ID	Name
DFT-1001	Triage devices or media	
			Input: https://ontology.solveit-df.org/solveit/observable/DeviceSet
			Output: https://ontology.solveit-df.org/solveit/observable/PrioritizedDeviceSet
DFT-1002	Copy sectors from storage media	
			Input: https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface
			Input: https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface
			Output: https://ontology.solveit-df.org/solveit/observable/Bitstream
DFT-1003	Copy pages from physical memory	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Memory
			Output: https://ontology.solveit-df.org/solveit/observable/Bitstream
DFT-1004	Collect logical files selectively	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.solveit-df.org/solveit/observable/FilteredFileSet
DFT-1005	Search a crime scene for relevant physical evidence	
			Output: https://ontology.solveit-df.org/solveit/observable/DeviceSet
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Device
			Output: https://ontology.unifiedcyberontology.org/uco/observable/location
DFT-1006	Search a crime scene using digital sniffer dogs	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/location
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Device
DFT-1007	Detect the potential existence of digital devices using a SyncTriage-based approach	
DFT-1008	Detect the potential existence of digital devices by profiling network traffic	
DFT-1009	Locate potential digital evidence sources via cloud account identifiers	
DFT-1010	Place device in a faraday environment	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Device
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Device
DFT-1011	Store seized devices or media in evidence bags	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Device
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Device
			Output: https://ontology.caseontology.org/case/investigation/exhibitNumber
DFT-1012	Write protect storage media using a hardware write blocker	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/StorageMedium
			Output: https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface
DFT-1013	Write protect storage media using a software write blocker	
			Input: https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface
			Input: https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface
			Output: https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface
DFT-1014	Document the chain of custody	
			Input: https://ontology.caseontology.org/case/investigation/ProvenanceRecord
			Output: https://ontology.caseontology.org/case/investigation/ProvenanceRecord
DFT-1015	Collect logical files selectively based on privacy preserving criteria	
DFT-1016	Collect specific pieces of information from a live running device	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Device
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Process
			Output: https://ontology.unifiedcyberontology.org/uco/observable/NetworkConnection
			Output: https://ontology.unifiedcyberontology.org/uco/observable/IPAddress
			Output: https://ontology.unifiedcyberontology.org/uco/observable/MACAddress
			Output: https://ontology.unifiedcyberontology.org/uco/observable/UserAccount
DFT-1017	Capture network packets	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/NetworkInterface
			Output: https://ontology.solveit-df.org/solveit/observable/NetworkPacketCapture
DFT-1018	Collect data from a remote networked device	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/NetworkConnection
			Output: https://ontology.solveit-df.org/solveit/observable/ForensicImageContainer
			Output: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1019	Extract a backup from a mobile device	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice
			Output: https://ontology.solveit-df.org/solveit/observable/DeviceGeneratedBackup
DFT-1020	Extract the file system from a mobile device	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice
			Output: https://ontology.solveit-df.org/solveit/observable/FileSystemExtraction
DFT-1021	Extract artifacts from a configuration file	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/File
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
			Output: https://ontology.unifiedcyberontology.org/uco/configuration/ConfigurationEntry
DFT-1022	Capture mobile device screenshots (manually)	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice
			Output: https://ontology.solveit-df.org/solveit/observable/DeviceScreenshotCapture
DFT-1023	Collect data from cloud service via a live web page using credentials	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Credential
			Input: https://ontology.unifiedcyberontology.org/uco/observable/OnlineService
			Output: https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile
DFT-1024	Collect data from cloud service via submission of request to service provider	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/OnlineService
			Input: https://ontology.unifiedcyberontology.org/uco/observable/accountIdentifier
			Output: https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile
DFT-1025	Store bitstream data in a forensic image format	
			Input: https://ontology.solveit-df.org/solveit/observable/Bitstream
			Output: https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer
DFT-1026	Store data in standard archive format	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSystemExtraction
			Input: https://ontology.solveit-df.org/solveit/observable/DeviceGeneratedBackup
			Output: https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile
DFT-1027	Read data from a device using JTAG	
DFT-1028	Physically remove a storage chip from a device (chip-off)	
DFT-1029	Read data from a desoldered eMMC via a chip reader	
