ID	Name
DFM-1001	Review of all triage results that are relied on during the full digital forensic examination
DFM-1002	Testing of the faraday environment to be used
DFM-1003	Check image size corresponds with drive label
DFM-1004	Check hash of image matches hash of source device (DFT-1042)
DFM-1005	Testing to ensure that the software and hardware disk imaging setup can detect HPAs
DFM-1006	Testing to ensure software and hardware setup detects DCOs
DFM-1007	Use hardware write blocker (DFT-1012)
DFM-1008	Use software write blocker (DFT-1013)
DFM-1009	Check hash of image matches hash of source material
DFM-1010	Perform full extraction instead of selective
DFM-1011	Perform full extraction instead of selective, followed by partial processing
DFM-1012	Clear presentation of the backup and deletion process
DFM-1013	Consider memory acquisition and offline analysis instead
DFM-1014	Test and document changes made by the tools used
DFM-1015	Use tools only if changes made are to locations where relevant evidence is unlikely to be located.
DFM-1016	Alert user that the data collected is a partial set of data stored on the device
DFM-1017	Check for physical presence of SD card
DFM-1018	Check if presence of SD card is expected
DFM-1019	Consider if file system acquisition is possible/permitted (DFT-1020)
DFM-1020	Compare data extracted with full list of installed apps
DFM-1021	Verify the disk image integrity with multiple hash algorithms e.g. MD5 and SHA1 (Kessler 2016)
DFM-1022	Restrict access to stored disk images
DFM-1023	Ensure and check logs of access to stored disk images
DFM-1024	Validate extracted key against the encrypted material before powering off the machine from which the key was extracted (e.g. Hargreaves & Chivers 2008b)
DFM-1025	Validation & testing against the encryption system under consideration
DFM-1026	Testing of backup parsing method
DFM-1027	Use dual tool verification
DFM-1028	Parse app lists if available and highlight missing data
DFM-1029	Testing of keyword indexing component of tool
DFM-1030	Testing of retrieval of indexed content
DFM-1031	Also using synonyms for terms used
DFM-1032	Evaluation of the effectiveness of wordlist used for case-type searching
DFM-1033	Prioritization of search results based on context
DFM-1034	Comparison of index results with live search results (DFT-1125)
DFM-1035	Verification against second tool with known different regex implementation
DFM-1036	Testing of regular expression component of tool
DFM-1037	The context of relevant keyword results are manually checked
DFM-1038	Word list selected such that a practically reviewable number of results are returned
DFM-1039	Hash matching to reduce need for manual review
DFM-1040	Use of AI to flag potentially relevant content to reduce need for manual review
DFM-1041	Regular breaks to minimise investigator fatigue
DFM-1042	Secondary review of flagged items to ensure relevance
DFM-1043	Scan for orphaned EPTs
DFM-1044	Scan for Volume Boot Records in unpartitioned space
DFM-1045	Explicitly detect sector size in use
DFM-1046	Check pointer offsets for both 512 and 4096 sectors sizes
DFM-1047	Testing partition table parsing on standard and non-standard configurations
DFM-1048	Check built-in integrity checks of partition tables where possible
DFM-1049	Check consistency between primary and backup partition tables (where possible)
DFM-1050	Manually verify relevant data
DFM-1051	Validation of specific file system parsing operation for the file system under consideration
DFM-1052	Use of a second independent tool to compare live file system listing
DFM-1053	Verification of the file system specification used as the basis for the tool development
DFM-1054	Testing of message extraction and parsing features
DFM-1055	Correlation of data extracted with data from service provider
DFM-1056	Correlation of message data from third party data (another participant in message thread)
DFM-1057	Testing of parsing of syncronisation artefacts
DFM-1058	Checking for other confirmatory indicators of the inferred device's existence.
DFM-1059	Ongoing research and documentation of syncronisation artefacts
DFM-1060	Repair salvaged content by grafting different reference data onto fragment(s) (DFT-1099)
DFM-1061	Use digital stratigraphy to attempt to attribute data within a specific file system
DFM-1062	Verify semantic integrity of carved content using manual inspection of relevant data
DFM-1063	Verify semantic integrity of carved content using an automated tool
DFM-1064	Verify that salvaged content is renderable using visual inspection of displayed/rendered content 
DFM-1065	Render salvaged content by reconstructing a container around fragment(s) based on detected video frame and audio sample locations and (if available) a reference video file with similar parameters.
