;
    solveit-core:weaknessID "DFW-1449" ;
    solveit-core:weaknessName "An AI response to a question asserts a link that does not exist because the supporting data was unreliable but that was not recognised" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX .

:weaknessDFW-1450
    a solveit-core:Weakness ;
    rdfs:label "DFW-1450: An AI response to a question does not return a relevant event because data needed to reconstruct the event was lost due to compression of the context"@en ;
    solveit-core:weaknessID "DFW-1450" ;
    solveit-core:weaknessName "An AI response to a question does not return a relevant event because data needed to reconstruct the event was lost due to compression of the context" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1344 .

:weaknessDFW-1451
    a solveit-core:Weakness ;
    rdfs:label "DFW-1451: An AI response to a question returns an event that did not occur because of model hallucinations"@en ;
    solveit-core:weaknessID "DFW-1451" ;
    solveit-core:weaknessName "An AI response to a question returns an event that did not occur because of model hallucinations" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1345 .

:weaknessDFW-1452
    a solveit-core:Weakness ;
    rdfs:label "DFW-1452: An AI response to a question returns an event that did not occur because of an incorrect 'interpretation' of the meaning of some artifacts"@en ;
    solveit-core:weaknessID "DFW-1452" ;
    solveit-core:weaknessName "An AI response to a question returns an event that did not occur because of an incorrect 'interpretation' of the meaning of some artifacts" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1346,
                                        :mitigationDFM-1347 .

:weaknessDFW-1453
    a solveit-core:Weakness ;
    rdfs:label "DFW-1453: An AI response to a question returns an event that did not occur because the supporting data was unreliable, but that was not recognised"@en ;
    solveit-core:weaknessID "DFW-1453" ;
    solveit-core:weaknessName "An AI response to a question returns an event that did not occur because the supporting data was unreliable, but that was not recognised" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX .

:weaknessDFW-1454
    a solveit-core:Weakness ;
    rdfs:label "DFW-1454: An AI response to a question returns an event with one or more incorrect details because of model hallucinations"@en ;
    solveit-core:weaknessID "DFW-1454" ;
    solveit-core:weaknessName "An AI response to a question returns an event with one or more incorrect details because of model hallucinations" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1348 .

:weaknessDFW-1455
    a solveit-core:Weakness ;
    rdfs:label "DFW-1455: An AI response to a question returns an event with one or more incorrect details because of an incorrect 'interpretation' of the meaning of some artifacts"@en ;
    solveit-core:weaknessID "DFW-1455" ;
    solveit-core:weaknessName "An AI response to a question returns an event with one or more incorrect details because of an incorrect 'interpretation' of the meaning of some artifacts" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1347,
                                        :mitigationDFM-1349 .

:weaknessDFW-1456
    a solveit-core:Weakness ;
    rdfs:label "DFW-1456: The decoded value is incorrect because the incorrect data type was applied for decoding"@en ;
    solveit-core:weaknessID "DFW-1456" ;
    solveit-core:weaknessName "The decoded value is incorrect because the incorrect data type was applied for decoding" ;
    solveit-core:weaknessDescription "For example a string was decoded as an integer - e.g. \"61 3A\" was decoded as integer 14945 rather than \"a:\" " ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1351 .

:weaknessDFW-1457
    a solveit-core:Weakness ;
    rdfs:label "DFW-1457: The integer decoded from some data is incorrect because the incorrect number of bytes was examined"@en ;
    solveit-core:weaknessID "DFW-1457" ;
    solveit-core:weaknessName "The integer decoded from some data is incorrect because the incorrect number of bytes was examined" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1352 .

:weaknessDFW-1458
    a solveit-core:Weakness ;
    rdfs:label "DFW-1458: The integer decoded from some data is incorrect because the endianness used was incorrect"@en ;
    solveit-core:weaknessID "DFW-1458" ;
    solveit-core:weaknessName "The integer decoded from some data is incorrect because the endianness used was incorrect" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1353 .

:weaknessDFW-1459
    a solveit-core:Weakness ;
    rdfs:label "DFW-1459: The integer decoded from some data is incorrect because the decoding was signed not unsigned or vice versa"@en ;
    solveit-core:weaknessID "DFW-1459" ;
    solveit-core:weaknessName "The integer decoded from some data is incorrect because the decoding was signed not unsigned or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1354 .

:weaknessDFW-1460
    a solveit-core:Weakness ;
    rdfs:label "DFW-1460: The integer decoded from some data is incorrect because it should have been decoded as a floating point number"@en ;
    solveit-core:weaknessID "DFW-1460" ;
    solveit-core:weaknessName "The integer decoded from some data is incorrect because it should have been decoded as a floating point number" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT .

:weaknessDFW-1461
    a solveit-core:Weakness ;
    rdfs:label "DFW-1461: The floating point number decoded from some data is incorrect because the incorrect number of bytes was examined"@en ;
    solveit-core:weaknessID "DFW-1461" ;
    solveit-core:weaknessName "The floating point number decoded from some data is incorrect because the incorrect number of bytes was examined" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1352 .

:weaknessDFW-1462
    a solveit-core:Weakness ;
    rdfs:label "DFW-1462: The floating point number decoded from some data is incorrect because the endianness used was incorrect"@en ;
    solveit-core:weaknessID "DFW-1462" ;
    solveit-core:weaknessName "The floating point number decoded from some data is incorrect because the endianness used was incorrect" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1355 .

:weaknessDFW-1463
    a solveit-core:Weakness ;
    rdfs:label "DFW-1463: The floating point number decoded from some data is incorrect because the decoding was signed not unsigned or vice versa"@en ;
    solveit-core:weaknessID "DFW-1463" ;
    solveit-core:weaknessName "The floating point number decoded from some data is incorrect because the decoding was signed not unsigned or vice versa" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1354 .

:weaknessDFW-1464
    a solveit-core:Weakness ;
    rdfs:label "DFW-1464: The floating point number decoded from some data is incorrect because it should have been decoded as an integer"@en ;
    solveit-core:weaknessID "DFW-1464" ;
    solveit-core:weaknessName "The floating point number decoded from some data is incorrect because it should have been decoded as an integer" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT .

:weaknessDFW-1465
    a solveit-core:Weakness ;
    rdfs:label "DFW-1465: The floating point number decoded from some data is incorrect because the original value could not be fully represented within the bytes available"@en ;
    solveit-core:weaknessID "DFW-1465" ;
    solveit-core:weaknessName "The floating point number decoded from some data is incorrect because the original value could not be fully represented within the bytes available" ;
    solveit-core:weaknessDescription "For example some fraction that could not be represented exactly within 4 bytes" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX,
                                  solveit-core:ASTM_MISINT ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1356 .

:weaknessDFW-1473
    a solveit-core:Weakness ;
    rdfs:label "DFW-1473: The examiner-entered metadata was not stored along with the forensic container because of a software error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1473" ;
    solveit-core:weaknessName "The examiner-entered metadata was not stored along with the forensic container because of a software error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1363 .

:weaknessDFW-1474
    a solveit-core:Weakness ;
    rdfs:label "DFW-1474: The examiner-entered metadata was not stored along with the forensic container because the examiner did not enter the details"@en ;
    solveit-core:weaknessID "DFW-1474" ;
    solveit-core:weaknessName "The examiner-entered metadata was not stored along with the forensic container because the examiner did not enter the details" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP .

:weaknessDFW-1475
    a solveit-core:Weakness ;
    rdfs:label "DFW-1475: The computed hash(s) were not stored along with the forensic container because of a software error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1475" ;
    solveit-core:weaknessName "The computed hash(s) were not stored along with the forensic container because of a software error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INCOMP ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1364 .

:weaknessDFW-1476
    a solveit-core:Weakness ;
    rdfs:label "DFW-1476: The examiner-entered metadata stored along with the forensic container is incorrect because of a software error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1476" ;
    solveit-core:weaknessName "The examiner-entered metadata stored along with the forensic container is incorrect because of a software error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1363 .

:weaknessDFW-1477
    a solveit-core:Weakness ;
    rdfs:label "DFW-1477: The examiner-entered metadata stored along with the forensic container is incorrect because the examiner entered the wrong details"@en ;
    solveit-core:weaknessID "DFW-1477" ;
    solveit-core:weaknessName "The examiner-entered metadata stored along with the forensic container is incorrect because the examiner entered the wrong details" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_AS,
                                  solveit-core:ASTM_INAC_EX .

:weaknessDFW-1478
    a solveit-core:Weakness ;
    rdfs:label "DFW-1478: The computed hash(s) stored along with the forensic container is incorrect because of a software error in the tool used"@en ;
    solveit-core:weaknessID "DFW-1478" ;
    solveit-core:weaknessName "The computed hash(s) stored along with the forensic container is incorrect because of a software error in the tool used" ;
    solveit-core:hasWeaknessClass solveit-core:ASTM_INAC_EX ;
    solveit-core:hasPotentialMitigation :mitigationDFM-1364 .

#################################################################
#    Mitigations (336)
#
#    Actions that prevent a weakness or reduce its impact.
#################################################################

:mitigationDFM-1001
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1001: Review of all triage results that are relied on during the full digital forensic examination"@en ;
    solveit-core:mitigationID "DFM-1001" ;
    solveit-core:mitigationName "Review of all triage results that are relied on during the full digital forensic examination" .

:mitigationDFM-1002
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1002: Testing of the faraday environment to be used"@en ;
    solveit-core:mitigationID "DFM-1002" ;
    solveit-core:mitigationName "Testing of the faraday environment to be used" ;
    solveit-core:hasReference :citationDFCite-1086 .

:mitigationDFM-1003
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1003: Check image size corresponds with drive label"@en ;
    solveit-core:mitigationID "DFM-1003" ;
    solveit-core:mitigationName "Check image size corresponds with drive label" .

:mitigationDFM-1004
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1004: Check hash of image matches hash of source device"@en ;
    solveit-core:mitigationID "DFM-1004" ;
    solveit-core:mitigationName "Check hash of image matches hash of source device" ;
    solveit-core:mitigationDescription "This mitigation refers to checking the hash of a source *device* and differs from M1009 which refers to source *material*. This differs based on whether data on a device needs to be hashed for verification, or a piece of data needs to be hashed (e.g. imaging a raw dd to a forensic container format)." ;
    solveit-core:linksToTechnique :techniqueDFT-1042 .

:mitigationDFM-1005
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1005: Testing to ensure that the software and hardware disk imaging setup can detect HPAs"@en ;
    solveit-core:mitigationID "DFM-1005" ;
    solveit-core:mitigationName "Testing to ensure that the software and hardware disk imaging setup can detect HPAs" ;
    solveit-core:mitigationDescription "Tests have been performed that the combination of hardware and software used can detect when HPAs are present." .

:mitigationDFM-1006
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1006: Testing to ensure software and hardware setup detects DCOs"@en ;
    solveit-core:mitigationID "DFM-1006" ;
    solveit-core:mitigationName "Testing to ensure software and hardware setup detects DCOs" .

:mitigationDFM-1007
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1007: Use hardware write blocker"@en ;
    solveit-core:mitigationID "DFM-1007" ;
    solveit-core:mitigationName "Use hardware write blocker" ;
    solveit-core:linksToTechnique :techniqueDFT-1012 .

:mitigationDFM-1008
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1008: Use software write blocker"@en ;
    solveit-core:mitigationID "DFM-1008" ;
    solveit-core:mitigationName "Use software write blocker" ;
    solveit-core:linksToTechnique :techniqueDFT-1013 .

:mitigationDFM-1009
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1009: Check hash of image matches hash of source material"@en ;
    solveit-core:mitigationID "DFM-1009" ;
    solveit-core:mitigationName "Check hash of image matches hash of source material" ;
    solveit-core:mitigationDescription """This mitigation refers to checking the hash of a source *material* and differs from M1004 which refers to source *device*. 

This differs based on whether data on a device needs to be hashed for verification, or a piece of data needs to be hashed (e.g. imaging a raw dd to a forensic container format).""" .

:mitigationDFM-1010
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1010: Perform full extraction instead of selective"@en ;
    solveit-core:mitigationID "DFM-1010" ;
    solveit-core:mitigationName "Perform full extraction instead of selective" .

:mitigationDFM-1011
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1011: Perform full extraction instead of selective, followed by partial processing"@en ;
    solveit-core:mitigationID "DFM-1011" ;
    solveit-core:mitigationName "Perform full extraction instead of selective, followed by partial processing" .

:mitigationDFM-1012
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1012: Clear presentation of the backup and deletion process"@en ;
    solveit-core:mitigationID "DFM-1012" ;
    solveit-core:mitigationName "Clear presentation of the backup and deletion process" .

:mitigationDFM-1013
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1013: Consider memory acquisition and offline analysis instead"@en ;
    solveit-core:mitigationID "DFM-1013" ;
    solveit-core:mitigationName "Consider memory acquisition and offline analysis instead" ;
    solveit-core:hasReference :citationDFCite-1063 .

:mitigationDFM-1014
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1014: Test and document changes made by the tools used"@en ;
    solveit-core:mitigationID "DFM-1014" ;
    solveit-core:mitigationName "Test and document changes made by the tools used" ;
    solveit-core:hasReference :citationDFCite-1062 .

:mitigationDFM-1015
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1015: Use tools only if changes made are to locations where relevant evidence is unlikely to be located."@en ;
    solveit-core:mitigationID "DFM-1015" ;
    solveit-core:mitigationName "Use tools only if changes made are to locations where relevant evidence is unlikely to be located." ;
    solveit-core:hasReference :citationDFCite-1062 .

:mitigationDFM-1016
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1016: Alert user that the data collected is a partial set of data stored on the device"@en ;
    solveit-core:mitigationID "DFM-1016" ;
    solveit-core:mitigationName "Alert user that the data collected is a partial set of data stored on the device" .

:mitigationDFM-1017
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1017: Check for physical presence of SD card"@en ;
    solveit-core:mitigationID "DFM-1017" ;
    solveit-core:mitigationName "Check for physical presence of SD card" .

:mitigationDFM-1018
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1018: Check if presence of SD card is expected"@en ;
    solveit-core:mitigationID "DFM-1018" ;
    solveit-core:mitigationName "Check if presence of SD card is expected" .

:mitigationDFM-1019
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1019: Consider if file system acquisition is possible/permitted"@en ;
    solveit-core:mitigationID "DFM-1019" ;
    solveit-core:mitigationName "Consider if file system acquisition is possible/permitted" ;
    solveit-core:linksToTechnique :techniqueDFT-1020 .

:mitigationDFM-1020
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1020: Compare data extracted with full list of installed apps"@en ;
    solveit-core:mitigationID "DFM-1020" ;
    solveit-core:mitigationName "Compare data extracted with full list of installed apps" .

:mitigationDFM-1021
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1021: Verify the disk image integrity with multiple hash algorithms e.g. MD5 and SHA1 (Kessler 2016)"@en ;
    solveit-core:mitigationID "DFM-1021" ;
    solveit-core:mitigationName "Verify the disk image integrity with multiple hash algorithms e.g. MD5 and SHA1 (Kessler 2016)" .

:mitigationDFM-1022
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1022: Restrict access to stored disk images"@en ;
    solveit-core:mitigationID "DFM-1022" ;
    solveit-core:mitigationName "Restrict access to stored disk images" .

:mitigationDFM-1023
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1023: Ensure and check logs of access to stored disk images"@en ;
    solveit-core:mitigationID "DFM-1023" ;
    solveit-core:mitigationName "Ensure and check logs of access to stored disk images" .

:mitigationDFM-1024
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1024: Validate extracted key against the encrypted material before powering off the machine from which the key was extracted (e.g. Hargreaves & Chivers 2008b)"@en ;
    solveit-core:mitigationID "DFM-1024" ;
    solveit-core:mitigationName "Validate extracted key against the encrypted material before powering off the machine from which the key was extracted (e.g. Hargreaves & Chivers 2008b)" .

:mitigationDFM-1025
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1025: Validation & testing against the encryption system under consideration"@en ;
    solveit-core:mitigationID "DFM-1025" ;
    solveit-core:mitigationName "Validation & testing against the encryption system under consideration" .

:mitigationDFM-1026
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1026: Testing of backup parsing method"@en ;
    solveit-core:mitigationID "DFM-1026" ;
    solveit-core:mitigationName "Testing of backup parsing method" .

:mitigationDFM-1027
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1027: Use dual tool verification"@en ;
    solveit-core:mitigationID "DFM-1027" ;
    solveit-core:mitigationName "Use dual tool verification" .

:mitigationDFM-1028
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1028: Parse app lists if available and highlight missing data"@en ;
    solveit-core:mitigationID "DFM-1028" ;
    solveit-core:mitigationName "Parse app lists if available and highlight missing data" .

:mitigationDFM-1029
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1029: Testing of keyword indexing component of tool"@en ;
    solveit-core:mitigationID "DFM-1029" ;
    solveit-core:mitigationName "Testing of keyword indexing component of tool" .

:mitigationDFM-1030
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1030: Testing of retrieval of indexed content"@en ;
    solveit-core:mitigationID "DFM-1030" ;
    solveit-core:mitigationName "Testing of retrieval of indexed content" .

:mitigationDFM-1031
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1031: Also using synonyms for terms used"@en ;
    solveit-core:mitigationID "DFM-1031" ;
    solveit-core:mitigationName "Also using synonyms for terms used" .

:mitigationDFM-1032
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1032: Evaluation of the effectiveness of wordlist used for case-type searching"@en ;
    solveit-core:mitigationID "DFM-1032" ;
    solveit-core:mitigationName "Evaluation of the effectiveness of wordlist used for case-type searching" ;
    solveit-core:hasReference :citationDFCite-1074 .

:mitigationDFM-1033
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1033: Prioritization of search results based on context"@en ;
    solveit-core:mitigationID "DFM-1033" ;
    solveit-core:mitigationName "Prioritization of search results based on context" ;
    solveit-core:hasReference :citationDFCite-1014 .

:mitigationDFM-1034
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1034: Comparison of index results with live search results"@en ;
    solveit-core:mitigationID "DFM-1034" ;
    solveit-core:mitigationName "Comparison of index results with live search results" ;
    solveit-core:linksToTechnique :techniqueDFT-1125 .

:mitigationDFM-1035
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1035: Verification against second tool with known different regex implementation"@en ;
    solveit-core:mitigationID "DFM-1035" ;
    solveit-core:mitigationName "Verification against second tool with known different regex implementation" .

:mitigationDFM-1036
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1036: Testing of regular expression component of tool"@en ;
    solveit-core:mitigationID "DFM-1036" ;
    solveit-core:mitigationName "Testing of regular expression component of tool" .

:mitigationDFM-1037
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1037: The context of relevant keyword results are manually checked"@en ;
    solveit-core:mitigationID "DFM-1037" ;
    solveit-core:mitigationName "The context of relevant keyword results are manually checked" .

:mitigationDFM-1038
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1038: Word list selected such that a practically reviewable number of results are returned"@en ;
    solveit-core:mitigationID "DFM-1038" ;
    solveit-core:mitigationName "Word list selected such that a practically reviewable number of results are returned" .

:mitigationDFM-1039
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1039: Hash matching to reduce need for manual review"@en ;
    solveit-core:mitigationID "DFM-1039" ;
    solveit-core:mitigationName "Hash matching to reduce need for manual review" .

:mitigationDFM-1040
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1040: Use of AI to flag potentially relevant content to reduce need for manual review"@en ;
    solveit-core:mitigationID "DFM-1040" ;
    solveit-core:mitigationName "Use of AI to flag potentially relevant content to reduce need for manual review" .

:mitigationDFM-1041
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1041: Regular breaks to minimise investigator fatigue"@en ;
    solveit-core:mitigationID "DFM-1041" ;
    solveit-core:mitigationName "Regular breaks to minimise investigator fatigue" .

:mitigationDFM-1042
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1042: Secondary review of flagged items to ensure relevance"@en ;
    solveit-core:mitigationID "DFM-1042" ;
    solveit-core:mitigationName "Secondary review of flagged items to ensure relevance" .

:mitigationDFM-1043
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1043: Scan for orphaned EPTs"@en ;
    solveit-core:mitigationID "DFM-1043" ;
    solveit-core:mitigationName "Scan for orphaned EPTs" ;
    solveit-core:hasReference :citationDFCite-1135 .

:mitigationDFM-1044
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1044: Scan for Volume Boot Records in unpartitioned space"@en ;
    solveit-core:mitigationID "DFM-1044" ;
    solveit-core:mitigationName "Scan for Volume Boot Records in unpartitioned space" ;
    solveit-core:hasReference :citationDFCite-1135 .

:mitigationDFM-1045
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1045: Explicitly detect sector size in use"@en ;
    solveit-core:mitigationID "DFM-1045" ;
    solveit-core:mitigationName "Explicitly detect sector size in use" .

:mitigationDFM-1046
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1046: Check pointer offsets for both 512 and 4096 sectors sizes"@en ;
    solveit-core:mitigationID "DFM-1046" ;
    solveit-core:mitigationName "Check pointer offsets for both 512 and 4096 sectors sizes" .

:mitigationDFM-1047
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1047: Testing partition table parsing on standard and non-standard configurations"@en ;
    solveit-core:mitigationID "DFM-1047" ;
    solveit-core:mitigationName "Testing partition table parsing on standard and non-standard configurations" .

:mitigationDFM-1048
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1048: Check built-in integrity checks of partition tables where possible"@en ;
    solveit-core:mitigationID "DFM-1048" ;
    solveit-core:mitigationName "Check built-in integrity checks of partition tables where possible" .

:mitigationDFM-1049
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1049: Check consistency between primary and backup partition tables (where possible)"@en ;
    solveit-core:mitigationID "DFM-1049" ;
    solveit-core:mitigationName "Check consistency between primary and backup partition tables (where possible)" .

:mitigationDFM-1050
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1050: Manually verify relevant data"@en ;
    solveit-core:mitigationID "DFM-1050" ;
    solveit-core:mitigationName "Manually verify relevant data" .

:mitigationDFM-1051
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1051: Validation of specific file system parsing operation for the file system under consideration"@en ;
    solveit-core:mitigationID "DFM-1051" ;
    solveit-core:mitigationName "Validation of specific file system parsing operation for the file system under consideration" .

:mitigationDFM-1052
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1052: Use of a second independent tool to compare live file system listing"@en ;
    solveit-core:mitigationID "DFM-1052" ;
    solveit-core:mitigationName "Use of a second independent tool to compare live file system listing" .

:mitigationDFM-1053
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1053: Verification of the file system specification used as the basis for the tool development"@en ;
    solveit-core:mitigationID "DFM-1053" ;
    solveit-core:mitigationName "Verification of the file system specification used as the basis for the tool development" .