			Output: https://ontology.solveit-df.org/solveit/observable/Bitstream
DFT-1030	Read data from unmanaged NAND	
DFT-1031	Recover encryption/decryption key from memory	
			Output: https://ontology.solveit-df.org/solveit/observable/DecryptionKey
DFT-1032	Recover encryption/decryption key information using side channel attacks	
DFT-1033	Extract credential(s) from an accessible device to attempt access to a more secure device or service	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Credential
DFT-1034	Attack a stored credential or device using a brute force approach	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/password
DFT-1035	Attack a stored credential or device using a dictionary-based approach	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/password
DFT-1036	Recover information about a potential device PIN or pattern lock using a smudge attack	
			Output: https://ontology.solveit-df.org/solveit/observable/UnlockPattern
DFT-1037	Obtain password from the device's owner	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/password
DFT-1038	Attack a stored credential or device using a rainbow table-based approach	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/password
DFT-1039	Downgrade apps to facilitate data extraction	
DFT-1040	Exploit a mobile device to facilitate privileged access for data extraction	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/isPrivileged
DFT-1041	Gain access to a device via a Pin2Pwn approach	
DFT-1042	Verify hash of copied data matches the hash of the data read from source device	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/hash
			Output: https://ontology.solveit-df.org/solveit/observable/HashVerificationResult
DFT-1043	Read bitstream from forensic image container file(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer
			Output: https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed
DFT-1044	Decode data stored in a mobile backup format	
			Input: https://ontology.solveit-df.org/solveit/observable/DeviceGeneratedBackup
			Output: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1045	Read contents from standard archive file(s)	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/ArchiveFile
			Output: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1046	Redact digital forensic tool results to protect privileged material	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Input: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Output: https://ontology.solveit-df.org/solveit/observable/RedactedFileSet
			Output: https://ontology.solveit-df.org/solveit/observable/RedactedArtifactSet
DFT-1047	Filter files using a hashset to reduce files examined	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Input: https://ontology.solveit-df.org/solveit/observable/HashSet
			Output: https://ontology.solveit-df.org/solveit/observable/RedactedFileSet
DFT-1048	Protect privacy by only partially processing data from a source	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.solveit-df.org/solveit/observable/RedactedArtifactSet
			Output: https://ontology.solveit-df.org/solveit/observable/RedactedFileSet
DFT-1049	Keyword search	
			Output: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet
DFT-1050	Locate relevant files using a hashset to identify files of interest	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Input: https://ontology.solveit-df.org/solveit/observable/HashSet
			Output: https://ontology.solveit-df.org/solveit/observable/FilteredFileSet
DFT-1051	Locate potentially relevant files using fuzzy hash matching	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.solveit-df.org/solveit/observable/FilteredFileSet
DFT-1052	Generate timeline	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Input: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Output: https://ontology.solveit-df.org/solveit/observable/Timeline
DFT-1053	Extract 'entities' from a data source	
			Input: https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Input: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Output: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
DFT-1054	Review artifacts or content manually for relevant material	
			Input: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
			Output: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Output: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1055	Examine file and folder structure	
DFT-1056	Enumerate connections between artifacts	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/ObservableObject
			Output: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Output: https://ontology.unifiedcyberontology.org/uco/observable/ObservableRelationship
DFT-1057	Search for indicators of steganography	
			Input: https://ontology.solveit-df.org/solveit/observable/AcquiredData
			Output: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
DFT-1058	Search for mismatched file extensions	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.solveit-df.org/solveit/observable/FilteredFileSet
DFT-1059	Identify partitions	
			Input: https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed
			Output: https://ontology.unifiedcyberontology.org/uco/observable/DiskPartition
DFT-1060	Enumerate allocated files and folders	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/FileSystem
			Output: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1061	Recover non-allocated files	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/ContentData
			Input: https://ontology.unifiedcyberontology.org/uco/observable/FileSystem
			Output: https://ontology.unifiedcyberontology.org/uco/core/confidence
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Directory
DFT-1062	Decrypt encrypted file systems/volumes	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Volume