DFM-1066	Attempt to reconstruct browser activity from other areas of disk
DFM-1067	Analyze web browser memory for web browsing activity (DFT-1105)
DFM-1068	Use digital sniffer dogs to assist in locating evidence (DFT-1006)
DFM-1069	Use a SyncTriage style approach to determine existence other synchronized devices (DFT-1007)
DFM-1070	Ensure hash algorithm(s) used are resistant to collisions through data manipulation
DFM-1071	Thorough testing of write blocker against multiple targets to ensure that writes are not possible.
DFM-1072	Regular checks for hardware write blocker firmware updates.
DFM-1073	Subscription to notifications from write blocker vendor for firmware updates or identified problems.
DFM-1074	Validate image hash against one stored externally to the image in a trusted location.
DFM-1075	Testing programme to validate hashes of data in images is calculated correctly
DFM-1076	Testing programme to validate hashes of metadata in images is calculated correctly
DFM-1077	Ensure potential secondary locations for stored message content are reviewed.
DFM-1078	Use of multiple carving tools and comparing results
DFM-1079	Analyse file content to detect incompatibility between the content and the recovered file system metadata
DFM-1080	Use a hashset of known files to detect that recovered content does not match the expected file content
DFM-1081	Check if recovered content matches with size in metadata e.g. file footer at expected location.
DFM-1082	Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file
DFM-1083	Analyse content for embedded timestamps to find that content is a newer file than indicated by metadata (beware of file tunneling)
DFM-1084	Test that the tool used expresses uncertainty in the classification of file recovery results
DFM-1085	Use of multiple tools to verify disk image hash
DFM-1086	Acquire the parts of memory with interconnected data first, before proceeding with a sequential acquisition.
DFM-1087	Acquire memory from outside of the target system for example using direct memory access (DMA) devices
DFM-1088	If applicable, leverage hardware virtualization utilities to add a hypervisor to the system, i.e., virtualize the original system. This allows to either freeze the system before the acquisition or, if the system should not be completely frozen, to copy pages before they are modified.
DFM-1089	Attempt physical disk repair
DFM-1090	Compare carved results against known files (e.g. from another source)
DFM-1091	Use a brute force attack instead (DFT-1034)
DFM-1092	Optimise dictionary
DFM-1093	Use mangling rules to generate variants of candidate passwords
DFM-1094	Include contextual information when assembling the dictionary
DFM-1095	Order dictionary to test the most likely candidates first
DFM-1096	Apply additional resources to dictionary attack
DFM-1097	Attempt to obtain password/passcode from the device owner (DFT-1037)
DFM-1098	Optimise the brute force search space
DFM-1099	Use a dictionary attack instead (DFT-1035)
DFM-1100	Apply additional resources to brute force attack
DFM-1101	Apply time offset to timestamp (DFT-1153)
DFM-1102	Apply techniques to read remapped sectors
DFM-1103	Check that analysis of timestamp accuracy on which event reconstruction is based has been performed
DFM-1104	Testing of report generation functionality that all intended bookmarks are included
DFM-1105	Manual verification that all intended bookmarks are included in the generated report.
DFM-1106	Testing that generated reports correctly represent/render all expected file types
DFM-1107	Manual verification that all bookmarked items in the report are correctly rendered/represented.
DFM-1108	Preserve hash in secure location of the generated report so intentional or unintentional modifications can be detected.