:mitigationDFM-1054
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1054: Testing of message extraction and parsing features"@en ;
    solveit-core:mitigationID "DFM-1054" ;
    solveit-core:mitigationName "Testing of message extraction and parsing features" .

:mitigationDFM-1055
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1055: Correlation of data extracted with data from service provider"@en ;
    solveit-core:mitigationID "DFM-1055" ;
    solveit-core:mitigationName "Correlation of data extracted with data from service provider" .

:mitigationDFM-1056
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1056: Correlation of message data from third party data (another participant in message thread)"@en ;
    solveit-core:mitigationID "DFM-1056" ;
    solveit-core:mitigationName "Correlation of message data from third party data (another participant in message thread)" .

:mitigationDFM-1057
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1057: Testing of parsing of syncronisation artefacts"@en ;
    solveit-core:mitigationID "DFM-1057" ;
    solveit-core:mitigationName "Testing of parsing of syncronisation artefacts" .

:mitigationDFM-1058
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1058: Checking for other confirmatory indicators of the inferred device's existence."@en ;
    solveit-core:mitigationID "DFM-1058" ;
    solveit-core:mitigationName "Checking for other confirmatory indicators of the inferred device's existence." .

:mitigationDFM-1059
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1059: Ongoing research and documentation of syncronisation artefacts"@en ;
    solveit-core:mitigationID "DFM-1059" ;
    solveit-core:mitigationName "Ongoing research and documentation of syncronisation artefacts" .

:mitigationDFM-1060
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1060: Repair salvaged content by grafting different reference data onto fragment(s)"@en ;
    solveit-core:mitigationID "DFM-1060" ;
    solveit-core:mitigationName "Repair salvaged content by grafting different reference data onto fragment(s)" ;
    solveit-core:linksToTechnique :techniqueDFT-1099 .

:mitigationDFM-1061
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1061: Use digital stratigraphy to attempt to attribute data within a specific file system"@en ;
    solveit-core:mitigationID "DFM-1061" ;
    solveit-core:mitigationName "Use digital stratigraphy to attempt to attribute data within a specific file system" ;
    solveit-core:hasReference :citationDFCite-1117 .

:mitigationDFM-1062
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1062: Verify semantic integrity of carved content using manual inspection of relevant data"@en ;
    solveit-core:mitigationID "DFM-1062" ;
    solveit-core:mitigationName "Verify semantic integrity of carved content using manual inspection of relevant data" .

:mitigationDFM-1063
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1063: Verify semantic integrity of carved content using an automated tool"@en ;
    solveit-core:mitigationID "DFM-1063" ;
    solveit-core:mitigationName "Verify semantic integrity of carved content using an automated tool" .

:mitigationDFM-1064
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1064: Verify that salvaged content is renderable using visual inspection of displayed/rendered content "@en ;
    solveit-core:mitigationID "DFM-1064" ;
    solveit-core:mitigationName "Verify that salvaged content is renderable using visual inspection of displayed/rendered content " .

:mitigationDFM-1065
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1065: Render salvaged content by reconstructing a container around fragment(s) based on detected video frame and audio sample locations and (if available) a reference video file with similar parameters."@en ;
    solveit-core:mitigationID "DFM-1065" ;
    solveit-core:mitigationName "Render salvaged content by reconstructing a container around fragment(s) based on detected video frame and audio sample locations and (if available) a reference video file with similar parameters." .

:mitigationDFM-1066
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1066: Attempt to reconstruct browser activity from other areas of disk"@en ;
    solveit-core:mitigationID "DFM-1066" ;
    solveit-core:mitigationName "Attempt to reconstruct browser activity from other areas of disk" ;
    solveit-core:hasReference :citationDFCite-1032 .

:mitigationDFM-1067
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1067: Analyze web browser memory for web browsing activity"@en ;
    solveit-core:mitigationID "DFM-1067" ;
    solveit-core:mitigationName "Analyze web browser memory for web browsing activity" ;
    solveit-core:linksToTechnique :techniqueDFT-1105 ;
    solveit-core:hasReference :citationDFCite-1032 .

:mitigationDFM-1068
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1068: Use digital sniffer dogs to assist in locating evidence"@en ;
    solveit-core:mitigationID "DFM-1068" ;
    solveit-core:mitigationName "Use digital sniffer dogs to assist in locating evidence" ;
    solveit-core:linksToTechnique :techniqueDFT-1006 ;
    solveit-core:hasReference :citationDFCite-1114 .

:mitigationDFM-1069
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1069: Use a SyncTriage style approach to determine existence other synchronized devices"@en ;
    solveit-core:mitigationID "DFM-1069" ;
    solveit-core:mitigationName "Use a SyncTriage style approach to determine existence other synchronized devices" ;
    solveit-core:linksToTechnique :techniqueDFT-1007 ;
    solveit-core:hasReference :citationDFCite-1057 .

:mitigationDFM-1070
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1070: Ensure hash algorithm(s) used are resistant to collisions through data manipulation"@en ;
    solveit-core:mitigationID "DFM-1070" ;
    solveit-core:mitigationName "Ensure hash algorithm(s) used are resistant to collisions through data manipulation" .

:mitigationDFM-1071
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1071: Thorough testing of write blocker against multiple targets to ensure that writes are not possible."@en ;
    solveit-core:mitigationID "DFM-1071" ;
    solveit-core:mitigationName "Thorough testing of write blocker against multiple targets to ensure that writes are not possible." ;
    solveit-core:hasReference :citationDFCite-1089 .

:mitigationDFM-1072
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1072: Regular checks for hardware write blocker firmware updates."@en ;
    solveit-core:mitigationID "DFM-1072" ;
    solveit-core:mitigationName "Regular checks for hardware write blocker firmware updates." .

:mitigationDFM-1073
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1073: Subscription to notifications from write blocker vendor for firmware updates or identified problems."@en ;
    solveit-core:mitigationID "DFM-1073" ;
    solveit-core:mitigationName "Subscription to notifications from write blocker vendor for firmware updates or identified problems." .

:mitigationDFM-1074
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1074: Validate image hash against one stored externally to the image in a trusted location."@en ;
    solveit-core:mitigationID "DFM-1074" ;
    solveit-core:mitigationName "Validate image hash against one stored externally to the image in a trusted location." ;
    solveit-core:hasReference :citationDFCite-1060 .

:mitigationDFM-1075
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1075: Testing programme to validate hashes of data in images is calculated correctly"@en ;
    solveit-core:mitigationID "DFM-1075" ;
    solveit-core:mitigationName "Testing programme to validate hashes of data in images is calculated correctly" .

:mitigationDFM-1076
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1076: Testing programme to validate hashes of metadata in images is calculated correctly"@en ;
    solveit-core:mitigationID "DFM-1076" ;
    solveit-core:mitigationName "Testing programme to validate hashes of metadata in images is calculated correctly" .

:mitigationDFM-1077
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1077: Ensure potential secondary locations for stored message content are reviewed."@en ;
    solveit-core:mitigationID "DFM-1077" ;
    solveit-core:mitigationName "Ensure potential secondary locations for stored message content are reviewed." ;
    solveit-core:hasReference :citationDFCite-1097 .

:mitigationDFM-1078
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1078: Use of multiple carving tools and comparing results"@en ;
    solveit-core:mitigationID "DFM-1078" ;
    solveit-core:mitigationName "Use of multiple carving tools and comparing results" .

:mitigationDFM-1079
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1079: Analyse file content to detect incompatibility between the content and the recovered file system metadata"@en ;
    solveit-core:mitigationID "DFM-1079" ;
    solveit-core:mitigationName "Analyse file content to detect incompatibility between the content and the recovered file system metadata" .

:mitigationDFM-1080
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1080: Use a hashset of known files to detect that recovered content does not match the expected file content"@en ;
    solveit-core:mitigationID "DFM-1080" ;
    solveit-core:mitigationName "Use a hashset of known files to detect that recovered content does not match the expected file content" .

:mitigationDFM-1081
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1081: Check if recovered content matches with size in metadata e.g. file footer at expected location."@en ;
    solveit-core:mitigationID "DFM-1081" ;
    solveit-core:mitigationName "Check if recovered content matches with size in metadata e.g. file footer at expected location." .

:mitigationDFM-1082
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1082: Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file"@en ;
    solveit-core:mitigationID "DFM-1082" ;
    solveit-core:mitigationName "Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file" .

:mitigationDFM-1083
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1083: Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)"@en ;
    solveit-core:mitigationID "DFM-1083" ;
    solveit-core:mitigationName "Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)" .

:mitigationDFM-1084
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1084: Test that the tool used expresses uncertainty in the classification of file recovery results"@en ;
    solveit-core:mitigationID "DFM-1084" ;
    solveit-core:mitigationName "Test that the tool used expresses uncertainty in the classification of file recovery results" .

:mitigationDFM-1085
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1085: Use of multiple tools to verify disk image hash"@en ;
    solveit-core:mitigationID "DFM-1085" ;
    solveit-core:mitigationName "Use of multiple tools to verify disk image hash" .

:mitigationDFM-1086
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1086: Acquire the parts of memory with interconnected data first, before proceeding with a sequential acquisition."@en ;
    solveit-core:mitigationID "DFM-1086" ;
    solveit-core:mitigationName "Acquire the parts of memory with interconnected data first, before proceeding with a sequential acquisition." ;
    solveit-core:hasReference :citationDFCite-1111 .

:mitigationDFM-1087
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1087: Acquire memory from outside of the target system for example using direct memory access (DMA) devices"@en ;
    solveit-core:mitigationID "DFM-1087" ;
    solveit-core:mitigationName "Acquire memory from outside of the target system for example using direct memory access (DMA) devices" ;
    solveit-core:hasReference :citationDFCite-1085 .

:mitigationDFM-1088
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1088: If applicable, leverage hardware virtualization utilities to add a hypervisor to the system, i.e., virtualize the original system. This allows to either freeze the system before the acquisition or, if the system should not be completely frozen, to copy pages before they are modified."@en ;
    solveit-core:mitigationID "DFM-1088" ;
    solveit-core:mitigationName "If applicable, leverage hardware virtualization utilities to add a hypervisor to the system, i.e., virtualize the original system. This allows to either freeze the system before the acquisition or, if the system should not be completely frozen, to copy pages before they are modified." ;
    solveit-core:hasReference :citationDFCite-1025,
                              :citationDFCite-1096 .

:mitigationDFM-1089
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1089: Attempt physical disk repair"@en ;
    solveit-core:mitigationID "DFM-1089" ;
    solveit-core:mitigationName "Attempt physical disk repair" .

:mitigationDFM-1090
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1090: Compare carved results against known files (e.g. from another source)"@en ;
    solveit-core:mitigationID "DFM-1090" ;
    solveit-core:mitigationName "Compare carved results against known files (e.g. from another source)" .

:mitigationDFM-1091
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1091: Use a brute force attack instead"@en ;
    solveit-core:mitigationID "DFM-1091" ;
    solveit-core:mitigationName "Use a brute force attack instead" ;
    solveit-core:linksToTechnique :techniqueDFT-1034 .

:mitigationDFM-1092
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1092: Optimise dictionary"@en ;
    solveit-core:mitigationID "DFM-1092" ;
    solveit-core:mitigationName "Optimise dictionary" ;
    solveit-core:hasReference :citationDFCite-1076 .

:mitigationDFM-1093
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1093: Use mangling rules to generate variants of candidate passwords"@en ;
    solveit-core:mitigationID "DFM-1093" ;
    solveit-core:mitigationName "Use mangling rules to generate variants of candidate passwords" .

:mitigationDFM-1094
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1094: Include contextual information when assembling the dictionary"@en ;
    solveit-core:mitigationID "DFM-1094" ;
    solveit-core:mitigationName "Include contextual information when assembling the dictionary" ;
    solveit-core:hasReference :citationDFCite-1076 .

:mitigationDFM-1095
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1095: Order dictionary to test the most likely candidates first"@en ;
    solveit-core:mitigationID "DFM-1095" ;
    solveit-core:mitigationName "Order dictionary to test the most likely candidates first" .

:mitigationDFM-1096
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1096: Apply additional resources to dictionary attack"@en ;
    solveit-core:mitigationID "DFM-1096" ;
    solveit-core:mitigationName "Apply additional resources to dictionary attack" .

:mitigationDFM-1097
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1097: Attempt to obtain password/passcode from the device owner"@en ;
    solveit-core:mitigationID "DFM-1097" ;
    solveit-core:mitigationName "Attempt to obtain password/passcode from the device owner" ;
    solveit-core:linksToTechnique :techniqueDFT-1037 .

:mitigationDFM-1098
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1098: Optimise the brute force search space"@en ;
    solveit-core:mitigationID "DFM-1098" ;
    solveit-core:mitigationName "Optimise the brute force search space" .

:mitigationDFM-1099
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1099: Use a dictionary attack instead"@en ;
    solveit-core:mitigationID "DFM-1099" ;
    solveit-core:mitigationName "Use a dictionary attack instead" ;
    solveit-core:linksToTechnique :techniqueDFT-1035 .

:mitigationDFM-1100
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1100: Apply additional resources to brute force attack"@en ;
    solveit-core:mitigationID "DFM-1100" ;
    solveit-core:mitigationName "Apply additional resources to brute force attack" .

:mitigationDFM-1101
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1101: Apply time offset to timestamp"@en ;
    solveit-core:mitigationID "DFM-1101" ;
    solveit-core:mitigationName "Apply time offset to timestamp" ;
    solveit-core:linksToTechnique :techniqueDFT-1153 .

:mitigationDFM-1102
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1102: Apply techniques to read remapped sectors"@en ;
    solveit-core:mitigationID "DFM-1102" ;
    solveit-core:mitigationName "Apply techniques to read remapped sectors" ;
    solveit-core:hasReference :citationDFCite-1124 .

:mitigationDFM-1103
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1103: Check that analysis of timestamp accuracy on which event reconstruction is based has been performed"@en ;
    solveit-core:mitigationID "DFM-1103" ;
    solveit-core:mitigationName "Check that analysis of timestamp accuracy on which event reconstruction is based has been performed" .

:mitigationDFM-1104
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1104: Testing of report generation functionality that all intended bookmarks are included"@en ;
    solveit-core:mitigationID "DFM-1104" ;
    solveit-core:mitigationName "Testing of report generation functionality that all intended bookmarks are included" .

:mitigationDFM-1105
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1105: Manual verification that all intended bookmarks are included in the generated report."@en ;
    solveit-core:mitigationID "DFM-1105" ;
    solveit-core:mitigationName "Manual verification that all intended bookmarks are included in the generated report." .

:mitigationDFM-1106
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1106: Testing that generated reports correctly represent/render all expected file types"@en ;
    solveit-core:mitigationID "DFM-1106" ;
    solveit-core:mitigationName "Testing that generated reports correctly represent/render all expected file types" .

:mitigationDFM-1107
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1107: Manual verification that all bookmarked items in the report are correctly rendered/represented."@en ;
    solveit-core:mitigationID "DFM-1107" ;
    solveit-core:mitigationName "Manual verification that all bookmarked items in the report are correctly rendered/represented." .

:mitigationDFM-1108
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1108: Preserve hash in secure location of the generated report so intentional or unintentional modifications can be detected."@en ;
    solveit-core:mitigationID "DFM-1108" ;
    solveit-core:mitigationName "Preserve hash in secure location of the generated report so intentional or unintentional modifications can be detected." .

:mitigationDFM-1109
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1109: Testing that tool(s) identify file types correctly"@en ;
    solveit-core:mitigationID "DFM-1109" ;
    solveit-core:mitigationName "Testing that tool(s) identify file types correctly" .

:mitigationDFM-1110
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1110: Manual review of files classified as unknown"@en ;
    solveit-core:mitigationID "DFM-1110" ;
    solveit-core:mitigationName "Manual review of files classified as unknown" .

:mitigationDFM-1111
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1111: Use of multiple tools to classify file types"@en ;
    solveit-core:mitigationID "DFM-1111" ;
    solveit-core:mitigationName "Use of multiple tools to classify file types" .

:mitigationDFM-1112
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1112: Use of AI to classify files in addition to standard programmatic methods"@en ;
    solveit-core:mitigationID "DFM-1112" ;
    solveit-core:mitigationName "Use of AI to classify files in addition to standard programmatic methods" ;
    solveit-core:hasReference :citationDFCite-1002,
                              :citationDFCite-1078,
                              :citationDFCite-1141 .

:mitigationDFM-1113
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1113: Use mobile exploit to gain privileged access"@en ;
    solveit-core:mitigationID "DFM-1113" ;
    solveit-core:mitigationName "Use mobile exploit to gain privileged access" ;
    solveit-core:linksToTechnique :techniqueDFT-1040 .

:mitigationDFM-1114
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1114: Clear use of language around mobile file system extractions, making the limitations clear and differentiating from a full disk image"@en ;
    solveit-core:mitigationID "DFM-1114" ;
    solveit-core:mitigationName "Clear use of language around mobile file system extractions, making the limitations clear and differentiating from a full disk image" .

:mitigationDFM-1115
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1115: Attempt to brute force user PIN (potentially on device)"@en ;
    solveit-core:mitigationID "DFM-1115" ;
    solveit-core:mitigationName "Attempt to brute force user PIN (potentially on device)" ;
    solveit-core:linksToTechnique :techniqueDFT-1034 .

:mitigationDFM-1116
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1116: Attempt to dictionary attack user PIN (potentially on device)"@en ;
    solveit-core:mitigationID "DFM-1116" ;
    solveit-core:mitigationName "Attempt to dictionary attack user PIN (potentially on device)" ;
    solveit-core:linksToTechnique :techniqueDFT-1035 .

:mitigationDFM-1117
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1117: Attempt to obtain user PIN from user"@en ;
    solveit-core:mitigationID "DFM-1117" ;
    solveit-core:mitigationName "Attempt to obtain user PIN from user" ;
    solveit-core:linksToTechnique :techniqueDFT-1037 .

:mitigationDFM-1118
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1118: Recover appropriate database table joins from source application source code"@en ;
    solveit-core:mitigationID "DFM-1118" ;
    solveit-core:mitigationName "Recover appropriate database table joins from source application source code" .

:mitigationDFM-1119
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1119: Recover appropriate database table joins from source application reverse engineering"@en ;
    solveit-core:mitigationID "DFM-1119" ;
    solveit-core:mitigationName "Recover appropriate database table joins from source application reverse engineering" .

:mitigationDFM-1120
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1120: Recover appropriate database table joins from source application developer documentation"@en ;
    solveit-core:mitigationID "DFM-1120" ;
    solveit-core:mitigationName "Recover appropriate database table joins from source application developer documentation" .

:mitigationDFM-1121
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1121: Infer appropriate table joins from extensive experimentation with known ground-truth data"@en ;
    solveit-core:mitigationID "DFM-1121" ;
    solveit-core:mitigationName "Infer appropriate table joins from extensive experimentation with known ground-truth data" ;
    solveit-core:linksToTechnique :techniqueDFT-1090 .

:mitigationDFM-1122
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1122: Apply non-allocated record recovery to database file(s)"@en ;
    solveit-core:mitigationID "DFM-1122" ;
    solveit-core:mitigationName "Apply non-allocated record recovery to database file(s)" ;
    solveit-core:hasReference :citationDFCite-1113 .

:mitigationDFM-1123
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1123: Apply system-wide record recovery for non-allocated database record data structures"@en ;
    solveit-core:mitigationID "DFM-1123" ;
    solveit-core:mitigationName "Apply system-wide record recovery for non-allocated database record data structures" ;
    solveit-core:hasReference :citationDFCite-1113 .

:mitigationDFM-1124
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1124: Examine database contents with and without Write Ahead Log (WAL) files applied"@en ;
    solveit-core:mitigationID "DFM-1124" ;
    solveit-core:mitigationName "Examine database contents with and without Write Ahead Log (WAL) files applied" ;
    solveit-core:hasReference :citationDFCite-1021,
                              :citationDFCite-1022 .

:mitigationDFM-1125
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1125: Examine database journal files"@en ;
    solveit-core:mitigationID "DFM-1125" ;
    solveit-core:mitigationName "Examine database journal files" ;
    solveit-core:hasReference :citationDFCite-1022 .

:mitigationDFM-1126
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1126: Use forensic bootable environment to gain access to internal media"@en ;
    solveit-core:mitigationID "DFM-1126" ;
    solveit-core:mitigationName "Use forensic bootable environment to gain access to internal media" ;
    solveit-core:linksToTechnique :techniqueDFT-1113 .

:mitigationDFM-1127
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1127: Use a similar system to test steps required to interrupt the normal boot process and boot from Trusted Bootable Environment"@en ;
    solveit-core:mitigationID "DFM-1127" ;
    solveit-core:mitigationName "Use a similar system to test steps required to interrupt the normal boot process and boot from Trusted Bootable Environment" .

:mitigationDFM-1128
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1128: Use a Trusted Bootable Environment that is permitted to boot"@en ;
    solveit-core:mitigationID "DFM-1128" ;
    solveit-core:mitigationName "Use a Trusted Bootable Environment that is permitted to boot" .

:mitigationDFM-1129
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1129: Use USB flashdrive version if a CD version is not permitted to boot"@en ;
    solveit-core:mitigationID "DFM-1129" ;
    solveit-core:mitigationName "Use USB flashdrive version if a CD version is not permitted to boot" .

:mitigationDFM-1130
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1130: Disable Secureboot in BIOS to permit bootable environment to load (risks wiping FDE key, requiring ADK)."@en ;
    solveit-core:mitigationID "DFM-1130" ;
    solveit-core:mitigationName "Disable Secureboot in BIOS to permit bootable environment to load (risks wiping FDE key, requiring ADK)." .

:mitigationDFM-1131
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1131: Use a Trusted Bootable Environment that supports accessing the internal disk"@en ;
    solveit-core:mitigationID "DFM-1131" ;
    solveit-core:mitigationName "Use a Trusted Bootable Environment that supports accessing the internal disk" .

:mitigationDFM-1132
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1132: Use a Trusted Bootable Environment that supports decryption of the internal disk"@en ;
    solveit-core:mitigationID "DFM-1132" ;
    solveit-core:mitigationName "Use a Trusted Bootable Environment that supports decryption of the internal disk" ;
    solveit-core:hasReference :citationDFCite-1026 .

:mitigationDFM-1133
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1133: Acquire the encrypted contents of the internal disk and decrypt the copy within a virtualized environment"@en ;
    solveit-core:mitigationID "DFM-1133" ;
    solveit-core:mitigationName "Acquire the encrypted contents of the internal disk and decrypt the copy within a virtualized environment" ;
    solveit-core:hasReference :citationDFCite-1026 .