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Image
DFT-1063	Identify file types	
			Output: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
			Output: https://ontology.unifiedcyberontology.org/uco/observable/mimeType
DFT-1064	Carve non-allocated files	
			Output: https://ontology.unifiedcyberontology.org/uco/core/confidence
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
			Output: https://ontology.unifiedcyberontology.org/uco/observable/rangeOffset
			Output: https://ontology.unifiedcyberontology.org/uco/observable/rangeOffsetType
DFT-1065	Extract artifacts from operating system-level content indexer(s)	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/fileName
			Output: https://ontology.unifiedcyberontology.org/uco/observable/filePath
DFT-1066	Extract artifacts from operating system log files	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/EventLog
DFT-1067	Extract artifacts from operating system cloud synchronization features	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1068	Extract operating system artifacts indicating recently used files	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.unifiedcyberontology.org/uco/observable/filePath
			Output: https://ontology.unifiedcyberontology.org/uco/observable/accessedTime
DFT-1069	Extract artifacts from a web browser	
			Input: https://ontology.solveit-df.org/solveit/observable/BrowserAppFiles
			Output: https://ontology.unifiedcyberontology.org/uco/observable/URLHistory
			Output: https://ontology.unifiedcyberontology.org/uco/observable/CookieHistory
			Output: https://ontology.unifiedcyberontology.org/uco/observable/BrowserBookmark
			Output: https://ontology.unifiedcyberontology.org/uco/observable/BrowserCookie
			Output: https://ontology.unifiedcyberontology.org/uco/observable/URLVisit
			Output: https://ontology.unifiedcyberontology.org/uco/observable/URLHistoryEntry
DFT-1070	Extract artifacts from email client(s) or webmail access	
			Input: https://ontology.solveit-df.org/solveit/observable/EmailAppFiles
			Output: https://ontology.unifiedcyberontology.org/uco/observable/EmailAccount
			Output: https://ontology.unifiedcyberontology.org/uco/observable/EmailMessage
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Contact
DFT-1071	Extract data from SQLite database(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/SQLiteDatabase
			Output: https://ontology.solveit-df.org/solveit/observable/SQLiteTable
DFT-1072	Extract artifacts from chat app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/ChatAppFiles
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Message
			Output: https://ontology.unifiedcyberontology.org/uco/observable/SMSMessage
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Contact
DFT-1073	Extract artifacts from calendar app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/CalendarAppFiles
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Calendar
			Output: https://ontology.unifiedcyberontology.org/uco/observable/CalendarEntry
DFT-1074	Extract artifacts from social network app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/SocialMediaAppFiles
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Message
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Post
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Contact
DFT-1075	Extract artifacts from maps/travel app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/MapsAppFiles
			Input: https://ontology.solveit-df.org/solveit/observable/NavigationAppFiles
DFT-1076	Extract artifacts from log files	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/EventLog
			Output: https://ontology.unifiedcyberontology.org/uco/core/eventType
DFT-1077	Extract artifacts from photo management app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/PhotosAppFiles
DFT-1078	Extract artifacts from cloud synchronization app(s)	
DFT-1079	Examine audio content	
DFT-1080	Examine video content	
DFT-1081	Examine image/picture content	
DFT-1082	Examine document content	
DFT-1083	Extract artifacts from operating system memory structures	
DFT-1084	Extract potentially user-identifying content from account information	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/UserAccount
			Output: https://ontology.unifiedcyberontology.org/uco/identity/Person
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship
DFT-1085	Conflate specific account identifiers to a single user identity	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Account
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship
DFT-1086	Analyze timeline	
			Output: https://ontology.solveit-df.org/solveit/observable/Timeline
			Output: https://ontology.solveit-df.org/solveit/observable/TimelineEntry
DFT-1087	Reconstruct the location-based properties of an event	
			Output: https://ontology.unifiedcyberontology.org/uco/core/confidence
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisedEvent
			Output: https://ontology.unifiedcyberontology.org/uco/location/Location
DFT-1088	Reconstruct relations between events or properties of events	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Message
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Contact
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisedCommunication
DFT-1089	Review source code of software	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Code
DFT-1090	Experiment with software to ascertain forensic artifacts	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Software
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship
DFT-1091	Tag artifacts	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/ObservableObject
			Output: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
			Output: https://ontology.unifiedcyberontology.org/uco/core/Annotation