DFM-1109	Testing that tool(s) identify file types correctly
DFM-1110	Manual review of files classified as unknown
DFM-1111	Use of multiple tools to classify file types
DFM-1112	Use of AI to classify files in addition to standard programmatic methods
DFM-1113	Use mobile exploit to gain privileged access (DFT-1040)
DFM-1114	Clear use of language around mobile file system extractions, making the limitations clear and differentiating from a full disk image
DFM-1115	Attempt to brute force user PIN (potentially on device) (DFT-1034)
DFM-1116	Attempt to dictionary attack user PIN (potentially on device) (DFT-1035)
DFM-1117	Attempt to obtain user PIN from user (DFT-1037)
DFM-1118	Recover appropriate database table joins from source application source code
DFM-1119	Recover appropriate database table joins from source application reverse engineering
DFM-1120	Recover appropriate database table joins from source application developer documentation
DFM-1121	Infer appropriate table joins from extensive experimentation with known ground-truth data (DFT-1090)
DFM-1122	Apply non-allocated record recovery to database file(s)
DFM-1123	Apply system-wide record recovery for non-allocated database record data structures
DFM-1124	Examine database contents with and without Write Ahead Log (WAL) files applied
DFM-1125	Examine database journal files
DFM-1126	Use forensic bootable environment to gain access to internal media (DFT-1113)
DFM-1127	Use a similar system to test steps required to interrupt the normal boot process and boot from Trusted Bootable Environment
DFM-1128	Use a Trusted Bootable Environment that is permitted to boot
DFM-1129	Use USB flashdrive version if a CD version is not permitted to boot
DFM-1130	Disable Secureboot in BIOS to permit bootable environment to load (risks wiping FDE key, requiring ADK).
DFM-1131	Use a Trusted Bootable Environment that supports accessing the internal disk
DFM-1132	Use a Trusted Bootable Environment that supports decryption of the internal disk
DFM-1133	Acquire the encrypted contents of the internal disk and decrypt the copy within a virtualized environment
DFM-1134	Testing that connected devices are detected.
DFM-1135	Testing that correct metadata/status of connected devices is extracted
DFM-1136	Testing of archive format parsing
DFM-1137	Review of logs for any file extraction errors
DFM-1138	Testing file name/path pattern matching engine
DFM-1139	Use automated software monitoring to detect app artefact changes (DFT-1119)
DFM-1140	Use automation framework to emulate user actions to generate test data
DFM-1141	Careful review of case brief for case-specific keyword list generation
DFM-1142	Review of case-specific keyword list by case officer
DFM-1143	Use live logical keyword search (DFT-1127)
DFM-1144	Use indexed keyword search (DFT-1124)
DFM-1145	Apply OCR to files and search or index resulting text
DFM-1146	Ensure keyword indexing settings capture text encodings required during indexing
DFM-1147	Ensure keyword indexing settings configure text substring handling as required during indexing
DFM-1148	Ensure keyword indexing settings configure case sensitivity for indexing as required
DFM-1149	Ensure keyword indexing settings mean that decompression will be applied as required during indexing
DFM-1150	Ensure keyword indexing settings mean that file formats will be decoded as required during indexing
DFM-1151	Check keyword results are part of allocated file, or if not perform detailed analysis to determine if the association between keyword results and file is valid
DFM-1152	Peer review of case-specific keyword list created
DFM-1153	Index data in the case and perform iterative keyword searching using the index (DFT-1124)
DFM-1154	Testing for live message recovery from AI companion app
DFM-1155	Testing for deleted message recovery from AI companion app
DFM-1156	Testing that message sender and recipient extraction are correct
DFM-1157	Ensure messages are viewed in the context of the message thread
DFM-1158	Testing for live picture message recovery from AI companion app
DFM-1159	Testing for deleted picture message recovery from AI companion app
DFM-1160	Testing that picture message sender and recipient extraction are correct
DFM-1161	Testing of live call record recovery from AI companion app
DFM-1162	Testing of deleted call record recovery from AI companion app
DFM-1163	Testing that call record caller and recipient extraction are correct
DFM-1164	Testing of account details recovery from AI companion app
DFM-1165	Ensure data collection prior to any interaction with app
DFM-1166	Remove all network connectivity from device
DFM-1167	Check time of account access is prior to device seizure time
DFM-1168	Request logs of access times from service provider
DFM-1169	Testing of app settings recovery from AI companion app
DFM-1170	Experiments with test device to view possible settings of forensic value
DFM-1171	Testing of the recovery of companion AI bot settings
DFM-1172	Also examine any older versions of the logs from backups
DFM-1173	Check logging settings so the bounds of logging are known
DFM-1174	Check logging settings to determine expected behaviour
DFM-1175	Ensure any available archive logs are also examined
DFM-1176	Ensure log entry type interpretation applies for the software version being examined
DFM-1177	Ensure resolution or limitations of logfile timestamps are understood
DFM-1178	Ensure timezone handling method for logfile timestamps is understood
DFM-1179	If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation
DFM-1180	Testing correct extraction of logfile entry timestamps
DFM-1181	Testing logfile parsing capability
DFM-1182	Testing of correct log entry type extraction
DFM-1187	Ensure browser cache data is also considered  (DFT-1138)
DFM-1188	Ensure all profiles of the web browser are considered (DFT-1144)
DFM-1189	Conduct experiments to determine if content from the page in question is cached only when viewed in the browser
DFM-1190	Ensure that the context of recovered URLs is considered during event reconstruction
DFM-1191	Ensure that profile configuration is examined rather than just folders within the standard profile folder (DFT-1143)
DFM-1192	Examine browser configuration to determine history retention settings (DFT-1143)
DFM-1193	Obtain older versions of browser history files from backups or from file system versioning features
DFM-1194	Consider carefully page titles and other details associated with older web history visits when details are recovered using SQL join queries.