:mitigationDFM-1134
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1134: Testing that connected devices are detected."@en ;
    solveit-core:mitigationID "DFM-1134" ;
    solveit-core:mitigationName "Testing that connected devices are detected." .

:mitigationDFM-1135
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1135: Testing that correct metadata/status of connected devices is extracted"@en ;
    solveit-core:mitigationID "DFM-1135" ;
    solveit-core:mitigationName "Testing that correct metadata/status of connected devices is extracted" .

:mitigationDFM-1136
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1136: Testing of archive format parsing"@en ;
    solveit-core:mitigationID "DFM-1136" ;
    solveit-core:mitigationName "Testing of archive format parsing" .

:mitigationDFM-1137
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1137: Review of logs for any file extraction errors"@en ;
    solveit-core:mitigationID "DFM-1137" ;
    solveit-core:mitigationName "Review of logs for any file extraction errors" .

:mitigationDFM-1138
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1138: Testing file name/path pattern matching engine"@en ;
    solveit-core:mitigationID "DFM-1138" ;
    solveit-core:mitigationName "Testing file name/path pattern matching engine" .

:mitigationDFM-1139
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1139: Use automated software monitoring to detect app artefact changes"@en ;
    solveit-core:mitigationID "DFM-1139" ;
    solveit-core:mitigationName "Use automated software monitoring to detect app artefact changes" ;
    solveit-core:linksToTechnique :techniqueDFT-1119 .

:mitigationDFM-1140
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1140: Use automation framework to emulate user actions to generate test data"@en ;
    solveit-core:mitigationID "DFM-1140" ;
    solveit-core:mitigationName "Use automation framework to emulate user actions to generate test data" .

:mitigationDFM-1141
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1141: Careful review of case brief for case-specific keyword list generation"@en ;
    solveit-core:mitigationID "DFM-1141" ;
    solveit-core:mitigationName "Careful review of case brief for case-specific keyword list generation" .

:mitigationDFM-1142
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1142: Review of case-specific keyword list by case officer"@en ;
    solveit-core:mitigationID "DFM-1142" ;
    solveit-core:mitigationName "Review of case-specific keyword list by case officer" .

:mitigationDFM-1143
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1143: Use live logical keyword search"@en ;
    solveit-core:mitigationID "DFM-1143" ;
    solveit-core:mitigationName "Use live logical keyword search" ;
    solveit-core:linksToTechnique :techniqueDFT-1127 .

:mitigationDFM-1144
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1144: Use indexed keyword search"@en ;
    solveit-core:mitigationID "DFM-1144" ;
    solveit-core:mitigationName "Use indexed keyword search" ;
    solveit-core:linksToTechnique :techniqueDFT-1124 .

:mitigationDFM-1145
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1145: Apply OCR to files and search or index resulting text"@en ;
    solveit-core:mitigationID "DFM-1145" ;
    solveit-core:mitigationName "Apply OCR to files and search or index resulting text" .

:mitigationDFM-1146
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1146: Ensure keyword indexing settings capture text encodings required during indexing"@en ;
    solveit-core:mitigationID "DFM-1146" ;
    solveit-core:mitigationName "Ensure keyword indexing settings capture text encodings required during indexing" .

:mitigationDFM-1147
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1147: Ensure keyword indexing settings configure text substring handling as required during indexing"@en ;
    solveit-core:mitigationID "DFM-1147" ;
    solveit-core:mitigationName "Ensure keyword indexing settings configure text substring handling as required during indexing" .

:mitigationDFM-1148
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1148: Ensure keyword indexing settings configure case sensitivity for indexing as required"@en ;
    solveit-core:mitigationID "DFM-1148" ;
    solveit-core:mitigationName "Ensure keyword indexing settings configure case sensitivity for indexing as required" .

:mitigationDFM-1149
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1149: Ensure keyword indexing settings mean that decompression will be applied as required during indexing"@en ;
    solveit-core:mitigationID "DFM-1149" ;
    solveit-core:mitigationName "Ensure keyword indexing settings mean that decompression will be applied as required during indexing" .

:mitigationDFM-1150
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1150: Ensure keyword indexing settings mean that file formats will be decoded as required during indexing"@en ;
    solveit-core:mitigationID "DFM-1150" ;
    solveit-core:mitigationName "Ensure keyword indexing settings mean that file formats will be decoded as required during indexing" .

:mitigationDFM-1151
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1151: Check keyword results are part of allocated file, or if not perform detailed analysis to determine if the association between keyword results and file is valid"@en ;
    solveit-core:mitigationID "DFM-1151" ;
    solveit-core:mitigationName "Check keyword results are part of allocated file, or if not perform detailed analysis to determine if the association between keyword results and file is valid" .

:mitigationDFM-1152
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1152: Peer review of case-specific keyword list created"@en ;
    solveit-core:mitigationID "DFM-1152" ;
    solveit-core:mitigationName "Peer review of case-specific keyword list created" .

:mitigationDFM-1153
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1153: Index data in the case and perform iterative keyword searching using the index"@en ;
    solveit-core:mitigationID "DFM-1153" ;
    solveit-core:mitigationName "Index data in the case and perform iterative keyword searching using the index" ;
    solveit-core:linksToTechnique :techniqueDFT-1124 .

:mitigationDFM-1154
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1154: Testing for live message recovery from AI companion app"@en ;
    solveit-core:mitigationID "DFM-1154" ;
    solveit-core:mitigationName "Testing for live message recovery from AI companion app" .

:mitigationDFM-1155
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1155: Testing for deleted message recovery from AI companion app"@en ;
    solveit-core:mitigationID "DFM-1155" ;
    solveit-core:mitigationName "Testing for deleted message recovery from AI companion app" .

:mitigationDFM-1156
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1156: Testing that message sender and recipient extraction are correct"@en ;
    solveit-core:mitigationID "DFM-1156" ;
    solveit-core:mitigationName "Testing that message sender and recipient extraction are correct" .

:mitigationDFM-1157
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1157: Ensure messages are viewed in the context of the message thread"@en ;
    solveit-core:mitigationID "DFM-1157" ;
    solveit-core:mitigationName "Ensure messages are viewed in the context of the message thread" .

:mitigationDFM-1158
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1158: Testing for live picture message recovery from AI companion app"@en ;
    solveit-core:mitigationID "DFM-1158" ;
    solveit-core:mitigationName "Testing for live picture message recovery from AI companion app" .

:mitigationDFM-1159
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1159: Testing for deleted picture message recovery from AI companion app"@en ;
    solveit-core:mitigationID "DFM-1159" ;
    solveit-core:mitigationName "Testing for deleted picture message recovery from AI companion app" .

:mitigationDFM-1160
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1160: Testing that picture message sender and recipient extraction are correct"@en ;
    solveit-core:mitigationID "DFM-1160" ;
    solveit-core:mitigationName "Testing that picture message sender and recipient extraction are correct" .

:mitigationDFM-1161
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1161: Testing of live call record recovery from AI companion app"@en ;
    solveit-core:mitigationID "DFM-1161" ;
    solveit-core:mitigationName "Testing of live call record recovery from AI companion app" .

:mitigationDFM-1162
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1162: Testing of deleted call record recovery from AI companion app"@en ;
    solveit-core:mitigationID "DFM-1162" ;
    solveit-core:mitigationName "Testing of deleted call record recovery from AI companion app" .

:mitigationDFM-1163
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1163: Testing that call record caller and recipient extraction are correct"@en ;
    solveit-core:mitigationID "DFM-1163" ;
    solveit-core:mitigationName "Testing that call record caller and recipient extraction are correct" .

:mitigationDFM-1164
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1164: Testing of account details recovery from AI companion app"@en ;
    solveit-core:mitigationID "DFM-1164" ;
    solveit-core:mitigationName "Testing of account details recovery from AI companion app" .

:mitigationDFM-1165
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1165: Ensure data collection prior to any interaction with app"@en ;
    solveit-core:mitigationID "DFM-1165" ;
    solveit-core:mitigationName "Ensure data collection prior to any interaction with app" .

:mitigationDFM-1166
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1166: Remove all network connectivity from device"@en ;
    solveit-core:mitigationID "DFM-1166" ;
    solveit-core:mitigationName "Remove all network connectivity from device" .

:mitigationDFM-1167
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1167: Check time of account access is prior to device seizure time"@en ;
    solveit-core:mitigationID "DFM-1167" ;
    solveit-core:mitigationName "Check time of account access is prior to device seizure time" .

:mitigationDFM-1168
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1168: Request logs of access times from service provider"@en ;
    solveit-core:mitigationID "DFM-1168" ;
    solveit-core:mitigationName "Request logs of access times from service provider" .

:mitigationDFM-1169
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1169: Testing of app settings recovery from AI companion app"@en ;
    solveit-core:mitigationID "DFM-1169" ;
    solveit-core:mitigationName "Testing of app settings recovery from AI companion app" .

:mitigationDFM-1170
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1170: Experiments with test device to view possible settings of forensic value"@en ;
    solveit-core:mitigationID "DFM-1170" ;
    solveit-core:mitigationName "Experiments with test device to view possible settings of forensic value" .

:mitigationDFM-1171
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1171: Testing of the recovery of companion AI bot settings"@en ;
    solveit-core:mitigationID "DFM-1171" ;
    solveit-core:mitigationName "Testing of the recovery of companion AI bot settings" .

:mitigationDFM-1172
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1172: Also examine any older versions of the logs from backups"@en ;
    solveit-core:mitigationID "DFM-1172" ;
    solveit-core:mitigationName "Also examine any older versions of the logs from backups" .

:mitigationDFM-1173
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1173: Check logging settings so the bounds of logging are known"@en ;
    solveit-core:mitigationID "DFM-1173" ;
    solveit-core:mitigationName "Check logging settings so the bounds of logging are known" ;
    solveit-core:hasReference :citationDFCite-1140 .

:mitigationDFM-1174
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1174: Check logging settings to determine expected behaviour"@en ;
    solveit-core:mitigationID "DFM-1174" ;
    solveit-core:mitigationName "Check logging settings to determine expected behaviour" .

:mitigationDFM-1175
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1175: Ensure any available archive logs are also examined"@en ;
    solveit-core:mitigationID "DFM-1175" ;
    solveit-core:mitigationName "Ensure any available archive logs are also examined" .

:mitigationDFM-1176
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1176: Ensure log entry type interpretation applies for the software version being examined"@en ;
    solveit-core:mitigationID "DFM-1176" ;
    solveit-core:mitigationName "Ensure log entry type interpretation applies for the software version being examined" .

:mitigationDFM-1177
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1177: Ensure resolution or limitations of logfile timestamps are understood"@en ;
    solveit-core:mitigationID "DFM-1177" ;
    solveit-core:mitigationName "Ensure resolution or limitations of logfile timestamps are understood" .

:mitigationDFM-1178
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1178: Ensure timezone handling method for logfile timestamps is understood"@en ;
    solveit-core:mitigationID "DFM-1178" ;
    solveit-core:mitigationName "Ensure timezone handling method for logfile timestamps is understood" .

:mitigationDFM-1179
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1179: If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation"@en ;
    solveit-core:mitigationID "DFM-1179" ;
    solveit-core:mitigationName "If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation" .

:mitigationDFM-1180
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1180: Testing correct extraction of logfile entry timestamps"@en ;
    solveit-core:mitigationID "DFM-1180" ;
    solveit-core:mitigationName "Testing correct extraction of logfile entry timestamps" .

:mitigationDFM-1181
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1181: Testing logfile parsing capability"@en ;
    solveit-core:mitigationID "DFM-1181" ;
    solveit-core:mitigationName "Testing logfile parsing capability" .

:mitigationDFM-1182
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1182: Testing of correct log entry type extraction"@en ;
    solveit-core:mitigationID "DFM-1182" ;
    solveit-core:mitigationName "Testing of correct log entry type extraction" .

:mitigationDFM-1187
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1187: Ensure browser cache data is also considered "@en ;
    solveit-core:mitigationID "DFM-1187" ;
    solveit-core:mitigationName "Ensure browser cache data is also considered " ;
    solveit-core:linksToTechnique :techniqueDFT-1138 .

:mitigationDFM-1188
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1188: Ensure all profiles of the web browser are considered"@en ;
    solveit-core:mitigationID "DFM-1188" ;
    solveit-core:mitigationName "Ensure all profiles of the web browser are considered" ;
    solveit-core:linksToTechnique :techniqueDFT-1144 .

:mitigationDFM-1189
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1189: Conduct experiments to determine if content from the page in question is cached only when viewed in the browser"@en ;
    solveit-core:mitigationID "DFM-1189" ;
    solveit-core:mitigationName "Conduct experiments to determine if content from the page in question is cached only when viewed in the browser" ;
    solveit-core:hasReference :citationDFCite-1064 .

:mitigationDFM-1190
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1190: Ensure that the context of recovered URLs is considered during event reconstruction"@en ;
    solveit-core:mitigationID "DFM-1190" ;
    solveit-core:mitigationName "Ensure that the context of recovered URLs is considered during event reconstruction" .

:mitigationDFM-1191
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1191: Ensure that profile configuration is examined rather than just folders within the standard profile folder"@en ;
    solveit-core:mitigationID "DFM-1191" ;
    solveit-core:mitigationName "Ensure that profile configuration is examined rather than just folders within the standard profile folder" ;
    solveit-core:linksToTechnique :techniqueDFT-1143 ;
    solveit-core:hasReference :citationDFCite-1101 .

:mitigationDFM-1192
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1192: Examine browser configuration to determine history retention settings"@en ;
    solveit-core:mitigationID "DFM-1192" ;
    solveit-core:mitigationName "Examine browser configuration to determine history retention settings" ;
    solveit-core:linksToTechnique :techniqueDFT-1143 .

:mitigationDFM-1193
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1193: Obtain older versions of browser history files from backups or from file system versioning features"@en ;
    solveit-core:mitigationID "DFM-1193" ;
    solveit-core:mitigationName "Obtain older versions of browser history files from backups or from file system versioning features" .

:mitigationDFM-1194
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1194: Consider carefully page titles and other details associated with older web history visits when details are recovered using SQL join queries."@en ;
    solveit-core:mitigationID "DFM-1194" ;
    solveit-core:mitigationName "Consider carefully page titles and other details associated with older web history visits when details are recovered using SQL join queries." .

:mitigationDFM-1195
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1195: Also examine browser cache to confirm details about an older web visit when details are recovered using SQL join queries."@en ;
    solveit-core:mitigationID "DFM-1195" ;
    solveit-core:mitigationName "Also examine browser cache to confirm details about an older web visit when details are recovered using SQL join queries." ;
    solveit-core:linksToTechnique :techniqueDFT-1138 .

:mitigationDFM-1196
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1196: Check if file being recovered is smaller than a block"@en ;
    solveit-core:mitigationID "DFM-1196" ;
    solveit-core:mitigationName "Check if file being recovered is smaller than a block" .

:mitigationDFM-1197
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1197: Check if file being recovered is resident (applicable on some file systems)"@en ;
    solveit-core:mitigationID "DFM-1197" ;
    solveit-core:mitigationName "Check if file being recovered is resident (applicable on some file systems)" .

:mitigationDFM-1198
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1198: Check if file system and operating system make use of an 'allocated but unwritten' value e.g. VDL."@en ;
    solveit-core:mitigationID "DFM-1198" ;
    solveit-core:mitigationName "Check if file system and operating system make use of an 'allocated but unwritten' value e.g. VDL." .

:mitigationDFM-1199
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1199: Check all relevant file size metadata values when recovering file content"@en ;
    solveit-core:mitigationID "DFM-1199" ;
    solveit-core:mitigationName "Check all relevant file size metadata values when recovering file content" .

:mitigationDFM-1200
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1200: Ensure that inconsistencies between allocated data size and data written size are clearly flagged."@en ;
    solveit-core:mitigationID "DFM-1200" ;
    solveit-core:mitigationName "Ensure that inconsistencies between allocated data size and data written size are clearly flagged." .

:mitigationDFM-1203
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1203: Use indexed keyword search over broader content of the data source"@en ;
    solveit-core:mitigationID "DFM-1203" ;
    solveit-core:mitigationName "Use indexed keyword search over broader content of the data source" ;
    solveit-core:linksToTechnique :techniqueDFT-1124 .

:mitigationDFM-1204
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1204: Use live keyword search over broader content of the data source"@en ;
    solveit-core:mitigationID "DFM-1204" ;
    solveit-core:mitigationName "Use live keyword search over broader content of the data source" ;
    solveit-core:linksToTechnique :techniqueDFT-1125 .

:mitigationDFM-1205
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1205: Use wordlist generator with case data"@en ;
    solveit-core:mitigationID "DFM-1205" ;
    solveit-core:mitigationName "Use wordlist generator with case data" ;
    solveit-core:hasReference :citationDFCite-1094,
                              :citationDFCite-1095 .

:mitigationDFM-1206
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1206: Ensure that tools used clearly separate fact from interpretation"@en ;
    solveit-core:mitigationID "DFM-1206" ;
    solveit-core:mitigationName "Ensure that tools used clearly separate fact from interpretation" ;
    solveit-core:hasReference :citationDFCite-1070 .

:mitigationDFM-1207
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1207: Ensure training is in place for tool operators to separate fact from interpretation within the tool used"@en ;
    solveit-core:mitigationID "DFM-1207" ;
    solveit-core:mitigationName "Ensure training is in place for tool operators to separate fact from interpretation within the tool used" ;
    solveit-core:hasReference :citationDFCite-1068,
                              :citationDFCite-1070 .

:mitigationDFM-1208
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1208: Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered"@en ;
    solveit-core:mitigationID "DFM-1208" ;
    solveit-core:mitigationName "Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered" ;
    solveit-core:hasReference :citationDFCite-1068,
                              :citationDFCite-1070 .

:mitigationDFM-1209
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1209: Ensure that tools used present the uncertainty associated with automated interpretation of data"@en ;
    solveit-core:mitigationID "DFM-1209" ;
    solveit-core:mitigationName "Ensure that tools used present the uncertainty associated with automated interpretation of data" ;
    solveit-core:hasReference :citationDFCite-1068,
                              :citationDFCite-1070 .

:mitigationDFM-1210
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1210: Use a forensic image format with internal integrity and continuity metadata"@en ;
    solveit-core:mitigationID "DFM-1210" ;
    solveit-core:mitigationName "Use a forensic image format with internal integrity and continuity metadata" ;
    solveit-core:hasReference :citationDFCite-1035 .

:mitigationDFM-1211
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1211: Test the parsing of split forensic images"@en ;
    solveit-core:mitigationID "DFM-1211" ;
    solveit-core:mitigationName "Test the parsing of split forensic images" .

:mitigationDFM-1212
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1212: Test the parsing of split forensic images with the maximum number of segments possible"@en ;
    solveit-core:mitigationID "DFM-1212" ;
    solveit-core:mitigationName "Test the parsing of split forensic images with the maximum number of segments possible" .

:mitigationDFM-1213
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1213: Test the parsing of split forensic images with missing segments"@en ;
    solveit-core:mitigationID "DFM-1213" ;
    solveit-core:mitigationName "Test the parsing of split forensic images with missing segments" .

:mitigationDFM-1214
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1214: Ensure forensic tool UI clearly warns that there are problems while parsing a split forensic image file"@en ;
    solveit-core:mitigationID "DFM-1214" ;
    solveit-core:mitigationName "Ensure forensic tool UI clearly warns that there are problems while parsing a split forensic image file" .

:mitigationDFM-1215
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1215: Test the parsing of split forensic images with a corrupt segment"@en ;
    solveit-core:mitigationID "DFM-1215" ;
    solveit-core:mitigationName "Test the parsing of split forensic images with a corrupt segment" .

:mitigationDFM-1216
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1216: Check that the assumption is valid that the specific local/external timestamp pair should be correlated"@en ;
    solveit-core:mitigationID "DFM-1216" ;
    solveit-core:mitigationName "Check that the assumption is valid that the specific local/external timestamp pair should be correlated" .

:mitigationDFM-1217
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1217: Consider multiple time anchors and check if timestamps from multiple external time sources agree"@en ;
    solveit-core:mitigationID "DFM-1217" ;
    solveit-core:mitigationName "Consider multiple time anchors and check if timestamps from multiple external time sources agree" .

:mitigationDFM-1218
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1218: Ensure that tools and processes take into account all current knowledge on sources of local/external timestamp pairs (time anchors)"@en ;
    solveit-core:mitigationID "DFM-1218" ;
    solveit-core:mitigationName "Ensure that tools and processes take into account all current knowledge on sources of local/external timestamp pairs (time anchors)" .

:mitigationDFM-1219
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1219: Manual verification of timestamp decoding within a time anchor"@en ;
    solveit-core:mitigationID "DFM-1219" ;
    solveit-core:mitigationName "Manual verification of timestamp decoding within a time anchor" .

:mitigationDFM-1220
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1220: Periodically keep records of time offsets of significant external servers"@en ;
    solveit-core:mitigationID "DFM-1220" ;
    solveit-core:mitigationName "Periodically keep records of time offsets of significant external servers" ;
    solveit-core:linksToTechnique :techniqueDFT-1110 .

:mitigationDFM-1221
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1221: Testing of timestamp decoding within a time anchor"@en ;
    solveit-core:mitigationID "DFM-1221" ;
    solveit-core:mitigationName "Testing of timestamp decoding within a time anchor" .

:mitigationDFM-1222
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1222: Testing to ensure that tooling is able to extract local/external timestamp pairs (time anchors)"@en ;
    solveit-core:mitigationID "DFM-1222" ;
    solveit-core:mitigationName "Testing to ensure that tooling is able to extract local/external timestamp pairs (time anchors)" .

:mitigationDFM-1223
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1223: Apply time zone based offsets only to UTC stored timestamps"@en ;
    solveit-core:mitigationID "DFM-1223" ;
    solveit-core:mitigationName "Apply time zone based offsets only to UTC stored timestamps" .

:mitigationDFM-1224
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1224: Check for location artifacts to infer the time zone at a specific moment"@en ;
    solveit-core:mitigationID "DFM-1224" ;
    solveit-core:mitigationName "Check for location artifacts to infer the time zone at a specific moment" .

:mitigationDFM-1225
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1225: Estimate clock offset at a specific point in time using time anchoring"@en ;
    solveit-core:mitigationID "DFM-1225" ;
    solveit-core:mitigationName "Estimate clock offset at a specific point in time using time anchoring" ;
    solveit-core:linksToTechnique :techniqueDFT-1134 ;
    solveit-core:hasReference :citationDFCite-1020 .