DFT-1092	Generate tag-based automated report	
			Output: https://ontology.solveit-df.org/solveit/analysis/ForensicToolTagBasedReport
DFT-1093	Write expert report	
			Output: https://cacontology.projectvic.org/case-management#ExpertReport
DFT-1094	Disclose investigation material to an authorized legal authority	
DFT-1095	Instrument a piece of running software	
DFT-1096	Extract operating system artifacts indicating program execution	
			Input: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Output: https://ontology.unifiedcyberontology.org/uco/observable/execProgramPath
			Output: https://ontology.unifiedcyberontology.org/uco/observable/timesExecuted
			Output: https://ontology.unifiedcyberontology.org/uco/observable/execProgramHashes
DFT-1097	Extract operating system artifacts indicating installed software	
			Input: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Application
			Output: https://ontology.unifiedcyberontology.org/uco/observable/ApplicationVersion
DFT-1098	Enumerate operating system user accounts	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.unifiedcyberontology.org/uco/observable/UserAccount
			Output: https://ontology.unifiedcyberontology.org/uco/observable/accountType
DFT-1099	Repair a damaged or incomplete file using `grafting`	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/ContentData
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
DFT-1100	Extract metadata from within images	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/RasterPicture
			Output: https://ontology.unifiedcyberontology.org/uco/observable/exifData
DFT-1101	Conduct cell site survey	
			Input: https://ontology.unifiedcyberontology.org/uco/location/Location
DFT-1102	Decode data extracted from unmanaged NAND	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/ContentData
DFT-1103	Virtualize suspect system for previewing	
			Input: https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer
			Input: https://ontology.solveit-df.org/solveit/observable/RawImage
			Output: https://ontology.solveit-df.org/solveit/observable/VirtualizedComputer
DFT-1104	Collect data using open source intelligence	
DFT-1105	Examine memory dump from an application	
DFT-1106	Classify if a video is potentially synthetically generated	
			Input: https://ontology.solveit-df.org/solveit/observable/VideoFile
			Output: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
			Output: https://ontology.unifiedcyberontology.org/uco/analysis/classificationConfidence
DFT-1107	Extract artifacts from health/fitness app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/HealthAppFiles
DFT-1108	Extract artifacts from reminders app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/RemindersAppFiles
DFT-1109	Extract artifacts from payment app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/PaymentAppFiles
DFT-1110	Preserve reference data	
DFT-1111	Record system clock offset	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Device
			Output: https://ontology.unifiedcyberontology.org/uco/observable/systemTime
			Output: https://ontology.solveit-df.org/solveit/observable/ClockOffsetCapture
DFT-1112	Locate and remove physical disks from a device	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Computer
			Output: https://ontology.unifiedcyberontology.org/uco/observable/StorageMedium
DFT-1113	Access internal storage via bootable environment	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Computer
			Output: https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface
DFT-1114	Preserve memory contents via Cold Boot Attack	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Memory
DFT-1115	Visualize geolocation information	
			Input: https://ontology.unifiedcyberontology.org/uco/location/Location
DFT-1116	Extract references to connected devices	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1117	Reconstruct the time that an event may have occurred	
			Output: https://ontology.solveit-df.org/solveit/analysis/hypothesisedDateTime
DFT-1118	Locate relevant files by path	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
			Output: https://ontology.solveit-df.org/solveit/observable/FilteredFileSet
DFT-1119	Automatically scan for artifact changes caused by app updates	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/hasChanged
			Output: https://ontology.unifiedcyberontology.org/uco/observable/filePath
			Output: https://ontology.unifiedcyberontology.org/uco/observable/tableSchema
			Output: https://ontology.unifiedcyberontology.org/uco/observable/TableField
DFT-1120	Extract artifacts from app data automatically	
			Input: https://ontology.solveit-df.org/solveit/observable/ApplicationFiles
			Output: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
DFT-1121	Index a data source for keyword searching	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Input: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Input: https://ontology.solveit-df.org/solveit/observable/KeywordIndexingConfiguration
			Output: https://ontology.solveit-df.org/solveit/observable/KeywordIndex
DFT-1122	Keyword search (case-type wordlists)	
			Output: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet
DFT-1123	Keyword search (case-specific wordlists)	
			Output: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet
DFT-1124	Keyword search (indexed)	
			Input: https://ontology.solveit-df.org/solveit/observable/KeywordIndex
			Input: https://ontology.solveit-df.org/solveit/observable/Wordlist
			Output: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet
DFT-1125	Keyword search (live)	
			Output: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet
DFT-1126	Keyword search (live) (physical)	
			Output: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet
DFT-1127	Keyword search (live) (logical)	