DFM-1195	Also examine browser cache to confirm details about an older web visit when details are recovered using SQL join queries. (DFT-1138)
DFM-1196	Check if file being recovered is smaller than a block
DFM-1197	Check if file being recovered is resident (applicable on some file systems)
DFM-1198	Check if file system and operating system make use of an 'allocated but unwritten' value e.g. VDL.
DFM-1199	Check all relevant file size metadata values when recovering file content
DFM-1200	Ensure that inconsistencies between allocated data size and data written size are clearly flagged.
DFM-1203	Use indexed keyword search over broader content of the data source (DFT-1124)
DFM-1204	Use live keyword search over broader content of the data source (DFT-1125)
DFM-1205	Use wordlist generator with case data
DFM-1206	Ensure that tools used clearly separate fact from interpretation
DFM-1207	Ensure training is in place for tool operators to separate fact from interpretation within the tool used
DFM-1208	Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered
DFM-1209	Ensure that tools used present the uncertainty associated with automated interpretation of data
DFM-1210	Use a forensic image format with internal integrity and continuity metadata
DFM-1211	Test the parsing of split forensic images
DFM-1212	Test the parsing of split forensic images with the maximum number of segments possible
DFM-1213	Test the parsing of split forensic images with missing segments
DFM-1214	Ensure forensic tool UI clearly warns that there are problems while parsing a split forensic image file
DFM-1215	Test the parsing of split forensic images with a corrupt segment
DFM-1216	Check that the assumption is valid that the specific local/external timestamp pair should be correlated
DFM-1217	Consider multiple time anchors and check if timestamps from multiple external time sources agree
DFM-1218	Ensure that tools and processes take into account all current knowledge on sources of local/external timestamp pairs (time anchors)
DFM-1219	Manual verification of timestamp decoding within a time anchor
DFM-1220	Periodically keep records of time offsets of significant external servers (DFT-1110)
DFM-1221	Testing of timestamp decoding within a time anchor
DFM-1222	Testing to ensure that tooling is able to extract local/external timestamp pairs (time anchors)
DFM-1223	Apply time zone based offsets only to UTC stored timestamps
DFM-1224	Check for location artifacts to infer the time zone at a specific moment
DFM-1225	Estimate clock offset at a specific point in time using time anchoring (DFT-1134)
DFM-1226	Testing to determine whether a timestamp is in UTC or local time
DFM-1227	Search for indicators of clock tampering (DFT-1129)
DFM-1228	Record system clock offset (DFT-1111)
DFM-1229	Determine last timezone used on system
DFM-1230	Ensure that daylight savings offsets that are applied to timestamps are correct
DFM-1231	Make use of 'paired searching'
DFM-1232	Adopt a systematic search pattern
DFM-1233	Test data extraction methods against reference data with known timestamps
DFM-1234	Exploit device to facilitate password/pincode attacks (DFT-1040)
DFM-1235	Attempt to obtain password/pincode with brute force attacks (DFT-1034)
DFM-1236	Attempt to obtain password/pincode with dictionary attacks (DFT-1035)
DFM-1237	Ensure that archive format used can handle sufficiently large files
DFM-1238	Configure device to enable required service (DFT-1158)
DFM-1239	Obtain possible passwords/PIN codes from other devices with limited security (DFT-1033)
DFM-1240	Check for indications of disk backed memory pages
DFM-1241	Avoid direct connection to media and use hardware write blocker instead (DFT-1012)
DFM-1242	Testing live message recovery from multiplayer gaming app
DFM-1243	Request user data from multiplayer gaming platform and compare
DFM-1244	Testing deleted message recovery from multiplayer gaming app
DFM-1245	Testing live contact recovery from a multiplayer gaming app
DFM-1246	Testing deleted contact recovery from a multiplayer gaming app
DFM-1247	Testing that gaming app configuration information is recovered correctly
DFM-1248	Testing to ensure that live accounts are recovered correctly from a gaming app
DFM-1249	Testing to ensure that deleted accounts are recovered correctly from a gaming app