:mitigationDFM-1226
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1226: Testing to determine whether a timestamp is in UTC or local time"@en ;
    solveit-core:mitigationID "DFM-1226" ;
    solveit-core:mitigationName "Testing to determine whether a timestamp is in UTC or local time" .

:mitigationDFM-1227
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1227: Search for indicators of clock tampering"@en ;
    solveit-core:mitigationID "DFM-1227" ;
    solveit-core:mitigationName "Search for indicators of clock tampering" ;
    solveit-core:linksToTechnique :techniqueDFT-1129 .

:mitigationDFM-1228
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1228: Record system clock offset"@en ;
    solveit-core:mitigationID "DFM-1228" ;
    solveit-core:mitigationName "Record system clock offset" ;
    solveit-core:linksToTechnique :techniqueDFT-1111 .

:mitigationDFM-1229
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1229: Determine last timezone used on system"@en ;
    solveit-core:mitigationID "DFM-1229" ;
    solveit-core:mitigationName "Determine last timezone used on system" .

:mitigationDFM-1230
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1230: Ensure that daylight savings offsets that are applied to timestamps are correct"@en ;
    solveit-core:mitigationID "DFM-1230" ;
    solveit-core:mitigationName "Ensure that daylight savings offsets that are applied to timestamps are correct" .

:mitigationDFM-1231
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1231: Make use of 'paired searching'"@en ;
    solveit-core:mitigationID "DFM-1231" ;
    solveit-core:mitigationName "Make use of 'paired searching'" ;
    solveit-core:mitigationDescription "According to Fisher & Fisher (2012): \"Indoor crime scene searches are best done with two persons. One easy way of accomplishing a search in a room is to divide it in half. Each investigator searches one half. After they have done a thorough search, they switch halves.\" " ;
    solveit-core:hasReference :citationDFCite-1043 .

:mitigationDFM-1232
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1232: Adopt a systematic search pattern"@en ;
    solveit-core:mitigationID "DFM-1232" ;
    solveit-core:mitigationName "Adopt a systematic search pattern" ;
    solveit-core:mitigationDescription "According to Fisher & Fisher (2012): \"Criminal investigation texts recommend a variety of search patterns: the strip or lane search, grid search, spiral search, and quadrant search. \" " ;
    solveit-core:hasReference :citationDFCite-1043 .

:mitigationDFM-1233
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1233: Test data extraction methods against reference data with known timestamps"@en ;
    solveit-core:mitigationID "DFM-1233" ;
    solveit-core:mitigationName "Test data extraction methods against reference data with known timestamps" .

:mitigationDFM-1234
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1234: Exploit device to facilitate password/pincode attacks"@en ;
    solveit-core:mitigationID "DFM-1234" ;
    solveit-core:mitigationName "Exploit device to facilitate password/pincode attacks" ;
    solveit-core:linksToTechnique :techniqueDFT-1040 .

:mitigationDFM-1235
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1235: Attempt to obtain password/pincode with brute force attacks"@en ;
    solveit-core:mitigationID "DFM-1235" ;
    solveit-core:mitigationName "Attempt to obtain password/pincode with brute force attacks" ;
    solveit-core:linksToTechnique :techniqueDFT-1034 .

:mitigationDFM-1236
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1236: Attempt to obtain password/pincode with dictionary attacks"@en ;
    solveit-core:mitigationID "DFM-1236" ;
    solveit-core:mitigationName "Attempt to obtain password/pincode with dictionary attacks" ;
    solveit-core:linksToTechnique :techniqueDFT-1035 .

:mitigationDFM-1237
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1237: Ensure that archive format used can handle sufficiently large files"@en ;
    solveit-core:mitigationID "DFM-1237" ;
    solveit-core:mitigationName "Ensure that archive format used can handle sufficiently large files" ;
    solveit-core:hasReference :citationDFCite-1130 .

:mitigationDFM-1238
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1238: Configure device to enable required service"@en ;
    solveit-core:mitigationID "DFM-1238" ;
    solveit-core:mitigationName "Configure device to enable required service" ;
    solveit-core:mitigationDescription "For example turning on Developer Mode on Android to enable ADB" ;
    solveit-core:linksToTechnique :techniqueDFT-1158 ;
    solveit-core:hasReference :citationDFCite-1003,
                              :citationDFCite-1004 .

:mitigationDFM-1239
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1239: Obtain possible passwords/PIN codes from other devices with limited security"@en ;
    solveit-core:mitigationID "DFM-1239" ;
    solveit-core:mitigationName "Obtain possible passwords/PIN codes from other devices with limited security" ;
    solveit-core:linksToTechnique :techniqueDFT-1033 .

:mitigationDFM-1240
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1240: Check for indications of disk backed memory pages"@en ;
    solveit-core:mitigationID "DFM-1240" ;
    solveit-core:mitigationName "Check for indications of disk backed memory pages" ;
    solveit-core:hasReference :citationDFCite-1143 .

:mitigationDFM-1241
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1241: Avoid direct connection to media and use hardware write blocker instead"@en ;
    solveit-core:mitigationID "DFM-1241" ;
    solveit-core:mitigationName "Avoid direct connection to media and use hardware write blocker instead" ;
    solveit-core:linksToTechnique :techniqueDFT-1012 .

:mitigationDFM-1242
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1242: Testing live message recovery from multiplayer gaming app"@en ;
    solveit-core:mitigationID "DFM-1242" ;
    solveit-core:mitigationName "Testing live message recovery from multiplayer gaming app" .

:mitigationDFM-1243
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1243: Request user data from multiplayer gaming platform and compare"@en ;
    solveit-core:mitigationID "DFM-1243" ;
    solveit-core:mitigationName "Request user data from multiplayer gaming platform and compare" .

:mitigationDFM-1244
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1244: Testing deleted message recovery from multiplayer gaming app"@en ;
    solveit-core:mitigationID "DFM-1244" ;
    solveit-core:mitigationName "Testing deleted message recovery from multiplayer gaming app" .

:mitigationDFM-1245
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1245: Testing live contact recovery from a multiplayer gaming app"@en ;
    solveit-core:mitigationID "DFM-1245" ;
    solveit-core:mitigationName "Testing live contact recovery from a multiplayer gaming app" .

:mitigationDFM-1246
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1246: Testing deleted contact recovery from a multiplayer gaming app"@en ;
    solveit-core:mitigationID "DFM-1246" ;
    solveit-core:mitigationName "Testing deleted contact recovery from a multiplayer gaming app" .

:mitigationDFM-1247
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1247: Testing that gaming app configuration information is recovered correctly"@en ;
    solveit-core:mitigationID "DFM-1247" ;
    solveit-core:mitigationName "Testing that gaming app configuration information is recovered correctly" .

:mitigationDFM-1248
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1248: Testing to ensure that live accounts are recovered correctly from a gaming app"@en ;
    solveit-core:mitigationID "DFM-1248" ;
    solveit-core:mitigationName "Testing to ensure that live accounts are recovered correctly from a gaming app" .

:mitigationDFM-1249
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1249: Testing to ensure that deleted accounts are recovered correctly from a gaming app"@en ;
    solveit-core:mitigationID "DFM-1249" ;
    solveit-core:mitigationName "Testing to ensure that deleted accounts are recovered correctly from a gaming app" .

:mitigationDFM-1250
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1250: Test that timeline analysis tool returns correct results when filter criteria are provided"@en ;
    solveit-core:mitigationID "DFM-1250" ;
    solveit-core:mitigationName "Test that timeline analysis tool returns correct results when filter criteria are provided" .

:mitigationDFM-1251
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1251: Manually review timeline entries for relevance"@en ;
    solveit-core:mitigationID "DFM-1251" ;
    solveit-core:mitigationName "Manually review timeline entries for relevance" .

:mitigationDFM-1252
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1252: Refine timeline filtering criteria to reduce set of entries to a manageable set for review"@en ;
    solveit-core:mitigationID "DFM-1252" ;
    solveit-core:mitigationName "Refine timeline filtering criteria to reduce set of entries to a manageable set for review" .

:mitigationDFM-1253
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1253: Ensure that timeline analysis tool highlights that a filtered timeline is presented e.g. x/y entries shown"@en ;
    solveit-core:mitigationID "DFM-1253" ;
    solveit-core:mitigationName "Ensure that timeline analysis tool highlights that a filtered timeline is presented e.g. x/y entries shown" .

:mitigationDFM-1259
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1259: Test that a timeline tool correctly sorts entries"@en ;
    solveit-core:mitigationID "DFM-1259" ;
    solveit-core:mitigationName "Test that a timeline tool correctly sorts entries" .

:mitigationDFM-1260
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1260: Check that sorted timeline contains same number of entries as unsorted timeline"@en ;
    solveit-core:mitigationID "DFM-1260" ;
    solveit-core:mitigationName "Check that sorted timeline contains same number of entries as unsorted timeline" .

:mitigationDFM-1261
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1261: Test that timeline sorting correctly represents entries with low resolution timestamps"@en ;
    solveit-core:mitigationID "DFM-1261" ;
    solveit-core:mitigationName "Test that timeline sorting correctly represents entries with low resolution timestamps" .

:mitigationDFM-1262
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1262: Test that timeline tools represent timeline entries with the same value at the same point in time, not in an artificial order"@en ;
    solveit-core:mitigationID "DFM-1262" ;
    solveit-core:mitigationName "Test that timeline tools represent timeline entries with the same value at the same point in time, not in an artificial order" .

:mitigationDFM-1263
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1263: Check timeline entry to ensure that a timezone has not already been applied and shifted the timestamp value"@en ;
    solveit-core:mitigationID "DFM-1263" ;
    solveit-core:mitigationName "Check timeline entry to ensure that a timezone has not already been applied and shifted the timestamp value" .

:mitigationDFM-1264
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1264: Ensure that tools used extract data from any operating system notification databases or relevant files"@en ;
    solveit-core:mitigationID "DFM-1264" ;
    solveit-core:mitigationName "Ensure that tools used extract data from any operating system notification databases or relevant files" .

:mitigationDFM-1265
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1265: Test that the tool used correctly recovers operating system notifications from the data structures examined"@en ;
    solveit-core:mitigationID "DFM-1265" ;
    solveit-core:mitigationName "Test that the tool used correctly recovers operating system notifications from the data structures examined" .

:mitigationDFM-1266
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1266: Examine longer lasting operating system notification storage locations if possible"@en ;
    solveit-core:mitigationID "DFM-1266" ;
    solveit-core:mitigationName "Examine longer lasting operating system notification storage locations if possible" .

:mitigationDFM-1267
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1267: Test that the tool used correctly recovers operating system notification timestamps from the data structures examined"@en ;
    solveit-core:mitigationID "DFM-1267" ;
    solveit-core:mitigationName "Test that the tool used correctly recovers operating system notification timestamps from the data structures examined" .

:mitigationDFM-1268
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1268: Count timeline entries before and after sorting a timeline and check they are the same"@en ;
    solveit-core:mitigationID "DFM-1268" ;
    solveit-core:mitigationName "Count timeline entries before and after sorting a timeline and check they are the same" .

:mitigationDFM-1269
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1269: Generate UUIDs of all timeline entries prior to a sort and ensure that all are present post-sort"@en ;
    solveit-core:mitigationID "DFM-1269" ;
    solveit-core:mitigationName "Generate UUIDs of all timeline entries prior to a sort and ensure that all are present post-sort" .

:mitigationDFM-1270
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1270: Systematically analyse all fields and timestamps in API responses to recover evidence that would otherwise be missed"@en ;
    solveit-core:mitigationID "DFM-1270" ;
    solveit-core:mitigationName "Systematically analyse all fields and timestamps in API responses to recover evidence that would otherwise be missed" .

:mitigationDFM-1271
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1271: Cross-validate API-derived artefacts against independent sources to improve reliability"@en ;
    solveit-core:mitigationID "DFM-1271" ;
    solveit-core:mitigationName "Cross-validate API-derived artefacts against independent sources to improve reliability" .

:mitigationDFM-1272
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1272: Test that the tool extracts the correct operating system"@en ;
    solveit-core:mitigationID "DFM-1272" ;
    solveit-core:mitigationName "Test that the tool extracts the correct operating system" .

:mitigationDFM-1273
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1273: Ensure that older operating system versions are also displayed along with current version"@en ;
    solveit-core:mitigationID "DFM-1273" ;
    solveit-core:mitigationName "Ensure that older operating system versions are also displayed along with current version" .

:mitigationDFM-1274
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1274: Testing of Windows HIVE file parsing"@en ;
    solveit-core:mitigationID "DFM-1274" ;
    solveit-core:mitigationName "Testing of Windows HIVE file parsing" .

:mitigationDFM-1275
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1275: Ensure tool presents Registry key modification times as applicable to a key only, not any individual value"@en ;
    solveit-core:mitigationID "DFM-1275" ;
    solveit-core:mitigationName "Ensure tool presents Registry key modification times as applicable to a key only, not any individual value" .

:mitigationDFM-1276
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1276: Collect from all available API endpoints, including undocumented ones identified via client reverse engineering"@en ;
    solveit-core:mitigationID "DFM-1276" ;
    solveit-core:mitigationName "Collect from all available API endpoints, including undocumented ones identified via client reverse engineering" .

:mitigationDFM-1277
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1277: Monitor structural changes to the target API and update parsing logic to prevent silent data loss"@en ;
    solveit-core:mitigationID "DFM-1277" ;
    solveit-core:mitigationName "Monitor structural changes to the target API and update parsing logic to prevent silent data loss" .

:mitigationDFM-1278
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1278: Place device in faraday bag to block connectivity"@en ;
    solveit-core:mitigationID "DFM-1278" ;
    solveit-core:mitigationName "Place device in faraday bag to block connectivity" ;
    solveit-core:linksToTechnique :techniqueDFT-1010 .

:mitigationDFM-1279
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1279: Ensure all relevant connectivity settings for this particular device have been disabled"@en ;
    solveit-core:mitigationID "DFM-1279" ;
    solveit-core:mitigationName "Ensure all relevant connectivity settings for this particular device have been disabled" .

:mitigationDFM-1280
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1280: Compare the metadata stored in a forensic container with that recorded in accompanying documentation"@en ;
    solveit-core:mitigationID "DFM-1280" ;
    solveit-core:mitigationName "Compare the metadata stored in a forensic container with that recorded in accompanying documentation" .

:mitigationDFM-1281
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1281: Compare the cryptographic hash stored in a forensic container with one recorded externally"@en ;
    solveit-core:mitigationID "DFM-1281" ;
    solveit-core:mitigationName "Compare the cryptographic hash stored in a forensic container with one recorded externally" .

:mitigationDFM-1282
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1282: Use up-to-date API"@en ;
    solveit-core:mitigationID "DFM-1282" ;
    solveit-core:mitigationName "Use up-to-date API" .

:mitigationDFM-1283
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1283: Use an alternative method that does not truncate data during format conversion"@en ;
    solveit-core:mitigationID "DFM-1283" ;
    solveit-core:mitigationName "Use an alternative method that does not truncate data during format conversion" .

:mitigationDFM-1284
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1284: Ensure tool configuration is correct"@en ;
    solveit-core:mitigationID "DFM-1284" ;
    solveit-core:mitigationName "Ensure tool configuration is correct" .

:mitigationDFM-1285
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1285: Testing that a tool acquires complete and accurate data"@en ;
    solveit-core:mitigationID "DFM-1285" ;
    solveit-core:mitigationName "Testing that a tool acquires complete and accurate data" .

:mitigationDFM-1286
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1286: Acquire data from production environment"@en ;
    solveit-core:mitigationID "DFM-1286" ;
    solveit-core:mitigationName "Acquire data from production environment" .

:mitigationDFM-1287
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1287: Update non-production environment with latest production data"@en ;
    solveit-core:mitigationID "DFM-1287" ;
    solveit-core:mitigationName "Update non-production environment with latest production data" .

:mitigationDFM-1288
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1288: Ensure that tools preserve metadata and relationships"@en ;
    solveit-core:mitigationID "DFM-1288" ;
    solveit-core:mitigationName "Ensure that tools preserve metadata and relationships" .

:mitigationDFM-1289
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1289: Acquire cloud service logs separately"@en ;
    solveit-core:mitigationID "DFM-1289" ;
    solveit-core:mitigationName "Acquire cloud service logs separately" .

:mitigationDFM-1290
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1290: Request cloud service logs from provider"@en ;
    solveit-core:mitigationID "DFM-1290" ;
    solveit-core:mitigationName "Request cloud service logs from provider" .

:mitigationDFM-1291
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1291: Obtain an up-to-date schema"@en ;
    solveit-core:mitigationID "DFM-1291" ;
    solveit-core:mitigationName "Obtain an up-to-date schema" .

:mitigationDFM-1292
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1292: Rate limit API calls to stay within limits"@en ;
    solveit-core:mitigationID "DFM-1292" ;
    solveit-core:mitigationName "Rate limit API calls to stay within limits" .

:mitigationDFM-1293
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1293: Contact cloud service provider to lift API limits"@en ;
    solveit-core:mitigationID "DFM-1293" ;
    solveit-core:mitigationName "Contact cloud service provider to lift API limits" .

:mitigationDFM-1294
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1294: Ensure credentials have sufficient permissions"@en ;
    solveit-core:mitigationID "DFM-1294" ;
    solveit-core:mitigationName "Ensure credentials have sufficient permissions" .

:mitigationDFM-1295
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1295: Ensure credentials have not expired or been revoked"@en ;
    solveit-core:mitigationID "DFM-1295" ;
    solveit-core:mitigationName "Ensure credentials have not expired or been revoked" .

:mitigationDFM-1296
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1296: Determine cause of failure and retry acquiring data when resolved"@en ;
    solveit-core:mitigationID "DFM-1296" ;
    solveit-core:mitigationName "Determine cause of failure and retry acquiring data when resolved" .

:mitigationDFM-1297
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1297: Use an alternative method that preserves historical data"@en ;
    solveit-core:mitigationID "DFM-1297" ;
    solveit-core:mitigationName "Use an alternative method that preserves historical data" .

:mitigationDFM-1298
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1298: Acquire raw data without conversion"@en ;
    solveit-core:mitigationID "DFM-1298" ;
    solveit-core:mitigationName "Acquire raw data without conversion" .

:mitigationDFM-1299
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1299: Cryptographically sign generated forensic analysis reports with an asymmetric key"@en ;
    solveit-core:mitigationID "DFM-1299" ;
    solveit-core:mitigationName "Cryptographically sign generated forensic analysis reports with an asymmetric key" ;
    solveit-core:mitigationDescription "Sign analysis reports and export bundles with an asymmetric key (e.g., Ed25519, ECDSA) and embed signatures in a manifest so subsequent tampering is detectable without relying solely on storing a hash in a separate location (DFM-1108)." .

:mitigationDFM-1300
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1300: Ensure that hypotheses are mutually exclusive"@en ;
    solveit-core:mitigationID "DFM-1300" ;
    solveit-core:mitigationName "Ensure that hypotheses are mutually exclusive" .

:mitigationDFM-1301
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1301: Avoid hypotheses that rely on untestable assertions"@en ;
    solveit-core:mitigationID "DFM-1301" ;
    solveit-core:mitigationName "Avoid hypotheses that rely on untestable assertions" .

:mitigationDFM-1302
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1302: Frame the hypothesis as a relational prediction"@en ;
    solveit-core:mitigationID "DFM-1302" ;
    solveit-core:mitigationName "Frame the hypothesis as a relational prediction" .

:mitigationDFM-1303
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1303: Refer to the to the \"suspect\" rather than \"device user\" when generating a hypothesis related to the accused individual"@en ;
    solveit-core:mitigationID "DFM-1303" ;
    solveit-core:mitigationName "Refer to the to the \"suspect\" rather than \"device user\" when generating a hypothesis related to the accused individual" .

:mitigationDFM-1304
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1304: Avoid judgmental or loaded terminology in generated hypotheses"@en ;
    solveit-core:mitigationID "DFM-1304" ;
    solveit-core:mitigationName "Avoid judgmental or loaded terminology in generated hypotheses" .

:mitigationDFM-1305
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1305: Ensure that hypotheses address the correct level of hierarchy (source, activity, or offense level)"@en ;
    solveit-core:mitigationID "DFM-1305" ;
    solveit-core:mitigationName "Ensure that hypotheses address the correct level of hierarchy (source, activity, or offense level)" .

:mitigationDFM-1306
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1306: Generate hypotheses as declarative statements written either in the present tense or specifying a past time period."@en ;
    solveit-core:mitigationID "DFM-1306" ;
    solveit-core:mitigationName "Generate hypotheses as declarative statements written either in the present tense or specifying a past time period." ;
    solveit-core:mitigationDescription "Digital forensics deals with the remnant results of an event, not the event itself. In digital forensics, we make observations in the present that \"may support only approximations about the past event.\" Any reconstruction or simulation of a past situation is \"incomplete, imperfect and degraded by time passing.\" Even when we boot a disk image in a virtual environment, it is on different hardware with a different network configuration/connection. Effective evaluative practice captures this fact by stating hypotheses in present tense or in terms of current observations relating to a specified time period in the past. For example, \"The defendant is the primary user of the mobile device,\" or \"When the offense occurred, the defendant was the primary user of the mobile device.\" As another example, \"The computer system can render and play the video frames fully\" or \"During the relevant time period, the computer system could render and play the video frames fully.\" Specifying the time period helps avoid mistakenly thinking that it is possible to recreate a past state perfectly, may be different from the latest state of a system, and reminds that there is inherent uncertainty requiring evaluation." .

:mitigationDFM-1307
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1307: Do not generate hypotheses that are overly narrow and may increase the risk of over-specificity or confirmation bias. For instance, refer to a class (wiping tool, Trojan horse program) rather than a member of class (e.g., Eraser.exe, Backdoor.exe) to avoid narrowly focusing on a specific detail"@en ;
    solveit-core:mitigationID "DFM-1307" ;
    solveit-core:mitigationName "Do not generate hypotheses that are overly narrow and may increase the risk of over-specificity or confirmation bias. For instance, refer to a class (wiping tool, Trojan horse program) rather than a member of class (e.g., Eraser.exe, Backdoor.exe) to avoid narrowly focusing on a specific detail" .

:mitigationDFM-1308
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1308: Test that the tool recovers the date of operating system installation correctly"@en ;
    solveit-core:mitigationID "DFM-1308" ;
    solveit-core:mitigationName "Test that the tool recovers the date of operating system installation correctly" .

:mitigationDFM-1309
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1309: Ensure that the tool examines artifacts of previous operating system installation and presents them clearly"@en ;
    solveit-core:mitigationID "DFM-1309" ;
    solveit-core:mitigationName "Ensure that the tool examines artifacts of previous operating system installation and presents them clearly" .