			Output: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet
DFT-1128	Search for indicators of malware	
DFT-1129	Search for indicators of clock tampering	
DFT-1130	Search for indicators of encrypted data	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Application
DFT-1131	Search for indicators of trail obfuscation	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Application
DFT-1132	Search for indicators of artifact wiping	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Application
DFT-1133	Extract artifacts from AI companion app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/AiChatAppFiles
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Message
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Call
			Output: https://ontology.unifiedcyberontology.org/uco/observable/callType
			Output: https://ontology.unifiedcyberontology.org/uco/observable/sentTime
			Output: https://ontology.unifiedcyberontology.org/uco/observable/receivedTime
			Output: https://ontology.unifiedcyberontology.org/uco/observable/messageType
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Account
			Output: https://ontology.unifiedcyberontology.org/uco/observable/emailAddress
			Output: https://ontology.unifiedcyberontology.org/uco/observable/phoneNumber
			Output: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
DFT-1134	Use time anchors to estimate clock offset	
			Input: https://ontology.solveit-df.org/solveit/observable/DateTimeStamp
			Output: https://ontology.solveit-df.org/solveit/observable/TimestampOffset
DFT-1137	Extract browser history artifacts	
			Input: https://ontology.solveit-df.org/solveit/observable/BrowserAppFiles
			Output: https://ontology.unifiedcyberontology.org/uco/observable/URLHistory
DFT-1138	Extract browser cache artifacts	
			Input: https://ontology.solveit-df.org/solveit/observable/BrowserCacheData
			Output: https://ontology.unifiedcyberontology.org/uco/observable/URL
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
			Output: https://ontology.unifiedcyberontology.org/uco/observable/httpRequestHeader
			Output: https://ontology.solveit-df.org/solveit/observable/httpResponseHeader
DFT-1139	Extract browser session artifacts	
DFT-1140	Extract browser autofill artifacts	
DFT-1141	Extract browser bookmark artifacts	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/BrowserBookmark
DFT-1142	Extract browser download artifacts	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/URL
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
DFT-1143	Extract browser configuration artifacts	
			Output: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
DFT-1144	Enumerate browser profiles	
DFT-1145	Extract browser extensions artifacts	
DFT-1146	Extract browser synchronization artifacts	
			Output: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
DFT-1147	Extract browser cookie artifacts	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/CookieHistory
			Output: https://ontology.unifiedcyberontology.org/uco/observable/BrowserCookie
DFT-1148	Extract browser web storage artifacts	
DFT-1149	Extract artifacts from the file versioning feature	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
			Output: https://ontology.unifiedcyberontology.org/uco/observable/version
			Output: https://ontology.unifiedcyberontology.org/uco/observable/modifiedTime
DFT-1150	Recover non-allocated files using residual file metadata	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/FileSystem
			Output: https://ontology.unifiedcyberontology.org/uco/core/confidence
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Directory
DFT-1151	Keyword search (over extracted artifacts)	
			Input: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Output: https://ontology.solveit-df.org/solveit/observable/KeywordSearchResultSet
DFT-1153	Apply offset to a timestamp	
			Output: https://ontology.solveit-df.org/solveit/observable/DateTimeStamp
			Output: https://ontology.solveit-df.org/solveit/observable/TimelineEntry
DFT-1154	Reconstruct an identity associated with an event	
			Output: https://ontology.unifiedcyberontology.org/uco/identity/Person
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Account
			Output: https://ontology.unifiedcyberontology.org/uco/core/confidence
DFT-1155	Reconstruct that a specific event may have occurred	
			Input: https://ontology.solveit-df.org/solveit/observable/Timeline
			Input: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisedEvent
DFT-1156	Reconstruct if an event could have functionally occurred on a system given its capabilities	
			Output: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
			Output: https://ontology.unifiedcyberontology.org/uco/configuration/dependencies
			Output: https://ontology.unifiedcyberontology.org/uco/core/confidence
DFT-1157	Extract device data using exposed service	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice
			Output: https://ontology.solveit-df.org/solveit/observable/ServiceBasedExtractionData
DFT-1158	Configure device to enable a service needed for data extraction	
DFT-1159	Extract mobile data via deployed agent	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice
			Output: https://ontology.solveit-df.org/solveit/observable/ServiceBasedExtractionData
DFT-1160	Collect data with 'cloud backup restore' approach	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/SmartDevice
DFT-1161	Collect data from cloud service via API using credentials	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/OnlineService
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Message
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
			Output: https://ontology.unifiedcyberontology.org/uco/observable/ContentData
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Account