DFM-1250	Test that timeline analysis tool returns correct results when filter criteria are provided
DFM-1251	Manually review timeline entries for relevance
DFM-1252	Refine timeline filtering criteria to reduce set of entries to a manageable set for review
DFM-1253	Ensure that timeline analysis tool highlights that a filtered timeline is presented e.g. x/y entries shown
DFM-1259	Test that a timeline tool correctly sorts entries
DFM-1260	Check that sorted timeline contains same number of entries as unsorted timeline
DFM-1261	Test that timeline sorting correctly represents entries with low resolution timestamps
DFM-1262	Test that timeline tools represent timeline entries with the same value at the same point in time, not in an artificial order
DFM-1263	Check timeline entry to ensure that a timezone has not already been applied and shifted the timestamp value
DFM-1264	Ensure that tools used extract data from any operating system notification databases or relevant files
DFM-1265	Test that the tool used correctly recovers operating system notifications from the data structures examined
DFM-1266	Examine longer lasting operating system notification storage locations if possible
DFM-1267	Test that the tool used correctly recovers operating system notification timestamps from the data structures examined
DFM-1268	Count timeline entries before and after sorting a timeline and check they are the same
DFM-1269	Generate UUIDs of all timeline entries prior to a sort and ensure that all are present post-sort
DFM-1270	Systematically analyse all fields and timestamps in API responses to recover evidence that would otherwise be missed
DFM-1271	Cross-validate API-derived artefacts against independent sources to improve reliability
DFM-1272	Test that the tool extracts the correct operating system
DFM-1273	Ensure that older operating system versions are also displayed along with current version
DFM-1274	Testing of Windows HIVE file parsing
DFM-1275	Ensure tool presents Registry key modification times as applicable to a key only, not any individual value
DFM-1276	Collect from all available API endpoints, including undocumented ones identified via client reverse engineering
DFM-1277	Monitor structural changes to the target API and update parsing logic to prevent silent data loss
DFM-1278	Place device in faraday bag to block connectivity (DFT-1010)
DFM-1279	Ensure all relevant connectivity settings for this particular device have been disabled
DFM-1280	Compare the metadata stored in a forensic container with that recorded in accompanying documentation
DFM-1281	Compare the cryptographic hash stored in a forensic container with one recorded externally
DFM-1282	Use up-to-date API
DFM-1283	Use an alternative method that does not truncate data during format conversion
DFM-1284	Ensure tool configuration is correct
DFM-1285	Testing that a tool acquires complete and accurate data
DFM-1286	Acquire data from production environment
DFM-1287	Update non-production environment with latest production data
DFM-1288	Ensure that tools preserve metadata and relationships
DFM-1289	Acquire cloud service logs separately
DFM-1290	Request cloud service logs from provider
DFM-1291	Obtain an up-to-date schema
DFM-1292	Rate limit API calls to stay within limits
DFM-1293	Contact cloud service provider to lift API limits
DFM-1294	Ensure credentials have sufficient permissions
DFM-1295	Ensure credentials have not expired or been revoked
DFM-1296	Determine cause of failure and retry acquiring data when resolved
DFM-1297	Use an alternative method that preserves historical data
DFM-1298	Acquire raw data without conversion
DFM-1299	Cryptographically sign generated forensic analysis reports with an asymmetric key
DFM-1300	Ensure that hypotheses are mutually exclusive
DFM-1301	Avoid hypotheses that rely on untestable assertions
DFM-1302	Frame the hypothesis as a relational prediction
DFM-1303	Refer to the to the "suspect" rather than "device user" when generating a hypothesis related to the accused individual
DFM-1304	Avoid judgmental or loaded terminology in generated hypotheses
DFM-1305	Ensure that hypotheses address the correct level of hierarchy (source, activity, or offense level)
DFM-1306	Generate hypotheses as declarative statements written either in the present tense or specifying a past time period.