:mitigationDFM-1310
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1310: Recover older copies of data that contains mount point mappings from backups"@en ;
    solveit-core:mitigationID "DFM-1310" ;
    solveit-core:mitigationName "Recover older copies of data that contains mount point mappings from backups" .

:mitigationDFM-1311
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1311: Recover older copies of data that contains mount point mappings from file versioning artifacts"@en ;
    solveit-core:mitigationID "DFM-1311" ;
    solveit-core:mitigationName "Recover older copies of data that contains mount point mappings from file versioning artifacts" .

:mitigationDFM-1312
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1312: Test that tool can correctly recover mount point mappings"@en ;
    solveit-core:mitigationID "DFM-1312" ;
    solveit-core:mitigationName "Test that tool can correctly recover mount point mappings" .

:mitigationDFM-1313
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1313: Check for the presence of multiple operating systems and process mount point mappings for all of them"@en ;
    solveit-core:mitigationID "DFM-1313" ;
    solveit-core:mitigationName "Check for the presence of multiple operating systems and process mount point mappings for all of them" .

:mitigationDFM-1314
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1314: Test that cryptographically hashing data on a connected drive/media performs correctly"@en ;
    solveit-core:mitigationID "DFM-1314" ;
    solveit-core:mitigationName "Test that cryptographically hashing data on a connected drive/media performs correctly" ;
    solveit-core:mitigationDescription "This differs from testing hashing data within forensic images as it replicates conditions of hashing external media attached for imaging" .

:mitigationDFM-1315
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1315: Test that cryptographic hashes are calculated correctly over all compression settings used for forensic images"@en ;
    solveit-core:mitigationID "DFM-1315" ;
    solveit-core:mitigationName "Test that cryptographic hashes are calculated correctly over all compression settings used for forensic images" .

:mitigationDFM-1316
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1316: Test that cryptographic hashing of split forensic images includes the data from all files that make up that image"@en ;
    solveit-core:mitigationID "DFM-1316" ;
    solveit-core:mitigationName "Test that cryptographic hashing of split forensic images includes the data from all files that make up that image" .

:mitigationDFM-1317
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1317: State the hypotheses to be evaluated before the examination begins"@en ;
    solveit-core:mitigationID "DFM-1317" ;
    solveit-core:mitigationName "State the hypotheses to be evaluated before the examination begins" .

:mitigationDFM-1318
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1318: Assign the probability or strength of the observations under each competing hypothesis"@en ;
    solveit-core:mitigationID "DFM-1318" ;
    solveit-core:mitigationName "Assign the probability or strength of the observations under each competing hypothesis" .

:mitigationDFM-1319
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1319: Evaluate the observations under each party's claims, not only the instructing party's"@en ;
    solveit-core:mitigationID "DFM-1319" ;
    solveit-core:mitigationName "Evaluate the observations under each party's claims, not only the instructing party's" .

:mitigationDFM-1331
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1331: Create a persistent log of any errors during data copying process"@en ;
    solveit-core:mitigationID "DFM-1331" ;
    solveit-core:mitigationName "Create a persistent log of any errors during data copying process" ;
    solveit-core:mitigationDescription "During any data copying process e.g. sectors, bytes, files ensure that any errors encountered are logged with clear details as to the scope of the error." .

:mitigationDFM-1332
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1332: Flag when an AI context window has reached a limit and prevent further processing within that session"@en ;
    solveit-core:mitigationID "DFM-1332" ;
    solveit-core:mitigationName "Flag when an AI context window has reached a limit and prevent further processing within that session" .

:mitigationDFM-1333
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1333: Use keyword searching to complement AI-based queries for relevant artifacts"@en ;
    solveit-core:mitigationID "DFM-1333" ;
    solveit-core:mitigationName "Use keyword searching to complement AI-based queries for relevant artifacts" ;
    solveit-core:linksToTechnique :techniqueDFT-1049 ;
    solveit-core:hasReference :citationDFCite-1169 .

:mitigationDFM-1334
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1334: Use timeline analysis to complement AI-based queries for relevant artifacts"@en ;
    solveit-core:mitigationID "DFM-1334" ;
    solveit-core:mitigationName "Use timeline analysis to complement AI-based queries for relevant artifacts" ;
    solveit-core:linksToTechnique :techniqueDFT-1086 .

:mitigationDFM-1335
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1335: Use hash matching to complement AI-based queries for relevant artifacts"@en ;
    solveit-core:mitigationID "DFM-1335" ;
    solveit-core:mitigationName "Use hash matching to complement AI-based queries for relevant artifacts" ;
    solveit-core:linksToTechnique :techniqueDFT-1050 .

:mitigationDFM-1336
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1336: Manually verify artifacts reported as relevant by an AI system"@en ;
    solveit-core:mitigationID "DFM-1336" ;
    solveit-core:mitigationName "Manually verify artifacts reported as relevant by an AI system" ;
    solveit-core:linksToTechnique :techniqueDFT-1054 .

:mitigationDFM-1337
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1337: Manual verification of the existence of artifacts reported by an AI system"@en ;
    solveit-core:mitigationID "DFM-1337" ;
    solveit-core:mitigationName "Manual verification of the existence of artifacts reported by an AI system" ;
    solveit-core:linksToTechnique :techniqueDFT-1202 .

:mitigationDFM-1338
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1338: Ensure AI-based tooling provides IDs that link to the artefacts to facilitate manual verification"@en ;
    solveit-core:mitigationID "DFM-1338" ;
    solveit-core:mitigationName "Ensure AI-based tooling provides IDs that link to the artefacts to facilitate manual verification" .

:mitigationDFM-1339
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1339: Ensure that the AI-based system is capable of providing reasoning behind the selection of results that are relevant"@en ;
    solveit-core:mitigationID "DFM-1339" ;
    solveit-core:mitigationName "Ensure that the AI-based system is capable of providing reasoning behind the selection of results that are relevant" .

:mitigationDFM-1340
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1340: Ensure that the AI-based system is capable of providing an audit trail of artifacts considered but excluded as relevant, along with the exclusion criteria"@en ;
    solveit-core:mitigationID "DFM-1340" ;
    solveit-core:mitigationName "Ensure that the AI-based system is capable of providing an audit trail of artifacts considered but excluded as relevant, along with the exclusion criteria" .

:mitigationDFM-1341
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1341: Manually verify an observation used as part of an AI system's reasoning explanation"@en ;
    solveit-core:mitigationID "DFM-1341" ;
    solveit-core:mitigationName "Manually verify an observation used as part of an AI system's reasoning explanation" ;
    solveit-core:linksToTechnique :techniqueDFT-1202 .

:mitigationDFM-1342
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1342: Manually verify the link between entities that is asserted by and AI-based system"@en ;
    solveit-core:mitigationID "DFM-1342" ;
    solveit-core:mitigationName "Manually verify the link between entities that is asserted by and AI-based system" .

:mitigationDFM-1343
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1343: Use deterministic event reconstruction approaches to complement AI-based event reconstruction"@en ;
    solveit-core:mitigationID "DFM-1343" ;
    solveit-core:mitigationName "Use deterministic event reconstruction approaches to complement AI-based event reconstruction" ;
    solveit-core:linksToTechnique :techniqueDFT-1086 ;
    solveit-core:hasReference :citationDFCite-1169 .

:mitigationDFM-1344
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1344: Do not allow context compression during AI-based investigative sessions"@en ;
    solveit-core:mitigationID "DFM-1344" ;
    solveit-core:mitigationName "Do not allow context compression during AI-based investigative sessions" .

:mitigationDFM-1345
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1345: Manually verify a reconstructed event's existence"@en ;
    solveit-core:mitigationID "DFM-1345" ;
    solveit-core:mitigationName "Manually verify a reconstructed event's existence" .

:mitigationDFM-1346
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1346: Manually verify the interpretation of artifacts used for an event reconstruction"@en ;
    solveit-core:mitigationID "DFM-1346" ;
    solveit-core:mitigationName "Manually verify the interpretation of artifacts used for an event reconstruction" ;
    solveit-core:linksToTechnique :techniqueDFT-1202 .

:mitigationDFM-1347
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1347: Look up in artifact catalogs how the identified artifacts should be interpreted"@en ;
    solveit-core:mitigationID "DFM-1347" ;
    solveit-core:mitigationName "Look up in artifact catalogs how the identified artifacts should be interpreted" .

:mitigationDFM-1348
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1348: Manually verify the properties of a reconstructed event"@en ;
    solveit-core:mitigationID "DFM-1348" ;
    solveit-core:mitigationName "Manually verify the properties of a reconstructed event" .

:mitigationDFM-1349
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1349: Manually verify the artifacts used for an event reconstruction"@en ;
    solveit-core:mitigationID "DFM-1349" ;
    solveit-core:mitigationName "Manually verify the artifacts used for an event reconstruction" ;
    solveit-core:linksToTechnique :techniqueDFT-1202 .

:mitigationDFM-1350
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1350: Ensure that tools producing data supporting event reconstruction report any potential uncertainty in their results"@en ;
    solveit-core:mitigationID "DFM-1350" ;
    solveit-core:mitigationName "Ensure that tools producing data supporting event reconstruction report any potential uncertainty in their results" .

:mitigationDFM-1351
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1351: Ensure that raw data is decoded as the correct data type"@en ;
    solveit-core:mitigationID "DFM-1351" ;
    solveit-core:mitigationName "Ensure that raw data is decoded as the correct data type" .

:mitigationDFM-1352
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1352: Ensure the correct number of bytes are used when decoding raw data into values"@en ;
    solveit-core:mitigationID "DFM-1352" ;
    solveit-core:mitigationName "Ensure the correct number of bytes are used when decoding raw data into values" .

:mitigationDFM-1353
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1353: Ensure the correct endianness was used when decoding raw data into values"@en ;
    solveit-core:mitigationID "DFM-1353" ;
    solveit-core:mitigationName "Ensure the correct endianness was used when decoding raw data into values" .

:mitigationDFM-1354
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1354: Ensure the correct signed/unsigned property is applied when decoding raw data into values"@en ;
    solveit-core:mitigationID "DFM-1354" ;
    solveit-core:mitigationName "Ensure the correct signed/unsigned property is applied when decoding raw data into values" .

:mitigationDFM-1355
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1355: Ensure the correct endianness was used for value decoding"@en ;
    solveit-core:mitigationID "DFM-1355" ;
    solveit-core:mitigationName "Ensure the correct endianness was used for value decoding" .

:mitigationDFM-1356
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1356: Ensure that any potential imprecision in decoding is also included when decoded values are presented"@en ;
    solveit-core:mitigationID "DFM-1356" ;
    solveit-core:mitigationName "Ensure that any potential imprecision in decoding is also included when decoded values are presented" .

:mitigationDFM-1363
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1363: Test that examiner-entered metadata is correctly written by the acquisition software along with the forensic container"@en ;
    solveit-core:mitigationID "DFM-1363" ;
    solveit-core:mitigationName "Test that examiner-entered metadata is correctly written by the acquisition software along with the forensic container" .

:mitigationDFM-1364
    a solveit-core:Mitigation ;
    rdfs:label "DFM-1364: Test that hashes computed of data stored within a container are written correctly by the acquisition software along with the forensic container"@en ;
    solveit-core:mitigationID "DFM-1364" ;
    solveit-core:mitigationName "Test that hashes computed of data stored within a container are written correctly by the acquisition software along with the forensic container" .

#################################################################
#    Citations (164)
#
#    Reference sources, cited by DFCite id from techniques, weaknesses
#    and mitigations.
#################################################################

:citationDFCite-1001
    a solveit-core:Citation ;
    rdfs:label "DFCite-1001" ;
    solveit-core:citationID "DFCite-1001" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex """@misc{brignoni_aleapp_adb_hosts,
  author = {Brignoni, Alexis},
  title = {ALEAPP adb\\_hosts.py},
  year = {n.d.},
  url = {https://github.com/abrignoni/ALEAPP/blob/main/scripts/artifacts/adb_hosts.py},
  note = {Android Logs Events And Protobuf Parser (ALEAPP) artifact script}
}""" .

:citationDFCite-1002
    a solveit-core:Citation ;
    rdfs:label "DFCite-1002" ;
    solveit-core:citationID "DFCite-1002" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex """@article{alam2024sift,
  title={SIFT: Sifting file types—application of explainable artificial intelligence in cyber forensics},
  author={Alam, Shahid and Demir, Alper Kamil},
  journal={Cybersecurity},
  volume={7},
  number={1},
  pages={52},
  year={2024},
  publisher={Springer}
}""" .

:citationDFCite-1003
    a solveit-core:Citation ;
    rdfs:label "DFCite-1003" ;
    solveit-core:citationID "DFCite-1003" ;
    solveit-core:citationPlaintext "Android (2025), Android Debug Bridge (adb), https://developer.android.com/tools/adb" ;
    solveit-core:citationBibtex """@misc{android_adb,
  author = {{Android Developers}},
  title = {Android Debug Bridge (adb)},
  year = {2025},
  url = {https://developer.android.com/tools/adb},
  note = {Official Android developer documentation for ADB}
}""" .

:citationDFCite-1004
    a solveit-core:Citation ;
    rdfs:label "DFCite-1004" ;
    solveit-core:citationID "DFCite-1004" ;
    solveit-core:citationPlaintext "Android (2025), How to Enable Android Developer Settings: Unlock your Device’s Hidden Potential, https://www.android.com/intl/en_uk/articles/enable-android-developer-settings/" .

:citationDFCite-1005
    a solveit-core:Citation ;
    rdfs:label "DFCite-1005" ;
    solveit-core:citationID "DFCite-1005" ;
    solveit-core:citationPlaintext "Apple (2025) View and restore past versions of documents on Mac https://support.apple.com/en-gb/guide/mac-help/mh40710/mac" .

:citationDFCite-1006
    a solveit-core:Citation ;
    rdfs:label "DFCite-1006" ;
    solveit-core:citationID "DFCite-1006" ;
    solveit-core:citationPlaintext "Autopsy Interesting File module, https://sleuthkit.org/autopsy/docs/user-docs/3.1/interesting_page.html" .

:citationDFCite-1007
    a solveit-core:Citation ;
    rdfs:label "DFCite-1007" ;
    solveit-core:citationID "DFCite-1007" ;
    solveit-core:citationPlaintext "Basis Technology (2015), Extension Mismatch Detector Module, https://sleuthkit.org/autopsy/docs/user-docs/3.1/extension_mismatch_detector_page.html" .

:citationDFCite-1008
    a solveit-core:Citation ;
    rdfs:label "DFCite-1008" ;
    solveit-core:citationID "DFCite-1008" ;
    solveit-core:citationPlaintext "Basis Technology 2019, Reporting, https://sleuthkit.org/autopsy/docs/user-docs/4.12.0/reporting_page.html" .

:citationDFCite-1009
    a solveit-core:Citation ;
    rdfs:label "DFCite-1009" ;
    solveit-core:citationID "DFCite-1009" ;
    solveit-core:citationPlaintext "Basis Technology 2019, Tagging, https://sleuthkit.org/autopsy/docs/user-docs/4.12.0/tagging_page.html" .

:citationDFCite-1010
    a solveit-core:Citation ;
    rdfs:label "DFCite-1010" ;
    solveit-core:citationID "DFCite-1010" ;
    solveit-core:citationPlaintext "Basis Technology 2020, Autopsy User Documentation: Geolocation Overview, https://sleuthkit.org/autopsy/docs/user-docs/4.13.0/geolocation_page.html" .

:citationDFCite-1011
    a solveit-core:Citation ;
    rdfs:label "DFCite-1011" ;
    solveit-core:citationID "DFCite-1011" ;
    solveit-core:citationPlaintext "Basis Technology 2025, PhotoRec Carver Module, https://sleuthkit.org/autopsy/docs/user-docs/4.22.0/photorec_carver_page.html" .

:citationDFCite-1012
    a solveit-core:Citation ;
    rdfs:label "DFCite-1012" ;
    solveit-core:citationID "DFCite-1012" ;
    solveit-core:citationPlaintext "Bayor, L., Weinert, C., Maier, C. and Weitzel, T., 2025. Social-Oriented Communication with AI Companions: Benefits, Costs, and Contextual Patterns. Business & Information Systems Engineering, pp.1-19." .

:citationDFCite-1013
    a solveit-core:Citation ;
    rdfs:label "DFCite-1013" ;
    solveit-core:citationID "DFCite-1013" ;
    solveit-core:citationPlaintext "Beebe, N.L. and Clark, J.G., 2007. Digital forensic text string searching: Improving information retrieval effectiveness by thematically clustering search results. Digital investigation, 4, pp.49-54." .

:citationDFCite-1014
    a solveit-core:Citation ;
    rdfs:label "DFCite-1014" ;
    solveit-core:citationID "DFCite-1014" ;
    solveit-core:citationPlaintext "Beebe, N.L. and Liu, L., 2014. Ranking algorithms for digital forensic string search hits. Digital Investigation, 11, pp.S124-S132." .

:citationDFCite-1015
    a solveit-core:Citation ;
    rdfs:label "DFCite-1015" ;
    solveit-core:citationID "DFCite-1015" ;
    solveit-core:citationPlaintext "Belkasoft (undated) Dealing with Apple's USB Restricted Mode, https://belkasoft.com/dealing_with_usb_restricted_mode" .

:citationDFCite-1016
    a solveit-core:Citation ;
    rdfs:label "DFCite-1016" ;
    solveit-core:citationID "DFCite-1016" ;
    solveit-core:citationPlaintext "Belkasoft https://belkasoft.com/agent_based_ios_acquisition" .

:citationDFCite-1017
    a solveit-core:Citation ;
    rdfs:label "DFCite-1017" ;
    solveit-core:citationID "DFCite-1017" ;
    solveit-core:citationPlaintext "Berggren at al. (2014) TimeSketch, https://timesketch.org" .

:citationDFCite-1018
    a solveit-core:Citation ;
    rdfs:label "DFCite-1018" ;
    solveit-core:citationID "DFCite-1018" ;
    solveit-core:citationPlaintext "Birzer, M.L., 2018. Crime Scene Search. Introduction to Criminal Investigation, p.35." .

:citationDFCite-1019
    a solveit-core:Citation ;
    rdfs:label "DFCite-1019" ;
    solveit-core:citationID "DFCite-1019" ;
    solveit-core:citationPlaintext "Breitinger, F., Studiawan, H. and Hargreaves, C., 2025. SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges." .

:citationDFCite-1020
    a solveit-core:Citation ;
    rdfs:label "DFCite-1020" ;
    solveit-core:citationID "DFCite-1020" ;
    solveit-core:citationPlaintext "C. Vanini, C. Hargreaves, H. van Beek, F. Breitinger, 2024, Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction, Forensic Science International: Digital Investigation, 10.1016/j.fsidi.2024.301759" ;
    solveit-core:citationBibtex """@article{vanini2024clocks,
title = {Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction},
journal = {Forensic Science International: Digital Investigation},
volume = {49},
pages = {301759},
year = {2024},
issn = {2666-2817},
doi = {https://doi.org/10.1016/j.fsidi.2024.301759},
url = {https://www.sciencedirect.com/science/article/pii/S2666281724000787},
author = {Céline Vanini and Christopher J. Hargreaves and Harm {van Beek} and Frank Breitinger}
}""" .

:citationDFCite-1021
    a solveit-core:Citation ;
    rdfs:label "DFCite-1021" ;
    solveit-core:citationID "DFCite-1021" ;
    solveit-core:citationPlaintext "Caithness 2012, The Forensic Implications of SQLite’s Write Ahead Log, https://digitalinvestigation.wordpress.com/2012/05/04/the-forensic-implications-of-sqlites-write-ahead-log/" .

:citationDFCite-1022
    a solveit-core:Citation ;
    rdfs:label "DFCite-1022" ;
    solveit-core:citationID "DFCite-1022" ;
    solveit-core:citationPlaintext "Caithness 2024, Time travelling with SQLite Journals and WAL, https://www.cclsolutionsgroup.com/post/time-travelling-with-sqlite-journals-and-wal" .

:citationDFCite-1023
    a solveit-core:Citation ;
    rdfs:label "DFCite-1023" ;
    solveit-core:citationID "DFCite-1023" ;
    solveit-core:citationPlaintext "Campbell, W., 2013. Volatile memory acquisition tools–A comparison across taint and correctness. 11th Australian Digital Forensics Conference. Edith Cowan University, Perth, Western Australia." .

:citationDFCite-1024
    a solveit-core:Citation ;
    rdfs:label "DFCite-1024" ;
    solveit-core:citationID "DFCite-1024" ;
    solveit-core:citationPlaintext "Carrier, B., 2005. File system forensic analysis. Addison-Wesley Professional." .

:citationDFCite-1025
    a solveit-core:Citation ;
    rdfs:label "DFCite-1025" ;
    solveit-core:citationID "DFCite-1025" ;
    solveit-core:citationPlaintext "Case, A. and Richard III, G. G., 2017. Memory forensics: The path forward. Digital investigation, 20, 23-33." .

:citationDFCite-1026
    a solveit-core:Citation ;
    rdfs:label "DFCite-1026" ;
    solveit-core:citationID "DFCite-1026" ;
    solveit-core:citationPlaintext "Casey et al (2011) The growing impact of full disk encryption on digital forensics, https://www.sciencedirect.com/science/article/abs/pii/S1742287611000727?via%3Dihub" .

:citationDFCite-1027
    a solveit-core:Citation ;
    rdfs:label "DFCite-1027" ;
    solveit-core:citationID "DFCite-1027" ;
    solveit-core:citationPlaintext "Casey, E. and Jaquet-Chiffelle, D.O., 2019. Do identities matter?. Policing: A Journal of Policy and Practice, 13(1), pp.21-34." .

:citationDFCite-1028
    a solveit-core:Citation ;
    rdfs:label "DFCite-1028" ;
    solveit-core:citationID "DFCite-1028" ;
    solveit-core:citationPlaintext "Casey, E., 2011. Digital evidence and computer crime: Forensic science, computers, and the internet. Academic press, Section 8.1.2" .

:citationDFCite-1029
    a solveit-core:Citation ;
    rdfs:label "DFCite-1029" ;
    solveit-core:citationID "DFCite-1029" ;
    solveit-core:citationPlaintext "Casey, E., 2011. Digital evidence and computer crime: Forensic science, computers, and the internet. Academic press, Section 8.1.3" .