			Output: https://ontology.unifiedcyberontology.org/uco/observable/EventRecord
			Output: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1162	Read data from a device via In-System Programming (ISP)	
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Image
DFT-1163	Capture mobile device screenshots (automatically)	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice
			Output: https://ontology.solveit-df.org/solveit/observable/DeviceScreenshotCapture
DFT-1164	Read data directly from a block device	
			Input: https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface
			Input: https://ontology.solveit-df.org/solveit/observable/WriteProtectedDeviceInterface
			Output: https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed
DFT-1165	Extract software configuration information	
			Input: https://ontology.solveit-df.org/solveit/observable/ApplicationFiles
			Output: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
DFT-1166	Connect directly to storage media	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Disk
			Input: https://ontology.unifiedcyberontology.org/uco/observable/StorageMedium
			Output: https://ontology.solveit-df.org/solveit/observable/ReadWriteDeviceInterface
DFT-1167	Extract search terms from URLs	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/URLHistory
			Input: https://ontology.unifiedcyberontology.org/uco/observable/urlHistoryEntry
			Input: https://ontology.unifiedcyberontology.org/uco/observable/URL
			Output: https://ontology.unifiedcyberontology.org/uco/observable/keywordSearchTerm
DFT-1168	Identify volumes	
			Input: https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed
			Input: https://ontology.unifiedcyberontology.org/uco/observable/DiskPartition
			Output: https://ontology.unifiedcyberontology.org/uco/observable/FileSystem
DFT-1169	Filter files related to an application	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.solveit-df.org/solveit/observable/ApplicationFiles
			Output: https://ontology.solveit-df.org/solveit/observable/BrowserAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/BrowserCacheData
			Output: https://ontology.solveit-df.org/solveit/observable/ChatAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/AiChatAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/EmailAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/HealthAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/MapsAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/NavigationAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/PaymentAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/RemindersAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/SocialMediaAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/CalendarAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/PhotosAppFiles
			Output: https://ontology.solveit-df.org/solveit/observable/GamingAppFiles
DFT-1170	Read contents from logical forensic container file(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/LogicalImageContainer
			Output: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1171	Access a file system via live operating system	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Computer
			Output: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1172	Read bitstream from raw image file(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/RawImage
			Output: https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed
DFT-1173	Extract data from captured screenshots	
			Input: https://ontology.solveit-df.org/solveit/observable/DeviceScreenshotCapture
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Message
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Contact
DFT-1174	Read evidential files stored directly on local file system	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/File
			Input: https://ontology.solveit-df.org/solveit/observable/ADBPullData
			Input: https://ontology.solveit-df.org/solveit/observable/AFCExtractionData
			Output: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1175	Extract data from an Android device using content queries	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/AndroidPhone
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Message
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Call
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Contact
DFT-1176	Classify if an image is potentially synthetically generated	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/RasterPicture
			Output: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
DFT-1177	Extract artifacts from multiplayer game app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/GamingAppFiles
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Message
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Contact
			Output: https://ontology.unifiedcyberontology.org/uco/configuration/Configuration
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Account
DFT-1178	Store bitstream data in a raw image format	
			Input: https://ontology.solveit-df.org/solveit/observable/Bitstream
			Output: https://ontology.solveit-df.org/solveit/observable/RawImage
DFT-1179	Extract artifacts from drone/UAV app(s)	
DFT-1180	Extract file(s) from a pre-deletion container	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.unifiedcyberontology.org/uco/observable/File
			Output: https://ontology.unifiedcyberontology.org/uco/observable/path
			Output: https://ontology.solveit-df.org/solveit/observable/DateTimeStamp
DFT-1181	Extract artifacts from smart home app(s)	
			Input: https://ontology.solveit-df.org/solveit/observable/SmartHomeAppFiles
			Output: https://ontology.unifiedcyberontology.org/uco/location/Location
DFT-1182	Filter a timeline for relevant entries	
			Input: https://ontology.solveit-df.org/solveit/observable/Timeline