DFM-1307	Do not generate hypotheses that are overly narrow and may increase the risk of over-specificity or confirmation bias. For instance, refer to a class (wiping tool, Trojan horse program) rather than a member of class (e.g., Eraser.exe, Backdoor.exe) to avoid narrowly focusing on a specific detail
DFM-1308	Test that the tool recovers the date of operating system installation correctly
DFM-1309	Ensure that the tool examines artifacts of previous operating system installation and presents them clearly
DFM-1310	Recover older copies of data that contains mount point mappings from backups
DFM-1311	Recover older copies of data that contains mount point mappings from file versioning artifacts
DFM-1312	Test that tool can correctly recover mount point mappings
DFM-1313	Check for the presence of multiple operating systems and process mount point mappings for all of them
DFM-1314	Test that cryptographically hashing data on a connected drive/media performs correctly
DFM-1315	Test that cryptographic hashes are calculated correctly over all compression settings used for forensic images
DFM-1316	Test that cryptographic hashing of split forensic images includes the data from all files that make up that image
DFM-1317	State the hypotheses to be evaluated before the examination begins
DFM-1318	Assign the probability or strength of the observations under each competing hypothesis
DFM-1319	Evaluate the observations under each party's claims, not only the instructing party's
DFM-1331	Create a persistent log of any errors during data copying process
DFM-1332	Flag when an AI context window has reached a limit and prevent further processing within that session
DFM-1333	Use keyword searching to complement AI-based queries for relevant artifacts (DFT-1049)
DFM-1334	Use timeline analysis to complement AI-based queries for relevant artifacts (DFT-1086)
DFM-1335	Use hash matching to complement AI-based queries for relevant artifacts (DFT-1050)
DFM-1336	Manually verify artifacts reported as relevant by an AI system (DFT-1054)
DFM-1337	Manual verification of the existence of artifacts reported by an AI system (DFT-1202)
DFM-1338	Ensure AI-based tooling provides IDs that link to the artefacts to facilitate manual verification
DFM-1339	Ensure that the AI-based system is capable of providing reasoning behind the selection of results that are relevant
DFM-1340	Ensure that the AI-based system is capable of providing an audit trail of artifacts considered but excluded as relevant, along with the exclusion criteria
DFM-1341	Manually verify an observation used as part of an AI system's reasoning explanation (DFT-1202)
DFM-1342	Manually verify the link between entities that is asserted by and AI-based system
DFM-1343	Use deterministic event reconstruction approaches to complement AI-based event reconstruction (DFT-1086)
DFM-1344	Do not allow context compression during AI-based investigative sessions
DFM-1345	Manually verify a reconstructed event's existence
DFM-1346	Manually verify the interpretation of artifacts used for an event reconstruction (DFT-1202)
DFM-1347	Look up in artifact catalogs how the identified artifacts should be interpreted
DFM-1348	Manually verify the properties of a reconstructed event
DFM-1349	Manually verify the artifacts used for an event reconstruction (DFT-1202)
DFM-1350	Ensure that tools producing data supporting event reconstruction report any potential uncertainty in their results
DFM-1351	Ensure that raw data is decoded as the correct data type
DFM-1352	Ensure the correct number of bytes are used when decoding raw data into values
DFM-1353	Ensure the correct endianness was used when decoding raw data into values
DFM-1354	Ensure the correct signed/unsigned property is applied when decoding raw data into values
DFM-1355	Ensure the correct endianness was used for value decoding
DFM-1356	Ensure that any potential imprecision in decoding is also included when decoded values are presented
DFM-1363	Test that examiner-entered metadata is correctly written by the acquisition software along with the forensic container
DFM-1364	Test that hashes computed of data stored within a container are written correctly by the acquisition software along with the forensic container