:citationDFCite-1030
    a solveit-core:Citation ;
    rdfs:label "DFCite-1030" ;
    solveit-core:citationID "DFCite-1030" ;
    solveit-core:citationPlaintext "Casey, E., Nelson, A. and Hyde, J., 2019. Standardization of file recovery classification and authentication. Digital Investigation, 31, p.100873." .

:citationDFCite-1031
    a solveit-core:Citation ;
    rdfs:label "DFCite-1031" ;
    solveit-core:citationID "DFCite-1031" ;
    solveit-core:citationPlaintext "Cellebrite (undated), Full File System Extraction - Mobile Device Forensics, https://cellebrite.com/en/glossary/full-file-system-extraction-mobile-device-forensics/" .

:citationDFCite-1032
    a solveit-core:Citation ;
    rdfs:label "DFCite-1032" ;
    solveit-core:citationID "DFCite-1032" ;
    solveit-core:citationPlaintext "Chivers, H., 2014. Private browsing: A window of forensic opportunity. Digital Investigation, 11(1), pp.20-29." .

:citationDFCite-1033
    a solveit-core:Citation ;
    rdfs:label "DFCite-1033" ;
    solveit-core:citationID "DFCite-1033" ;
    solveit-core:citationPlaintext "Claij-Swart et al. (2025), PUMA (Programmable Utility for Mobile Automation), https://github.com/NetherlandsForensicInstitute/puma" .

:citationDFCite-1034
    a solveit-core:Citation ;
    rdfs:label "DFCite-1034" ;
    solveit-core:citationID "DFCite-1034" ;
    solveit-core:citationPlaintext "Claij-Swart, A.A., Oudsen, E., Timbermont, B., Hargreaves, C. and Voigt, L.L., 2025. Automatically generating digital forensic reference data triggered by mobile application updates. Forensic Science International: Digital Investigation, 54, p.301985." .

:citationDFCite-1035
    a solveit-core:Citation ;
    rdfs:label "DFCite-1035" ;
    solveit-core:citationID "DFCite-1035" ;
    solveit-core:citationPlaintext "Cohen, M., Garfinkel, S. and Schatz, B., 2009. Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow. digital investigation, 6, pp.S57-S68." .

:citationDFCite-1036
    a solveit-core:Citation ;
    rdfs:label "DFCite-1036" ;
    solveit-core:citationID "DFCite-1036" ;
    solveit-core:citationPlaintext "DSTL Digital Forensics Bulletin, TRIM & Garbage Collection on SSDs, Edition 27, July 2024 DSTL/PUB160897, https://mailchi.mp/3b5bda81ff5f/digital-forensic-bulletin-edition27-trim-and-garbage-collection-on-ssds9445401" .

:citationDFCite-1037
    a solveit-core:Citation ;
    rdfs:label "DFCite-1037" ;
    solveit-core:citationID "DFCite-1037" ;
    solveit-core:citationPlaintext "Dickinson (2020) ‘Privacy by design – 10 ways MSAB can help you meet the challenges.’ MSAB Blog. Available at: https://www.msab.com/blog/privacy-by-design-10-ways-msab-can-help-you-meet-the-challenges/" .

:citationDFCite-1038
    a solveit-core:Citation ;
    rdfs:label "DFCite-1038" ;
    solveit-core:citationID "DFCite-1038" ;
    solveit-core:citationPlaintext "Digital Detective Knowledgebase https://kb.digital-detective.net/display/BF" .

:citationDFCite-1039
    a solveit-core:Citation ;
    rdfs:label "DFCite-1039" ;
    solveit-core:citationID "DFCite-1039" ;
    solveit-core:citationPlaintext "Dreier, L.M., Vanini, C., Hargreaves, C.J., Breitinger, F. and Freiling, F., 2024. Beyond timestamps: Integrating implicit timing information into digital forensic timelines. Forensic Science International: Digital Investigation, 49, p.301755." .

:citationDFCite-1040
    a solveit-core:Citation ;
    rdfs:label "DFCite-1040" ;
    solveit-core:citationID "DFCite-1040" ;
    solveit-core:citationPlaintext "Dubettier, A., Gernot, T., Giguet, E. and Rosenberger, C., 2023. File type identification tools for digital investigations. Forensic Science International: Digital Investigation, 46, p.301574." .

:citationDFCite-1041
    a solveit-core:Citation ;
    rdfs:label "DFCite-1041" ;
    solveit-core:citationID "DFCite-1041" ;
    solveit-core:citationPlaintext "Elcomsoft 20203 https://blog.elcomsoft.com/2023/07/ios-device-acquisition-installing-the-extraction-agent/" .

:citationDFCite-1042
    a solveit-core:Citation ;
    rdfs:label "DFCite-1042" ;
    solveit-core:citationID "DFCite-1042" ;
    solveit-core:citationPlaintext "Elcomsoft 2021, Forensically Sound checkm8 Based Extraction of iPhone 5s, 6, 6s and SE, https://blog.elcomsoft.com/2021/05/checkm8-based-extraction-of-iphone-5s-6-6s-and-se/" .

:citationDFCite-1043
    a solveit-core:Citation ;
    rdfs:label "DFCite-1043" ;
    solveit-core:citationID "DFCite-1043" ;
    solveit-core:citationPlaintext "Fisher & Fisher. 2012, Techniques of Crime Scene Investigation, Eighth Edition, p82" .

:citationDFCite-1044
    a solveit-core:Citation ;
    rdfs:label "DFCite-1044" ;
    solveit-core:citationID "DFCite-1044" ;
    solveit-core:citationPlaintext "Forensic Science Regulator (2025) Incident scene examination (FSR-GUI-0006). GOV.UK. Available at: https://www.gov.uk/government/publications/incident-scene-examination-fsr-gui-0006" .

:citationDFCite-1045
    a solveit-core:Citation ;
    rdfs:label "DFCite-1045" ;
    solveit-core:citationID "DFCite-1045" ;
    solveit-core:citationPlaintext "Fukami, A., Stoykova, R. and Geradts, Z., 2021. A new model for forensic data extraction from encrypted mobile devices. Forensic Science International: Digital Investigation, 38, p.301169." .

:citationDFCite-1046
    a solveit-core:Citation ;
    rdfs:label "DFCite-1046" ;
    solveit-core:citationID "DFCite-1046" ;
    solveit-core:citationPlaintext "Geus, J., Gruber, J., Wozar, J. and Freiling, F., 2025. From sync to seizure: A binary instrumentation-based evaluation of the iCloud backup process. Forensic Science International: Digital Investigation, 54, p.301978." .

:citationDFCite-1047
    a solveit-core:Citation ;
    rdfs:label "DFCite-1047" ;
    solveit-core:citationID "DFCite-1047" ;
    solveit-core:citationPlaintext "Google (2025) Content provider basics. Available at: https://developer.android.com/guide/topics/providers/content-provider-basics." .

:citationDFCite-1048
    a solveit-core:Citation ;
    rdfs:label "DFCite-1048" ;
    solveit-core:citationID "DFCite-1048" ;
    solveit-core:citationPlaintext "Grenier (2023) PhotoRec, https://www.cgsecurity.org/wiki/PhotoRec" .

:citationDFCite-1049
    a solveit-core:Citation ;
    rdfs:label "DFCite-1049" ;
    solveit-core:citationID "DFCite-1049" ;
    solveit-core:citationPlaintext "Grover, J., 2013. Android forensics: Automated data collection and reporting from a mobile device. Digital Investigation, 10, pp.S12-S20." .

:citationDFCite-1050
    a solveit-core:Citation ;
    rdfs:label "DFCite-1050" ;
    solveit-core:citationID "DFCite-1050" ;
    solveit-core:citationPlaintext "Groß, T., Dirauf, R. and Freiling, F., 2020, May. Systematic analysis of browser history evidence. In 2020 13th International Conference on Systematic Approaches to Digital Forensic Engineering (SADFE) (pp. 1-12). IEEE." .

:citationDFCite-1051
    a solveit-core:Citation ;
    rdfs:label "DFCite-1051" ;
    solveit-core:citationID "DFCite-1051" ;
    solveit-core:citationPlaintext "Gruhn, M. and Freiling, F.C., 2016. Evaluating atomicity, and integrity of correct memory acquisition methods. Digital Investigation, 16, S1-S10." .

:citationDFCite-1052
    a solveit-core:Citation ;
    rdfs:label "DFCite-1052" ;
    solveit-core:citationID "DFCite-1052" ;
    solveit-core:citationPlaintext "Gupta, M.R., Hoeschele, M.D. and Rogers, M.K., 2006. Hidden disk areas: HPA and DCO. International Journal of Digital Evidence, 5(1), pp.1-8." .

:citationDFCite-1053
    a solveit-core:Citation ;
    rdfs:label "DFCite-1053" ;
    solveit-core:citationID "DFCite-1053" ;
    solveit-core:citationPlaintext "Halderman, J.A., Schoen, S.D., Heninger, N., Clarkson, W., Paul, W., Calandrino, J.A., Feldman, A.J., Appelbaum, J. and Felten, E.W., 2009. Lest we remember: cold-boot attacks on encryption keys. Communications of the ACM, 52(5), pp.91-98." .

:citationDFCite-1054
    a solveit-core:Citation ;
    rdfs:label "DFCite-1054" ;
    solveit-core:citationID "DFCite-1054" ;
    solveit-core:citationPlaintext "Hargreaves & Chivers 2008b. Avoiding Live Imaging of Large Encrypted Volumes by Recovering Keys from Memory, Proceedings from 3rd Advances in Computer Security and Forensics" .

:citationDFCite-1055
    a solveit-core:Citation ;
    rdfs:label "DFCite-1055" ;
    solveit-core:citationID "DFCite-1055" ;
    solveit-core:citationPlaintext "Hargreaves & Drury, 2025, Forensic Analysis of AI Applications: A Replika \"AI Companion\" example, WSDF 2025" .

:citationDFCite-1056
    a solveit-core:Citation ;
    rdfs:label "DFCite-1056" ;
    solveit-core:citationID "DFCite-1056" ;
    solveit-core:citationPlaintext "Hargreaves, C. and Chivers, H., 2008, March. Recovery of encryption keys from memory using a linear scan. In 2008 Third International Conference on Availability, Reliability and Security (pp. 1369-1376). IEEE." .

:citationDFCite-1057
    a solveit-core:Citation ;
    rdfs:label "DFCite-1057" ;
    solveit-core:citationID "DFCite-1057" ;
    solveit-core:citationPlaintext "Hargreaves, C. and Marshall, A., 2019. SyncTriage: Using synchronisation artefacts to optimise acquisition order. Digital Investigation, 28, pp.S134-S140." .

:citationDFCite-1058
    a solveit-core:Citation ;
    rdfs:label "DFCite-1058" ;
    solveit-core:citationID "DFCite-1058" ;
    solveit-core:citationPlaintext "Hargreaves, C. and Patterson, J., 2012. An automated timeline reconstruction approach for digital forensic investigations. Digital Investigation, 9, pp.S69-S79." .

:citationDFCite-1059
    a solveit-core:Citation ;
    rdfs:label "DFCite-1059" ;
    solveit-core:citationID "DFCite-1059" ;
    solveit-core:citationPlaintext "Hargreaves, C., Chivers, H. and Titheridge, D., 2008. Windows Vista and digital investigations. Digital Investigation, 5(1-2), pp.34-48." .

:citationDFCite-1060
    a solveit-core:Citation ;
    rdfs:label "DFCite-1060" ;
    solveit-core:citationID "DFCite-1060" ;
    solveit-core:citationPlaintext "Hargreaves, C., Nelson, A. and Casey, E., 2024. An abstract model for digital forensic analysis tools-A foundation for systematic error mitigation analysis. Forensic Science International: Digital Investigation, 48, p.301679." .

:citationDFCite-1061
    a solveit-core:Citation ;
    rdfs:label "DFCite-1061" ;
    solveit-core:citationID "DFCite-1061" ;
    solveit-core:citationPlaintext "Hargreaves, C., Repository for 'An abstract model for digital forensic analysis tools - A foundation for systematic error mitigation analysis', https://github.com/chrishargreaves/digital-forensic-tool-abstractions/tree/main" .

:citationDFCite-1062
    a solveit-core:Citation ;
    rdfs:label "DFCite-1062" ;
    solveit-core:citationID "DFCite-1062" ;
    solveit-core:citationPlaintext "Hargreaves, C.J., 2009. Assessing the reliability of digital evidence from live investigations involving encryption. Chapter 5" .

:citationDFCite-1063
    a solveit-core:Citation ;
    rdfs:label "DFCite-1063" ;
    solveit-core:citationID "DFCite-1063" ;
    solveit-core:citationPlaintext "Hargreaves, C.J., 2009. Assessing the reliability of digital evidence from live investigations involving encryption. Chapter 6" .

:citationDFCite-1064
    a solveit-core:Citation ;
    rdfs:label "DFCite-1064" ;
    solveit-core:citationID "DFCite-1064" ;
    solveit-core:citationPlaintext "Horsman, G., 2018. I didn't see that! An examination of internet browser cache behaviour following website visits. Digital Investigation, 25, pp.105-113." .

:citationDFCite-1065
    a solveit-core:Citation ;
    rdfs:label "DFCite-1065" ;
    solveit-core:citationID "DFCite-1065" ;
    solveit-core:citationPlaintext "Horsman, G., 2019. A forensic examination of online search facility URL record structures. Journal of forensic sciences, 64(1), pp.236-242." .

:citationDFCite-1066
    a solveit-core:Citation ;
    rdfs:label "DFCite-1066" ;
    solveit-core:citationID "DFCite-1066" ;
    solveit-core:citationPlaintext "Horsman, G., 2020. The challenge of identifying historic ‘private browsing’sessions on suspect devices. Forensic Science International: Digital Investigation, 34, p.300980." .

:citationDFCite-1067
    a solveit-core:Citation ;
    rdfs:label "DFCite-1067" ;
    solveit-core:citationID "DFCite-1067" ;
    solveit-core:citationPlaintext "Hoy, J., 2023. Forensic radio survey techniques for cell site analysis. John Wiley & Sons." .

:citationDFCite-1068
    a solveit-core:Citation ;
    rdfs:label "DFCite-1068" ;
    solveit-core:citationID "DFCite-1068" ;
    solveit-core:citationPlaintext "ISO 21043-5:2025 - Forensic sciences — Part 5: Reporting" .

:citationDFCite-1069
    a solveit-core:Citation ;
    rdfs:label "DFCite-1069" ;
    solveit-core:citationID "DFCite-1069" ;
    solveit-core:citationPlaintext "Im, S., Park, H., Joun, J., Lee, S. and Park, J., 2024. Revisiting logical image formats for future digital forensics: A comprehensive analysis on L01 and AFF4-L. Forensic Science International: Digital Investigation, 50" .

:citationDFCite-1070
    a solveit-core:Citation ;
    rdfs:label "DFCite-1070" ;
    solveit-core:citationID "DFCite-1070" ;
    solveit-core:citationPlaintext "International Organization for Standardization (ISO) (2015) ISO/IEC 27042:2015 Guidelines for the analysis and interpretation of digital evidence." .

:citationDFCite-1071
    a solveit-core:Citation ;
    rdfs:label "DFCite-1071" ;
    solveit-core:citationID "DFCite-1071" ;
    solveit-core:citationPlaintext "Interpol (2021), Guidelines for digital forensics first responders v7, Ch5 Specific Procedures p34, https://www.interpol.int/content/download/16243/file/Guidelines_to_Digital_Forensics_First_Responders_V7.pdf" .

:citationDFCite-1072
    a solveit-core:Citation ;
    rdfs:label "DFCite-1072" ;
    solveit-core:citationID "DFCite-1072" ;
    solveit-core:citationPlaintext "Jenny Ottmann, Üsame Cengiz, Frank Breitinger, and Felix Freiling, 2023. As if Time Had Stopped – Checking Memory Dumps for Quasi-Instantaneous Consistency. In Proceedings of the Digital Forensics Research Conference USA (DFRWS USA), Baltimore, MD, July 2023." .

:citationDFCite-1073
    a solveit-core:Citation ;
    rdfs:label "DFCite-1073" ;
    solveit-core:citationID "DFCite-1073" ;
    solveit-core:citationPlaintext "Jens-Petter Sandvik, André Årnes, 2018. The reliability of clocks as digital evidence under low voltage conditions. Digital Investigation, 24, pp.S10-S17." .

:citationDFCite-1074
    a solveit-core:Citation ;
    rdfs:label "DFCite-1074" ;
    solveit-core:citationID "DFCite-1074" ;
    solveit-core:citationPlaintext "Kanta, A. and Hargreaves, C., 2025, August. Measuring the effectiveness of keyword lists in digital forensics. In Proceedings of the 20th International Conference on Availability, Reliability and Security." .

:citationDFCite-1075
    a solveit-core:Citation ;
    rdfs:label "DFCite-1075" ;
    solveit-core:citationID "DFCite-1075" ;
    solveit-core:citationPlaintext "Kanta, A., Coisel, I. and Scanlon, M., 2021, December. PCWQ: A framework for evaluating password cracking wordlist quality. In International Conference on Digital Forensics and Cyber Crime (pp. 159-175). Cham: Springer International Publishing." .

:citationDFCite-1076
    a solveit-core:Citation ;
    rdfs:label "DFCite-1076" ;
    solveit-core:citationID "DFCite-1076" ;
    solveit-core:citationPlaintext "Kanta, A., Coisel, I. and Scanlon, M., 2023. Harder, better, faster, stronger: Optimising the performance of context-based password cracking dictionaries. Forensic Science International: Digital Investigation, 44, p.301507." .

:citationDFCite-1077
    a solveit-core:Citation ;
    rdfs:label "DFCite-1077" ;
    solveit-core:citationID "DFCite-1077" ;
    solveit-core:citationPlaintext "Kanta, A., Coray, S., Coisel, I. and Scanlon, M., 2021. How viable is password cracking in digital forensic investigation? Analyzing the guessability of over 3.9 billion real-world accounts. Forensic Science International: Digital Investigation, 37, p.301186." .

:citationDFCite-1078
    a solveit-core:Citation ;
    rdfs:label "DFCite-1078" ;
    solveit-core:citationID "DFCite-1078" ;
    solveit-core:citationPlaintext "Karampidis, K. and Papadourakis, G., 2017. File type identification-computational intelligence for digital forensics. Journal of Digital Forensics, Security and Law, 12(2), p.6." .

:citationDFCite-1079
    a solveit-core:Citation ;
    rdfs:label "DFCite-1079" ;
    solveit-core:citationID "DFCite-1079" ;
    solveit-core:citationPlaintext "Kemmerich, T., Junge, F., Kuntze, N., Rudolph, C., Endicott-Popovsky, B. and Großkopf, L., 2014. Generation and handling of hard drive duplicates as piece of evidence." .

:citationDFCite-1080
    a solveit-core:Citation ;
    rdfs:label "DFCite-1080" ;
    solveit-core:citationID "DFCite-1080" ;
    solveit-core:citationPlaintext "Kent, K., Chevalier, S., Grance, T. & Dang, H. (2006) Guide to Integrating Forensic Techniques into Incident Response. NIST Special Publication 800‑86. National Institute of Standards and Technology (NIST). Available at: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf" .

:citationDFCite-1081
    a solveit-core:Citation ;
    rdfs:label "DFCite-1081" ;
    solveit-core:citationID "DFCite-1081" ;
    solveit-core:citationPlaintext "Kessler GC. The impact of SHA-1 file hash collisions on digital forensic imaging: A follow-up experiment. Journal of Digital Forensics, Security and Law. 2016;11(4):10." .

:citationDFCite-1082
    a solveit-core:Citation ;
    rdfs:label "DFCite-1082" ;
    solveit-core:citationID "DFCite-1082" ;
    solveit-core:citationPlaintext "Kessler, G.C., 2007. Anti-forensics and the digital investigator." .

:citationDFCite-1083
    a solveit-core:Citation ;
    rdfs:label "DFCite-1083" ;
    solveit-core:citationID "DFCite-1083" ;
    solveit-core:citationPlaintext "Kessler, G.C., 2016. The impact of MD5 file hash collisions on digital forensic imaging. Journal of digital forensics, security and law, 11(4), p.9." .

:citationDFCite-1084
    a solveit-core:Citation ;
    rdfs:label "DFCite-1084" ;
    solveit-core:citationID "DFCite-1084" ;
    solveit-core:citationPlaintext "Kornblum, J.D., 2007. Using every part of the buffalo in Windows memory analysis. Digital Investigation, 4(1), pp.24-29." .

:citationDFCite-1085
    a solveit-core:Citation ;
    rdfs:label "DFCite-1085" ;
    solveit-core:citationID "DFCite-1085" ;
    solveit-core:citationPlaintext "Latzo, T., Palutke, R. and Freiling, F., 2019. A universal taxonomy and survey of forensic memory acquisition techniques. Digital Investigation, 28, 56-69." .

:citationDFCite-1086
    a solveit-core:Citation ;
    rdfs:label "DFCite-1086" ;
    solveit-core:citationID "DFCite-1086" ;
    solveit-core:citationPlaintext "Lennox-Steele, A., & Nisbet, A. (2016). A forensic examination of several mobile device Faraday bags & materials to test their effectiveness. In Valli, C. (Ed.). (2016). The Proceedings of 14th Australian Digital Forensics Conference, 5-6 December 2016, Edith Cowan University, Perth, Australia. (pp 34-41)." .

:citationDFCite-1087
    a solveit-core:Citation ;
    rdfs:label "DFCite-1087" ;
    solveit-core:citationID "DFCite-1087" ;
    solveit-core:citationPlaintext "Leschke, T.R. and Nicholas, C., 2013, October. Change-link 2.0: a digital forensic tool for visualizing changes to shadow volume data. In Proceedings of the Tenth Workshop on Visualization for Cyber Security (pp. 17-24)." .

:citationDFCite-1088
    a solveit-core:Citation ;
    rdfs:label "DFCite-1088" ;
    solveit-core:citationID "DFCite-1088" ;
    solveit-core:citationPlaintext "Lyle, J., 2002. Testing disk imaging tools. DFRWS USA 2002, https://dfrws.org/wp-content/uploads/2019/06/2002_USA_paper-testing_disk_imaging_tools.pdf" .

:citationDFCite-1089
    a solveit-core:Citation ;
    rdfs:label "DFCite-1089" ;
    solveit-core:citationID "DFCite-1089" ;
    solveit-core:citationPlaintext "Lyle, J.R., 2006. A strategy for testing hardware write block devices. digital investigation, 3, pp.3-9." .