			Output: https://ontology.solveit-df.org/solveit/observable/Timeline
DFT-1184	Sort a timeline so entries are ordered chronologically	
			Input: https://ontology.solveit-df.org/solveit/observable/Timeline
			Output: https://ontology.solveit-df.org/solveit/observable/SortedTimeline
DFT-1185	Extract data from operating system notifications	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Message
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Message
			Output: https://ontology.solveit-df.org/solveit/observable/DateTimeStamp
DFT-1186	Compute per-file hash values	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Output: https://ontology.unifiedcyberontology.org/uco/observable/hash
DFT-1187	Extract content from compound files	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/File
			Output: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1190	Extract operating system version(s) from data source	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
DFT-1191	Parse allocated structures in Windows HIVE files	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/WindowsRegistryHive
			Output: https://ontology.unifiedcyberontology.org/uco/observable/WindowsRegistryKey
			Output: https://ontology.unifiedcyberontology.org/uco/observable/WindowsRegistryValue
DFT-1192	Disable connectivity using device configuration settings	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice
			Output: https://ontology.unifiedcyberontology.org/uco/observable/MobileDevice
DFT-1193	Read metadata from within a forensic image container	
			Input: https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer
			Input: https://ontology.solveit-df.org/solveit/observable/LogicalImageContainer
			Output: https://ontology.caseontology.org/case/investigation/exhibitNumber
			Output: https://ontology.unifiedcyberontology.org/uco/core/name
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Note
			Output: https://ontology.unifiedcyberontology.org/uco/core/description
			Output: https://ontology.unifiedcyberontology.org/uco/types/Hash
DFT-1194	Classify if audio is potentially synthetically generated	
			Input: https://ontology.solveit-df.org/solveit/observable/AudioFile
			Output: https://ontology.unifiedcyberontology.org/uco/analysis/ArtifactClassification
DFT-1195	Generate Alternative Hypotheses	
			Input: https://ontology.solveit-df.org/solveit/analysis/Hypothesis
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Observable
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisSet
DFT-1196	Extract operating system installation date	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Observable
			Output: https://ontology.unifiedcyberontology.org/uco/observable/installDate
DFT-1197	Determine mount point mappings within an operating system	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Observable
			Output: https://ontology.unifiedcyberontology.org/uco/observable/Device
			Output: https://ontology.unifiedcyberontology.org/uco/observable/DiskPartition
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship
			Output: https://ontology.unifiedcyberontology.org/uco/observable/mountPoint
			Output: https://ontology.unifiedcyberontology.org/uco/observable/driveLetter
DFT-1198	Compute hash of data read from source device	
			Input: https://ontology.solveit-df.org/solveit/observable/Bitstream
			Output: https://ontology.unifiedcyberontology.org/uco/types/Hash
DFT-1199	Compute hash of stored bitstream data	
			Input: https://ontology.solveit-df.org/solveit/observable/BitstreamRandomAccessed
			Output: https://ontology.unifiedcyberontology.org/uco/types/Hash
DFT-1200	Evaluate observations in light of hypotheses	
			Input: https://ontology.solveit-df.org/solveit/analysis/HypothesisSet
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Observable
			Output: https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult
DFT-1202	Verify automated results manually	
			Input: https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult
			Input: https://ontology.unifiedcyberontology.org/uco/observable/ObservableObject
			Output: https://ontology.unifiedcyberontology.org/uco/analysis/AnalyticResult
DFT-1203	Use an AI-based prompt for interrogating case data	
			Input: https://ontology.solveit-df.org/solveit/observable/FileSet
			Input: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisedEvent
			Output: https://ontology.solveit-df.org/solveit/observable/ArtifactSet
			Output: https://ontology.unifiedcyberontology.org/uco/core/Annotation
			Output: https://ontology.solveit-df.org/solveit/analysis/HypothesisedRelationship
DFT-1204	Verify hash of stored bitstream data matches a stored hash	
			Input: https://ontology.unifiedcyberontology.org/uco/types/Hash
			Output: https://ontology.solveit-df.org/solveit/observable/HashVerificationResult
DFT-1205	Decode raw data into data value(s)	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/ContentData
DFT-1206	Decode a number from raw data	
			Input: https://ontology.unifiedcyberontology.org/uco/observable/ContentData
DFT-1208	Store acquisition metadata along with a forensic image format	
			Input: https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer
			Input: https://ontology.solveit-df.org/solveit/observable/LogicalImageContainer
			Input: https://ontology.caseontology.org/case/investigation/exhibitNumber
			Input: https://ontology.unifiedcyberontology.org/uco/core/name
			Input: https://ontology.unifiedcyberontology.org/uco/core/description
			Input: https://ontology.unifiedcyberontology.org/uco/observable/Note
			Input: https://ontology.unifiedcyberontology.org/uco/types/Hash
			Output: https://ontology.solveit-df.org/solveit/observable/PhysicalImageContainer
			Output: https://ontology.solveit-df.org/solveit/observable/LogicalImageContainer