:citationDFCite-1090
    a solveit-core:Citation ;
    rdfs:label "DFCite-1090" ;
    solveit-core:citationID "DFCite-1090" ;
    solveit-core:citationPlaintext "Magazinius, J., Rios, B.K. and Sabelfeld, A., 2013, November. Polyglots: crossing origins by crossing formats. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security (pp. 753-764)." .

:citationDFCite-1091
    a solveit-core:Citation ;
    rdfs:label "DFCite-1091" ;
    solveit-core:citationID "DFCite-1091" ;
    solveit-core:citationPlaintext "Magnet (2024) Revealing hidden data: Full file system extractions uncovered, https://www.magnetforensics.com/blog/revealing-hidden-data-full-file-system-extractions-uncovered/" .

:citationDFCite-1092
    a solveit-core:Citation ;
    rdfs:label "DFCite-1092" ;
    solveit-core:citationID "DFCite-1092" ;
    solveit-core:citationPlaintext "Magnet 2020, Using the Geolocation Data Filter in Magnet AXIOM & AXIOM Cyber, https://www.magnetforensics.com/blog/using-the-geolocation-data-filter-in-magnet-axiom-axiom-cyber/" .

:citationDFCite-1093
    a solveit-core:Citation ;
    rdfs:label "DFCite-1093" ;
    solveit-core:citationID "DFCite-1093" ;
    solveit-core:citationPlaintext "Magnet 2024, Moving in the right direction with Animated maps, https://www.magnetforensics.com/blog/moving-in-the-right-direction-with-animated-maps/" .

:citationDFCite-1094
    a solveit-core:Citation ;
    rdfs:label "DFCite-1094" ;
    solveit-core:citationID "DFCite-1094" ;
    solveit-core:citationPlaintext "Magnet Forensics (2019) Magnet Axiom Wordlist Generator. Magnet Forensics. Available at: https://www.magnetforensics.com/resources/magnet-axiom-wordlist-generator/" .

:citationDFCite-1095
    a solveit-core:Citation ;
    rdfs:label "DFCite-1095" ;
    solveit-core:citationID "DFCite-1095" ;
    solveit-core:citationPlaintext "Magnet Forensics (2019) Utilizing AXIOM Wordlist Generator to Optimize Handset Lock Code Breaking, Magnet Forensics, Available at: https://www.magnetforensics.com/blog/utilizing-axiom-wordlist-generator-to-optimize-handset-lock-code-breaking/" .

:citationDFCite-1096
    a solveit-core:Citation ;
    rdfs:label "DFCite-1096" ;
    solveit-core:citationID "DFCite-1096" ;
    solveit-core:citationPlaintext "Martignoni, L., Fattori, A., Paleari, R. and Cavallaro, L., 2010. Live and trustworthy forensic analysis of commodity production systems. In International Workshop on Recent Advances in Intrusion Detection (pp. 297-316). Berlin, Heidelberg: Springer Berlin Heidelberg." .

:citationDFCite-1097
    a solveit-core:Citation ;
    rdfs:label "DFCite-1097" ;
    solveit-core:citationID "DFCite-1097" ;
    solveit-core:citationPlaintext "McGee, J. (2022). An Alternate Location for Deleted SMS/iMessage Data in Apple Devices. DFIR Review. Retrieved from https://dfir.pubpub.org/pub/yp6efc8q" .

:citationDFCite-1098
    a solveit-core:Citation ;
    rdfs:label "DFCite-1098" ;
    solveit-core:citationID "DFCite-1098" ;
    solveit-core:citationPlaintext "McQuaid, J. (2017) Using Keywords with Magnet AXIOM, Magnet Forensics, https://www.magnetforensics.com/blog/using-keywords-with-magnet-axiom/" .

:citationDFCite-1099
    a solveit-core:Citation ;
    rdfs:label "DFCite-1099" ;
    solveit-core:citationID "DFCite-1099" ;
    solveit-core:citationPlaintext "Mendoza, A., Kumar, A., Midcap, D., Cho, H. and Varol, C., 2015. BrowStEx: A tool to aggregate browser storage artifacts for forensic analysis. Digital investigation, 14, pp.63-75." .

:citationDFCite-1100
    a solveit-core:Citation ;
    rdfs:label "DFCite-1100" ;
    solveit-core:citationID "DFCite-1100" ;
    solveit-core:citationPlaintext "Metz (2011), Windows Search forensics, https://www.forensicfocus.com/articles/windows-search-forensics/" .

:citationDFCite-1101
    a solveit-core:Citation ;
    rdfs:label "DFCite-1101" ;
    solveit-core:citationID "DFCite-1101" ;
    solveit-core:citationPlaintext "Mozillazine (2017), Profiles.ini file, https://kb.mozillazine.org/Profiles.ini_file" .

:citationDFCite-1102
    a solveit-core:Citation ;
    rdfs:label "DFCite-1102" ;
    solveit-core:citationID "DFCite-1102" ;
    solveit-core:citationPlaintext "NIST (2006) NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response, https://doi.org/10.6028/NIST.SP.800-86" .

:citationDFCite-1103
    a solveit-core:Citation ;
    rdfs:label "DFCite-1103" ;
    solveit-core:citationID "DFCite-1103" ;
    solveit-core:citationPlaintext "NIST, 2025. Computer forensics tools & techniques catalog: string search, https://toolcatalog.nist.gov/taxonomy/index.php?ff_id=31" .

:citationDFCite-1104
    a solveit-core:Citation ;
    rdfs:label "DFCite-1104" ;
    solveit-core:citationID "DFCite-1104" ;
    solveit-core:citationPlaintext "Nemetz, S., Schmitt, S. and Freiling, F., 2018. A standardized corpus for SQLite database forensics. Digital Investigation, 24, pp.S121-S130." .

:citationDFCite-1105
    a solveit-core:Citation ;
    rdfs:label "DFCite-1105" ;
    solveit-core:citationID "DFCite-1105" ;
    solveit-core:citationPlaintext "New msgstore – Who ‘Dis? A Look At An Updated WhatsApp On Android, https://thebinaryhick.blog/2022/06/09/new-msgstore-who-dis-a-look-at-an-updated-whatsapp-on-android/" .

:citationDFCite-1106
    a solveit-core:Citation ;
    rdfs:label "DFCite-1106" ;
    solveit-core:citationID "DFCite-1106" ;
    solveit-core:citationPlaintext "Nikkel, B., 2009. Forensic analysis of GPT disks and GUID partition tables. Digital Investigation, 6(1-2), pp.39-47." .

:citationDFCite-1107
    a solveit-core:Citation ;
    rdfs:label "DFCite-1107" ;
    solveit-core:citationID "DFCite-1107" ;
    solveit-core:citationPlaintext "Nikkel, B., 2016. Practical forensic imaging: securing digital evidence with Linux tools. No Starch Press, Chapter 6, “Forensic Image Acquisition" .

:citationDFCite-1108
    a solveit-core:Citation ;
    rdfs:label "DFCite-1108" ;
    solveit-core:citationID "DFCite-1108" ;
    solveit-core:citationPlaintext "Oh, J., Lee, S. and Lee, S., 2011. Advanced evidence collection and analysis of web browser activity. Digital investigation, 8, pp.S62-S70." .

:citationDFCite-1109
    a solveit-core:Citation ;
    rdfs:label "DFCite-1109" ;
    solveit-core:citationID "DFCite-1109" ;
    solveit-core:citationPlaintext "Oh, J., Lee, S. and Lee, S., 2011. Advanced evidence collection and analysis of web browser activity. Digital investigation, 8, pp.S62-S70., section 3.6" .

:citationDFCite-1110
    a solveit-core:Citation ;
    rdfs:label "DFCite-1110" ;
    solveit-core:citationID "DFCite-1110" ;
    solveit-core:citationPlaintext "Ottmann, J., Breitinger, F. and Freiling, F., 2024. An experimental assessment of inconsistencies in memory forensics. ACM Transactions on Privacy and Security (TOPS). 27, 2:1–2:29." .

:citationDFCite-1111
    a solveit-core:Citation ;
    rdfs:label "DFCite-1111" ;
    solveit-core:citationID "DFCite-1111" ;
    solveit-core:citationPlaintext "Pagani, F., Fedorov, O. and Balzarotti, D., 2019. Introducing the temporal dimension to memory forensics. ACM Transactions on Privacy and Security (TOPS), 22(2), 1-21." .

:citationDFCite-1112
    a solveit-core:Citation ;
    rdfs:label "DFCite-1112" ;
    solveit-core:citationID "DFCite-1112" ;
    solveit-core:citationPlaintext "Paladin Forensic Suite, https://sumuri.com/software/paladin/" .

:citationDFCite-1113
    a solveit-core:Citation ;
    rdfs:label "DFCite-1113" ;
    solveit-core:citationID "DFCite-1113" ;
    solveit-core:citationPlaintext "Pereira, M.T., 2009. Forensic analysis of the Firefox 3 Internet history and recovery of deleted SQLite records. Digital Investigation, 5(3-4), pp.93-103." .

:citationDFCite-1114
    a solveit-core:Citation ;
    rdfs:label "DFCite-1114" ;
    solveit-core:citationID "DFCite-1114" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex """@incollection{petersen2022dogs,
  title={Dogs as Detectors for Hidden Digital Storage Devices: A Pilot Study from the National Police of The Netherlands},
  author={Petersen, St{\\`e}phan J and Schoon, Adee},
  booktitle={Canines},
  pages={535--557},
  year={2022},
  publisher={Jenny Stanford Publishing}
}""" .

:citationDFCite-1115
    a solveit-core:Citation ;
    rdfs:label "DFCite-1115" ;
    solveit-core:citationID "DFCite-1115" ;
    solveit-core:citationPlaintext "Roussev, V., Quates, C. and Martell, R., 2013. Real-time digital forensics and triage. Digital Investigation, 10(2), pp.158-167." .

:citationDFCite-1116
    a solveit-core:Citation ;
    rdfs:label "DFCite-1116" ;
    solveit-core:citationID "DFCite-1116" ;
    solveit-core:citationPlaintext "Rzepka, L., Ottmann, J., Freiling, F. and Baier, H., 2024. Causal Inconsistencies are Normal in Windows Memory Dumps (too). Digital Threats: Research and Practice." .

:citationDFCite-1117
    a solveit-core:Citation ;
    rdfs:label "DFCite-1117" ;
    solveit-core:citationID "DFCite-1117" ;
    solveit-core:citationPlaintext "Schneider, J., Eichhorn, M., Dreier, L.M. and Hargreaves, C., 2024. Applying digital stratigraphy to the problem of recycled storage media. Forensic Science International: Digital Investigation, 49, p.301761." .

:citationDFCite-1118
    a solveit-core:Citation ;
    rdfs:label "DFCite-1118" ;
    solveit-core:citationID "DFCite-1118" ;
    solveit-core:citationPlaintext "Spichiger, H. and Adelstein, F., 2025. Preserving meaning of evidence from evolving systems. Forensic Science International: Digital Investigation, 52, p.301867." .

:citationDFCite-1119
    a solveit-core:Citation ;
    rdfs:label "DFCite-1119" ;
    solveit-core:citationID "DFCite-1119" ;
    solveit-core:citationPlaintext "Spichiger, H., 2025. Please mind the gap: A taxonomy for addressing the issue of linking person, account and device. Science & Justice, p.101314." .

:citationDFCite-1120
    a solveit-core:Citation ;
    rdfs:label "DFCite-1120" ;
    solveit-core:citationID "DFCite-1120" ;
    solveit-core:citationPlaintext "Sreeja, S.C. and Balan, C., 2016, October. Forensic analysis of volume shadow copy in windows 7. In 2016 International Conference on Emerging Technological Trends (ICETT) (pp. 1-6). IEEE." .

:citationDFCite-1121
    a solveit-core:Citation ;
    rdfs:label "DFCite-1121" ;
    solveit-core:citationID "DFCite-1121" ;
    solveit-core:citationPlaintext "Tart, M., Brodie, I., Gleed, N. and Matthews, J., 2012. Historic cell site analysis–Overview of principles and survey methodologies. Digital Investigation, 8(3-4), pp.185-193." .

:citationDFCite-1122
    a solveit-core:Citation ;
    rdfs:label "DFCite-1122" ;
    solveit-core:citationID "DFCite-1122" ;
    solveit-core:citationPlaintext "The Zeitgeist Project (2021) https://zeitgeist.freedesktop.org" .

:citationDFCite-1123
    a solveit-core:Citation ;
    rdfs:label "DFCite-1123" ;
    solveit-core:citationID "DFCite-1123" ;
    solveit-core:citationPlaintext "Time is not on our side when it comes to Messages in iOS 11, https://smarterforensics.com/2017/09/time-is-not-on-our-side-when-it-comes-to-messages-in-ios-11/" .

:citationDFCite-1124
    a solveit-core:Citation ;
    rdfs:label "DFCite-1124" ;
    solveit-core:citationID "DFCite-1124" ;
    solveit-core:citationPlaintext "Turner, P. The Remapped/Reallocated Sector Conundrum, Presentation at DFRWS US 2024, https://www.dfrws.org/wp-content/uploads/2023/07/turner-remappedsectors.pdf" .

:citationDFCite-1125
    a solveit-core:Citation ;
    rdfs:label "DFCite-1125" ;
    solveit-core:citationID "DFCite-1125" ;
    solveit-core:citationPlaintext "Tyler, J., 2012 p50. XDA Developers' Android Hacker's Toolkit: The Complete Guide to Rooting, ROMs and Theming. John Wiley & Sons" .

:citationDFCite-1126
    a solveit-core:Citation ;
    rdfs:label "DFCite-1126" ;
    solveit-core:citationID "DFCite-1126" ;
    solveit-core:citationPlaintext "V, Kethareswaran; Khurana, Surinder Singh; Singh, Parvinder (2021), “File Carving based Digital Forensic Tools Testing Data Sets (Contiguous Files)”, Mendeley Data, V3, doi: 10.17632/2kh2bdsp5b.3" .

:citationDFCite-1127
    a solveit-core:Citation ;
    rdfs:label "DFCite-1127" ;
    solveit-core:citationID "DFCite-1127" ;
    solveit-core:citationPlaintext "Vanini, C., Hargreaves, C.J., van Beek, H. and Breitinger, F., 2024. Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction. Forensic Science International: Digital Investigation, 49, p.301759." .

:citationDFCite-1128
    a solveit-core:Citation ;
    rdfs:label "DFCite-1128" ;
    solveit-core:citationID "DFCite-1128" ;
    solveit-core:citationPlaintext "Vömel, S. and Stüttgen, J., 2013. An evaluation platform for forensic memory acquisition software. Digital Investigation, 10, S30-S40." .

:citationDFCite-1129
    a solveit-core:Citation ;
    rdfs:label "DFCite-1129" ;
    solveit-core:citationID "DFCite-1129" ;
    solveit-core:citationPlaintext "Waits, C., Akinyele, J.A., Nolan, R. and Rogers, L., 2008. Computer forensics: results of live response inquiry vs. memory image analysis. CERT program, CMU/SEI-2008-TN-017." .

:citationDFCite-1130
    a solveit-core:Citation ;
    rdfs:label "DFCite-1130" ;
    solveit-core:citationID "DFCite-1130" ;
    solveit-core:citationPlaintext "Wikipedia (2026), ZIP (file format), https://en.wikipedia.org/wiki/ZIP_(file_format)#ZIP64" .

:citationDFCite-1131
    a solveit-core:Citation ;
    rdfs:label "DFCite-1131" ;
    solveit-core:citationID "DFCite-1131" ;
    solveit-core:citationPlaintext "Wilson-Kovacs, D., 2020. Effective resource management in digital forensics: An exploratory analysis of triage practices in four English constabularies. Policing: an international journal, 43(1), pp.77-90." .

:citationDFCite-1132
    a solveit-core:Citation ;
    rdfs:label "DFCite-1132" ;
    solveit-core:citationID "DFCite-1132" ;
    solveit-core:citationPlaintext "WinFE, https://www.winfe.net" .

:citationDFCite-1133
    a solveit-core:Citation ;
    rdfs:label "DFCite-1133" ;
    solveit-core:citationID "DFCite-1133" ;
    solveit-core:citationPlaintext "X-Ways (2025), X-Ways Manual: Logical Search (section 5.11), https://www.x-ways.net/winhex/manual.pdf" .

:citationDFCite-1134
    a solveit-core:Citation ;
    rdfs:label "DFCite-1134" ;
    solveit-core:citationID "DFCite-1134" ;
    solveit-core:citationPlaintext "X-Ways (2025), X-Ways Manual: Simultaneous Search (section 5.10), https://www.x-ways.net/winhex/manual.pdf" .

:citationDFCite-1135
    a solveit-core:Citation ;
    rdfs:label "DFCite-1135" ;
    solveit-core:citationID "DFCite-1135" ;
    solveit-core:citationPlaintext "X-Ways - Provides an option called ‘Scan for Lost Partitions’ which explicitly scans for deleted partitions in unallocated space (X-Ways 2024)" .

:citationDFCite-1136
    a solveit-core:Citation ;
    rdfs:label "DFCite-1136" ;
    solveit-core:citationID "DFCite-1136" ;
    solveit-core:citationPlaintext "https://en.wikipedia.org/wiki/In-system_programming" .

:citationDFCite-1137
    a solveit-core:Citation ;
    rdfs:label "DFCite-1137" ;
    solveit-core:citationID "DFCite-1137" ;
    solveit-core:citationPlaintext "https://github.com/prosch88/ALEX" .

:citationDFCite-1138
    a solveit-core:Citation ;
    rdfs:label "DFCite-1138" ;
    solveit-core:citationID "DFCite-1138" ;
    solveit-core:citationPlaintext "https://github.com/prosch88/UFADE" .

:citationDFCite-1139
    a solveit-core:Citation ;
    rdfs:label "DFCite-1139" ;
    solveit-core:citationID "DFCite-1139" ;
    solveit-core:citationPlaintext "https://support.mobiledit.com/portal/en/kb/articles/app-downgrade" .

:citationDFCite-1140
    a solveit-core:Citation ;
    rdfs:label "DFCite-1140" ;
    solveit-core:citationID "DFCite-1140" ;
    solveit-core:citationPlaintext "https://www.crowdstrike.com/en-us/guides/syslog-logging/advanced-concepts/" .

:citationDFCite-1141
    a solveit-core:Citation ;
    rdfs:label "DFCite-1141" ;
    solveit-core:citationID "DFCite-1141" ;
    solveit-core:citationPlaintext "https://www.opswat.com/blog/accurate-file-type-detection-powered-by-ai" .

:citationDFCite-1142
    a solveit-core:Citation ;
    rdfs:label "DFCite-1142" ;
    solveit-core:citationID "DFCite-1142" ;
    solveit-core:citationPlaintext "https://www.oxygenforensics.com/en/resources/downgrade-method-what-should-be-known-before-the-procedure/" .

:citationDFCite-1143
    a solveit-core:Citation ;
    rdfs:label "DFCite-1143" ;
    solveit-core:citationID "DFCite-1143" ;
    solveit-core:citationPlaintext "Gruhn, M., 2015, May. Windows NT pagefile. sys virtual memory analysis. In 2015 Ninth International Conference on IT Security Incident Management & IT Forensics (pp. 3-18). IEEE." ;
    solveit-core:citationBibtex """@inproceedings{gruhn2015windows,
  title={Windows NT pagefile. sys virtual memory analysis},
  author={Gruhn, Michael},
  booktitle={2015 Ninth International Conference on IT Security Incident Management \\& IT Forensics},
  pages={3--18},
  year={2015},
  organization={IEEE}
}""" .

:citationDFCite-1144
    a solveit-core:Citation ;
    rdfs:label "DFCite-1144" ;
    solveit-core:citationID "DFCite-1144" ;
    solveit-core:citationPlaintext "Magnet Forensics (2020) Expose evidence of timestomping with the NTFS timestamp mismatch artifact in Magnet AXIOM 4.4. Available at: https://www.magnetforensics.com/blog/expose-evidence-of-timestomping-with-the-ntfs-timestamp-mismatch-artifact-in-magnet-axiom-4-4/" ;
    solveit-core:citationBibtex """@online{magnetforensics2020timestomping,
  author       = {{Magnet Forensics}},
  title        = {Expose evidence of timestomping with the NTFS timestamp mismatch artifact in Magnet AXIOM 4.4},
  year         = {2020},
  url          = {https://www.magnetforensics.com/blog/expose-evidence-of-timestomping-with-the-ntfs-timestamp-mismatch-artifact-in-magnet-axiom-4-4/},
  note         = {Accessed: 19 March 2026}
}""" .

:citationDFCite-1146
    a solveit-core:Citation ;
    rdfs:label "DFCite-1146" ;
    solveit-core:citationID "DFCite-1146" ;
    solveit-core:citationPlaintext "Casey, E., Jaquet-Chiffelle, D.-O., Spichiger, H., Ryser, E., Souvignet, T., 2020. Structuring the Evaluation of Location-Related Mobile Device Evidence. Forensic Science International: Digital Investigation 32, 300928. https://doi.org/10.1016/j.fsidi.2020.300928" ;
    solveit-core:citationBibtex """@article{casey_structuring_2020,
	title = {Structuring the {Evaluation} of {Location}-{Related} {Mobile} {Device} {Evidence}},
	volume = {32},
	issn = {2666-2817},
	url = {https://www.sciencedirect.com/science/article/pii/S2666281720300238},
	doi = {10.1016/j.fsidi.2020.300928},
	language = {en},
	urldate = {2021-12-18},
	journal = {Forensic Science International: Digital Investigation},
	author = {Casey, Eoghan and Jaquet-Chiffelle, David-Olivier and Spichiger, Hannes and Ryser, Elénore and Souvignet, Thomas},
	month = apr,
	year = {2020},
	keywords = {Digital forensic science, Scientific interpretation, Digital evidence evaluation, Geolocation data, Location-related evidence, Mobile device evidence},
	pages = {300928},
}""" .

:citationDFCite-1147
    a solveit-core:Citation ;
    rdfs:label "DFCite-1147" ;
    solveit-core:citationID "DFCite-1147" ;
    solveit-core:citationPlaintext "National Institute of Standards and Technology (undated) Computer Security Resource Center Glossary: Chain of Custody. Available at: https://csrc.nist.gov/glossary/term/chain_of_custody." ;
    solveit-core:citationBibtex """@online{nist_chain_of_custody,
  author       = {{National Institute of Standards and Technology}},
  title        = {Computer Security Resource Center Glossary: Chain of Custody},
  url          = {https://csrc.nist.gov/glossary/term/chain_of_custody},
  note         = {Accessed: 2026-03-27}
}""" .

:citationDFCite-1148
    a solveit-core:Citation ;
    rdfs:label "DFCite-1148" ;
    solveit-core:citationID "DFCite-1148" ;
    solveit-core:citationPlaintext "Suma, G.S., Dija, S. and Pillai, A.T., 2017, December. Forensic analysis of google chrome cache files. In 2017 ieee international conference on computational intelligence and computing research (iccic) (pp. 1-5). IEEE." ;
    solveit-core:citationBibtex """@inproceedings{suma2017forensic,
  title={Forensic analysis of google chrome cache files},
  author={Suma, GS and Dija, S and Pillai, Arun T},
  booktitle={2017 ieee international conference on computational intelligence and computing research (iccic)},
  pages={1--5},
  year={2017},
  organization={IEEE}
}""" .

:citationDFCite-1149
    a solveit-core:Citation ;
    rdfs:label "DFCite-1149" ;
    solveit-core:citationID "DFCite-1149" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex """@article{domingues2022digital,
  title={A digital forensic view of Windows 10 notifications},
  author={Domingues, Patr{\\'\\i}cio and Andrade, Lu{\\'\\i}s and Frade, Miguel},
  journal={Forensic Sciences},
  volume={2},
  number={1},
  pages={88--106},
  year={2022},
  publisher={MDPI}
}""" .

:citationDFCite-1150
    a solveit-core:Citation ;
    rdfs:label "DFCite-1150" ;
    solveit-core:citationID "DFCite-1150" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex """@inproceedings{dragonas2024forensic,
  title={Forensic Analysis of Android Notifications' History},
  author={Dragonas, Evangelos and Lambrinoudakis, Costas},
  booktitle={2024 IEEE International Conference on Cyber Security and Resilience (CSR)},
  pages={01--06},
  year={2024},
  organization={IEEE}
}""" .

:citationDFCite-1154
    a solveit-core:Citation ;
    rdfs:label "DFCite-1154" ;
    solveit-core:citationID "DFCite-1154" ;
    solveit-core:citationPlaintext "https://www.cps.gov.uk/prosecution-guidance/disclosure-manual-chapter-30-digital-material" ;
    solveit-core:citationBibtex """@online{CPS2026DigitalMaterial,
  author       = {{Crown Prosecution Service, England and Wales}},
  title        = {Disclosure Manual: Chapter 30 -- Digital Material},
  year         = {2026},
  url          = {https://www.cps.gov.uk/prosecution-guidance/disclosure-manual-chapter-30-digital-material},
  organization = {Crown Prosecution Service},
}""" .

:citationDFCite-1155
    a solveit-core:Citation ;
    rdfs:label "DFCite-1155" ;
    solveit-core:citationID "DFCite-1155" ;
    solveit-core:citationPlaintext "https://www.gov.uk/government/publications/attorney-generals-guidelines-on-disclosure" ;
    solveit-core:citationBibtex """@misc{AttorneyGeneral2024Disclosure,
  author = {{Attorney General's Office}},
  title  = {Attorney General's Guidelines on Disclosure, England and Wales},
  year   = {2024},
  url    = {https://www.gov.uk/government/publications/attorney-generals-guidelines-on-disclosure},
}""" .

:citationDFCite-1156
    a solveit-core:Citation ;
    rdfs:label "DFCite-1156" ;
    solveit-core:citationID "DFCite-1156" ;
    solveit-core:citationPlaintext "https://github.com/frida" ;
    solveit-core:citationBibtex """@misc{ravnas_frida,
  author = {Ravn{\\aa}s, Ole Andr{\\'e} Vadla and {The Frida Project contributors}},
  title  = {Frida: Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers},
  year   = {n.d.},
  url    = {https://github.com/frida},
}""" .

:citationDFCite-1157
    a solveit-core:Citation ;
    rdfs:label "DFCite-1157" ;
    solveit-core:citationID "DFCite-1157" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex """@misc{tubbs2018lastwindows,
  author       = {Tubbs, Jamey},
  title        = {What ``the Last Version of {Windows}'' Means for Digital Forensics},
  howpublished = {Magnet Forensics Blog},
  year         = {2018},
  month        = feb,
  day          = {16},
  url          = {https://www.magnetforensics.com/blog/what-the-last-version-of-windows-means-for-digital-forensics/},
  note         = {Accessed: 2026-07-06}
}""" .

:citationDFCite-1158
    a solveit-core:Citation ;
    rdfs:label "DFCite-1158" ;
    solveit-core:citationID "DFCite-1158" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex """@book{carvey2011windows,
  title={Windows registry forensics: Advanced digital forensic analysis of the windows registry},
  author={Carvey, Harlan},
  year={2011},
  publisher={Elsevier}
}""" .

:citationDFCite-1159
    a solveit-core:Citation ;
    rdfs:label "DFCite-1159" ;
    solveit-core:citationID "DFCite-1159" ;
    solveit-core:citationPlaintext "Jeong, B., Kim, J., Lee, S. and Park, J. (2026) 'FOREST: Inspecting and tracking RESTful APIs for constructing a cloud forensic knowledge base', Forensic Science International: Digital Investigation, 56, p. 302070." .

:citationDFCite-1160
    a solveit-core:Citation ;
    rdfs:label "DFCite-1160" ;
    solveit-core:citationID "DFCite-1160" ;
    solveit-core:citationPlaintext "Yang, J., Kim, J., Bang, J., Lee, S. and Park, J. (2022) 'CATCH: Cloud data acquisition through comprehensive and hybrid approaches', Forensic Science International: Digital Investigation, 43, p. 301442." .

:citationDFCite-1161
    a solveit-core:Citation ;
    rdfs:label "DFCite-1161" ;
    solveit-core:citationID "DFCite-1161" ;
    solveit-core:citationPlaintext "Chung, H., Park, J. and Lee, S. (2017) 'Digital forensic approaches for Amazon Alexa ecosystem', Digital Investigation, 22, pp. S15-S25." .

:citationDFCite-1162
    a solveit-core:Citation ;
    rdfs:label "DFCite-1162" ;
    solveit-core:citationID "DFCite-1162" ;
    solveit-core:citationPlaintext """Christlein, V., Riess, C., Jordan, J., Riess, C., & Angelopoulou, E. (2012). An evaluation of popular copy-move forgery detection approaches. IEEE Transactions on information forensics and security, 7(6), 1841-1854.
https://ieeexplore.ieee.org/iel5/10206/6342844/06301704.pdf?casa_token=iX_DE0LfjeYAAAAA:S1s10l4R5xSxCQqV1KIQLwKvexFhWdYuhQmHeYPi6-Sy07cD5iojhglfqgvUoY0Cfg0L-RPb""" ;
    solveit-core:citationBibtex """@article{christlein2012evaluation,
  title={An evaluation of popular copy-move forgery detection approaches},
  author={Christlein, Vincent and Riess, Christian and Jordan, Johannes and Riess, Corinna and Angelopoulou, Elli},
  journal={IEEE Transactions on information forensics and security},
  volume={7},
  number={6},
  pages={1841--1854},
  year={2012},
  publisher={IEEE}
}""" .

:citationDFCite-1163
    a solveit-core:Citation ;
    rdfs:label "DFCite-1163" ;
    solveit-core:citationID "DFCite-1163" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex "Organization of Scientific Area Committees for Forensic Science (2019) A Framework for Harmonizing Forensic Science Practices and Digital/Multimedia Evidence (OSAC Technical Series 0002R1). NIST. Available at: https://www.nist.gov/system/files/documents/2018/01/10/osac_ts_0002.pdf" .

:citationDFCite-1164
    a solveit-core:Citation ;
    rdfs:label "DFCite-1164" ;
    solveit-core:citationID "DFCite-1164" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex "Forensic Science Regulator (2026) Forensic science activities: interpretation and communication (FSR-GUI-0004), Version 2, Annex B. GOV.UK. Available at: https://www.gov.uk/government/publications/forensic-science-activities-interpretation-and-communication-fsr-gui-0004/forensic-science-activities-interpretation-and-communication-accessible#annex-b" .

:citationDFCite-1165
    a solveit-core:Citation ;
    rdfs:label "DFCite-1165" ;
    solveit-core:citationID "DFCite-1165" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex "Casey, E., 2020. Standardization of forming and expressing preliminary evaluative opinions on digital evidence. Forensic Science International: Digital Investigation 32, 200888. https://doi.org/10.1016/j.fsidi.2019.200888" .

:citationDFCite-1166
    a solveit-core:Citation ;
    rdfs:label "DFCite-1166" ;
    solveit-core:citationID "DFCite-1166" ;
    solveit-core:citationPlaintext "Park, S., Jeong, B., Kim, J. and Park, J., 2026. REPDF: Repairing corrupted PDF files through font mapping and object relationship reconstruction. Forensic Science International: Digital Investigation, 56, 302061. https://doi.org/10.1016/j.fsidi.2026.302061" ;
    solveit-core:citationBibtex """@article{PARK2026302061,
title = {REPDF: Repairing corrupted PDF files through font mapping and object relationship reconstruction},
journal = {Forensic Science International: Digital Investigation},
volume = {56},
pages = {302061},
year = {2026},
note = {DFRWS EU 2026 - Selected Papers from the 13th Annual Digital Forensics Research Conference Europe},
issn = {2666-2817},
doi = {https://doi.org/10.1016/j.fsidi.2026.302061},
url = {https://www.sciencedirect.com/science/article/pii/S2666281726000181},
author = {Seungeun Park and Byeongchan Jeong and Jieon Kim and Jungheum Park},
keywords = {Digital forensics, Corrupted file repair, Electronic document, PDF, Reference data}
}""" .

:citationDFCite-1168
    a solveit-core:Citation ;
    rdfs:label "DFCite-1168" ;
    solveit-core:citationID "DFCite-1168" ;
    solveit-core:citationPlaintext "None" ;
    solveit-core:citationBibtex """@misc{metz_libewf,
  author = {Metz, Joachim},
  title = {libewf},
  year = {2024},
  version = {20240506},
  url = {https://github.com/libyal/libewf}
}""" .

:citationDFCite-1169
    a solveit-core:Citation ;
    rdfs:label "DFCite-1169" ;
    solveit-core:citationID "DFCite-1169" ;
    solveit-core:citationPlaintext "Studiawan, H., Breitinger, F. and Scanlon, M., 2025. Towards a standardized methodology and dataset for evaluating LLM-based digital forensic timeline analysis. Forensic Science International: Digital Investigation, 54, p.301982." ;
    solveit-core:citationBibtex """@article{STUDIAWAN2025301982,
title = {Towards a standardized methodology and dataset for evaluating LLM-based digital forensic timeline analysis},
journal = {Forensic Science International: Digital Investigation},
volume = {54},
pages = {301982},
year = {2025},
note = {DFRWS APAC 2025 - Selected Papers from the 5th Annual Digital Forensics Research Conference APAC},
issn = {2666-2817},
doi = {https://doi.org/10.1016/j.fsidi.2025.301982},
url = {https://www.sciencedirect.com/science/article/pii/S2666281725001222},
author = {Hudan Studiawan and Frank Breitinger and Mark Scanlon},
keywords = {LLM evaluation, Forensic timeline analysis, Large language models, ChatGPT, log2timeline/plaso},
abstract = {Large language models (LLMs) have widespread adoption in many domains, including digital forensics. While prior research has largely centered on case studies and examples demonstrating how LLMs can assist forensic investigations, deeper explorations remain limited, i.e., a standardized approach for precise performance evaluations is lacking. Inspired by the NIST Computer Forensic Tool Testing Program, this paper proposes a standardized methodology to quantitatively evaluate the application of LLMs for digital forensic tasks, specifically in timeline analysis. The paper describes the components of the methodology, including the dataset, timeline generation, and ground truth development. In addition, the paper recommends the use of BLEU and ROUGE metrics for the quantitative evaluation of LLMs through case studies or tasks involving timeline analysis. Experimental results using ChatGPT demonstrate that the proposed methodology can effectively evaluate LLM-based forensic timeline analysis. Finally, we discuss the limitations of applying LLMs to forensic timeline analysis.}
}""" .

#################################################################
#    Referenced CASE/UCO classes (173)
#
#    Declaration only. These name classes defined in CASE/UCO or in
#    the SOLVE-IT observable modules, referenced above as technique
#    input and output classes. No definition is asserted here.
#################################################################

solveit-observable:ADBPullData
    a owl:Class .

solveit-observable:AFCExtractionData
    a owl:Class .

uco-observable:Account
    a owl:Class .

solveit-observable:AcquiredData
    a owl:Class .

solveit-observable:AiChatAppFiles
    a owl:Class .

<https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult>
    a owl:Class .

uco-observable:AndroidPhone
    a owl:Class .

uco-core:Annotation
    a owl:Class .

uco-observable:Application
    a owl:Class .

solveit-observable:ApplicationFiles
    a owl:Class .

uco-observable:ApplicationVersion
    a owl:Class .

uco-observable:ArchiveFile
    a owl:Class .

<https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification>
    a owl:Class .

solveit-observable:ArtifactSet
    a owl:Class .

solveit-observable:AudioFile
    a owl:Class .

solveit-observable:Bitstream
    a owl:Class .

solveit-observable:BitstreamRandomAccessed
    a owl:Class .

solveit-observable:BrowserAppFiles
    a owl:Class .

uco-observable:BrowserBookmark
    a owl:Class .

solveit-observable:BrowserCacheData
    a owl:Class .

uco-observable:BrowserCookie
    a owl:Class .

uco-observable:Calendar
    a owl:Class .

solveit-observable:CalendarAppFiles
    a owl:Class .

uco-observable:CalendarEntry
    a owl:Class .

uco-observable:Call
    a owl:Class .

solveit-observable:ChatAppFiles
    a owl:Class .

solveit-observable:ClockOffsetCapture
    a owl:Class .

uco-observable:Code
    a owl:Class .

uco-observable:Computer
    a owl:Class .

<https://ontology.unifiedcyberontology.org/uco/configuration/Configuration>
    a owl:Class .

<https://ontology.unifiedcyberontology.org/uco/configuration/ConfigurationEntry>
    a owl:Class .

uco-observable:Contact
    a owl:Class .

uco-observable:ContentData
    a owl:Class .

uco-observable:CookieHistory
    a owl:Class .

uco-observable:Credential
    a owl:Class .

solveit-observable:DateTimeStamp
    a owl:Class .

solveit-observable:DecryptionKey
    a owl:Class .

uco-observable:Device
    a owl:Class .

solveit-observable:DeviceGeneratedBackup
    a owl:Class .

solveit-observable:DeviceScreenshotCapture
    a owl:Class .

solveit-observable:DeviceSet
    a owl:Class .

uco-observable:Directory
    a owl:Class .

uco-observable:Disk
    a owl:Class .

uco-observable:DiskPartition
    a owl:Class .

uco-observable:EmailAccount
    a owl:Class .

solveit-observable:EmailAppFiles
    a owl:Class .

uco-observable:EmailMessage
    a owl:Class .

uco-observable:EventLog
    a owl:Class .

uco-observable:EventRecord
    a owl:Class .

uco-observable:File
    a owl:Class .

solveit-observable:FileSet
    a owl:Class .

uco-observable:FileSystem
    a owl:Class .

solveit-observable:FileSystemExtraction
    a owl:Class .

solveit-observable:FilteredFileSet
    a owl:Class .

solveit-observable:ForensicImageContainer
    a owl:Class .

solveit-analysis:ForensicToolTagBasedReport
    a owl:Class .

solveit-observable:GamingAppFiles
    a owl:Class .

<https://ontology.unifiedcyberontology.org/uco/types/Hash>
    a owl:Class .

solveit-observable:HashSet
    a owl:Class .

solveit-observable:HashVerificationResult
    a owl:Class .

solveit-observable:HealthAppFiles
    a owl:Class .

solveit-analysis:Hypothesis
    a owl:Class .

solveit-analysis:HypothesisSet
    a owl:Class .

solveit-analysis:HypothesisedCommunication
    a owl:Class .

solveit-analysis:HypothesisedEvent
    a owl:Class .

solveit-analysis:HypothesisedRelationship
    a owl:Class .

uco-observable:IPAddress
    a owl:Class .

uco-observable:Image
    a owl:Class .

solveit-observable:KeywordIndex
    a owl:Class .

solveit-observable:KeywordIndexingConfiguration
    a owl:Class .

solveit-observable:KeywordSearchResultSet
    a owl:Class .

<https://ontology.unifiedcyberontology.org/uco/location/Location>
    a owl:Class .

solveit-observable:LogicalImageContainer
    a owl:Class .

uco-observable:MACAddress
    a owl:Class .

solveit-observable:MapsAppFiles
    a owl:Class .

uco-observable:Memory
    a owl:Class .

uco-observable:Message
    a owl:Class .

uco-observable:MobileDevice
    a owl:Class .

solveit-observable:NavigationAppFiles
    a owl:Class .

uco-observable:NetworkConnection
    a owl:Class .

uco-observable:NetworkInterface
    a owl:Class .

solveit-observable:NetworkPacketCapture
    a owl:Class .

uco-observable:Note
    a owl:Class .

uco-observable:Observable
    a owl:Class .

uco-observable:ObservableObject
    a owl:Class .

uco-observable:ObservableRelationship
    a owl:Class .

uco-observable:OnlineService
    a owl:Class .

solveit-observable:PaymentAppFiles
    a owl:Class .

<https://ontology.unifiedcyberontology.org/uco/identity/Person>
    a owl:Class .

solveit-observable:PhotosAppFiles
    a owl:Class .

solveit-observable:PhysicalImageContainer
    a owl:Class .

uco-observable:Post
    a owl:Class .

solveit-observable:PrioritizedDeviceSet
    a owl:Class .

uco-observable:Process
    a owl:Class .

case-investigation:ProvenanceRecord
    a owl:Class .

uco-observable:RasterPicture
    a owl:Class .

solveit-observable:RawImage
    a owl:Class .

solveit-observable:ReadWriteDeviceInterface
    a owl:Class .

solveit-observable:RedactedArtifactSet
    a owl:Class .

solveit-observable:RedactedFileSet
    a owl:Class .

solveit-observable:RemindersAppFiles
    a owl:Class .

uco-observable:SMSMessage
    a owl:Class .

solveit-observable:SQLiteDatabase
    a owl:Class .

solveit-observable:SQLiteTable
    a owl:Class .

solveit-observable:ServiceBasedExtractionData
    a owl:Class .

uco-observable:SmartDevice
    a owl:Class .

solveit-observable:SmartHomeAppFiles
    a owl:Class .

solveit-observable:SocialMediaAppFiles
    a owl:Class .

uco-observable:Software
    a owl:Class .

solveit-observable:SortedTimeline
    a owl:Class .

uco-observable:StorageMedium
    a owl:Class .

uco-observable:TableField
    a owl:Class .

solveit-observable:Timeline
    a owl:Class .

solveit-observable:TimelineEntry
    a owl:Class .

solveit-observable:TimestampOffset
    a owl:Class .

uco-observable:URL
    a owl:Class .

uco-observable:URLHistory
    a owl:Class .

uco-observable:URLHistoryEntry
    a owl:Class .

uco-observable:URLVisit
    a owl:Class .

solveit-observable:UnlockPattern
    a owl:Class .

uco-observable:UserAccount
    a owl:Class .

solveit-observable:VideoFile
    a owl:Class .

solveit-observable:VirtualizedComputer
    a owl:Class .

uco-observable:Volume
    a owl:Class .

uco-observable:WindowsRegistryHive
    a owl:Class .

uco-observable:WindowsRegistryKey
    a owl:Class .

uco-observable:WindowsRegistryValue
    a owl:Class .

solveit-observable:Wordlist
    a owl:Class .

solveit-observable:WriteProtectedDeviceInterface
    a owl:Class .

uco-observable:accessedTime
    a owl:DatatypeProperty .

uco-observable:accountIdentifier
    a owl:DatatypeProperty .

uco-observable:accountType
    a owl:DatatypeProperty .

uco-observable:callType
    a owl:DatatypeProperty .

<https://cacontology.projectvic.org/case-management#ExpertReport>
    a owl:Class .

<https://ontology.unifiedcyberontology.org/uco/analysis/classificationConfidence>
    a owl:DatatypeProperty .

uco-core:confidence
    a owl:DatatypeProperty .

<https://ontology.unifiedcyberontology.org/uco/configuration/dependencies>
    a owl:ObjectProperty .

uco-core:description
    a owl:DatatypeProperty .

uco-observable:driveLetter
    a owl:DatatypeProperty .

uco-observable:emailAddress
    a owl:ObjectProperty .

uco-core:eventType
    a owl:DatatypeProperty .

uco-observable:execProgramHashes
    a owl:ObjectProperty .

uco-observable:execProgramPath
    a owl:DatatypeProperty .

case-investigation:exhibitNumber
    a owl:DatatypeProperty .

uco-observable:exifData
    a owl:ObjectProperty .

uco-observable:fileName
    a owl:DatatypeProperty .

uco-observable:filePath
    a owl:DatatypeProperty .

uco-observable:hasChanged
    a owl:DatatypeProperty .

uco-observable:hash
    a owl:ObjectProperty .

uco-observable:httpRequestHeader
    a owl:ObjectProperty .

solveit-observable:httpResponseHeader
    a owl:Class .

solveit-analysis:hypothesisedDateTime
    a owl:ObjectProperty .

uco-observable:installDate
    a owl:DatatypeProperty .

uco-observable:isPrivileged
    a owl:DatatypeProperty .

uco-observable:keywordSearchTerm
    a owl:DatatypeProperty .

uco-observable:location
    a owl:ObjectProperty .

uco-observable:messageType
    a owl:DatatypeProperty .

uco-observable:mimeType
    a owl:DatatypeProperty .

uco-observable:modifiedTime
    a owl:DatatypeProperty .

uco-observable:mountPoint
    a owl:DatatypeProperty .

uco-core:name
    a owl:DatatypeProperty .

uco-observable:password
    a owl:DatatypeProperty .

uco-observable:path
    a owl:DatatypeProperty .

uco-observable:phoneNumber
    a owl:DatatypeProperty .

uco-observable:rangeOffset
    a owl:DatatypeProperty .

uco-observable:rangeOffsetType
    a owl:DatatypeProperty .

uco-observable:receivedTime
    a owl:DatatypeProperty .

uco-observable:sentTime
    a owl:DatatypeProperty .

uco-observable:systemTime
    a owl:DatatypeProperty .

uco-observable:tableSchema
    a owl:DatatypeProperty .

uco-observable:timesExecuted
    a owl:DatatypeProperty .

uco-observable:urlHistoryEntry
    a owl:ObjectProperty .

uco-observable:version
    a owl:DatatypeProperty .