ID Name DFT-1001 Triage devices or media DFT-1002 Copy sectors from storage media DFT-1003 Copy pages from physical memory DFT-1004 Collect logical files selectively DFT-1005 Search a crime scene for relevant physical evidence DFT-1006 Search a crime scene using digital sniffer dogs DFT-1007 Detect the potential existence of digital devices using a SyncTriage-based approach DFT-1008 Detect the potential existence of digital devices by profiling network traffic DFT-1009 Locate potential digital evidence sources via cloud account identifiers DFT-1010 Place device in a faraday environment DFT-1011 Store seized devices or media in evidence bags DFT-1012 Write protect storage media using a hardware write blocker DFT-1013 Write protect storage media using a software write blocker DFT-1014 Document the chain of custody DFT-1015 Collect logical files selectively based on privacy preserving criteria DFT-1016 Collect specific pieces of information from a live running device DFT-1017 Capture network packets DFT-1018 Collect data from a remote networked device DFT-1019 Extract a backup from a mobile device DFT-1020 Extract the file system from a mobile device DFT-1021 Extract artifacts from a configuration file DFT-1022 Capture mobile device screenshots (manually) DFT-1023 Collect data from cloud service via a live web page using credentials DFT-1024 Collect data from cloud service via submission of request to service provider DFT-1025 Store bitstream data in a forensic image format DFT-1026 Store data in standard archive format DFT-1027 Read data from a device using JTAG DFT-1028 Physically remove a storage chip from a device (chip-off) DFT-1029 Read data from a desoldered eMMC via a chip reader DFT-1030 Read data from unmanaged NAND DFT-1031 Recover encryption/decryption key from memory DFT-1032 Recover encryption/decryption key information using side channel attacks DFT-1033 Extract credential(s) from an accessible device to attempt access to a more secure device or service DFT-1034 Attack a stored credential or device using a brute force approach DFT-1035 Attack a stored credential or device using a dictionary-based approach DFT-1036 Recover information about a potential device PIN or pattern lock using a smudge attack DFT-1037 Obtain password from the device's owner DFT-1038 Attack a stored credential or device using a rainbow table-based approach DFT-1039 Downgrade apps to facilitate data extraction DFT-1040 Exploit a mobile device to facilitate privileged access for data extraction DFT-1041 Gain access to a device via a Pin2Pwn approach DFT-1042 Verify hash of copied data matches the hash of the data read from source device DFT-1043 Read bitstream from forensic image container file(s) DFT-1044 Decode data stored in a mobile backup format DFT-1045 Read contents from standard archive file(s) DFT-1046 Redact digital forensic tool results to protect privileged material DFT-1047 Filter files using a hashset to reduce files examined DFT-1048 Protect privacy by only partially processing data from a source DFT-1049 Keyword search DFT-1050 Locate relevant files using a hashset to identify files of interest DFT-1051 Locate potentially relevant files using fuzzy hash matching DFT-1052 Generate timeline DFT-1053 Extract 'entities' from a data source DFT-1054 Review artifacts or content manually for relevant material DFT-1055 Examine file and folder structure DFT-1056 Enumerate connections between artifacts DFT-1057 Search for indicators of steganography DFT-1058 Search for mismatched file extensions DFT-1059 Identify partitions DFT-1060 Enumerate allocated files and folders DFT-1061 Recover non-allocated files DFT-1062 Decrypt encrypted file systems/volumes DFT-1063 Identify file types DFT-1064 Carve non-allocated files DFT-1065 Extract artifacts from operating system-level content indexer(s) DFT-1066 Extract artifacts from operating system log files DFT-1067 Extract artifacts from operating system cloud synchronization features DFT-1068 Extract operating system artifacts indicating recently used files DFT-1069 Extract artifacts from a web browser DFT-1070 Extract artifacts from email client(s) or webmail access DFT-1071 Extract data from SQLite database(s) DFT-1072 Extract artifacts from chat app(s) DFT-1073 Extract artifacts from calendar app(s) DFT-1074 Extract artifacts from social network app(s) DFT-1075 Extract artifacts from maps/travel app(s) DFT-1076 Extract artifacts from log files DFT-1077 Extract artifacts from photo management app(s) DFT-1078 Extract artifacts from cloud synchronization app(s) DFT-1079 Examine audio content DFT-1080 Examine video content DFT-1081 Examine image/picture content DFT-1082 Examine document content DFT-1083 Extract artifacts from operating system memory structures DFT-1084 Extract potentially user-identifying content from account information DFT-1085 Conflate specific account identifiers to a single user identity DFT-1086 Analyze timeline DFT-1087 Reconstruct the location-based properties of an event DFT-1088 Reconstruct relations between events or properties of events DFT-1089 Review source code of software DFT-1090 Experiment with software to ascertain forensic artifacts DFT-1091 Tag artifacts DFT-1092 Generate tag-based automated report DFT-1093 Write expert report DFT-1094 Disclose investigation material to an authorized legal authority DFT-1095 Instrument a piece of running software DFT-1096 Extract operating system artifacts indicating program execution DFT-1097 Extract operating system artifacts indicating installed software DFT-1098 Enumerate operating system user accounts DFT-1099 Repair a damaged or incomplete file using `grafting` DFT-1100 Extract metadata from within images DFT-1101 Conduct cell site survey DFT-1102 Decode data extracted from unmanaged NAND DFT-1103 Virtualize suspect system for previewing DFT-1104 Collect data using open source intelligence DFT-1105 Examine memory dump from an application DFT-1106 Classify if a video is potentially synthetically generated DFT-1107 Extract artifacts from health/fitness app(s) DFT-1108 Extract artifacts from reminders app(s) DFT-1109 Extract artifacts from payment app(s) DFT-1110 Preserve reference data DFT-1111 Record system clock offset DFT-1112 Locate and remove physical disks from a device DFT-1113 Access internal storage via bootable environment DFT-1114 Preserve memory contents via Cold Boot Attack DFT-1115 Visualize geolocation information DFT-1116 Extract references to connected devices DFT-1117 Reconstruct the time that an event may have occurred DFT-1118 Locate relevant files by path DFT-1119 Automatically scan for artifact changes caused by app updates DFT-1120 Extract artifacts from app data automatically DFT-1121 Index a data source for keyword searching DFT-1122 Keyword search (case-type wordlists) DFT-1123 Keyword search (case-specific wordlists) DFT-1124 Keyword search (indexed) DFT-1125 Keyword search (live) DFT-1126 Keyword search (live) (physical) DFT-1127 Keyword search (live) (logical) DFT-1128 Search for indicators of malware DFT-1129 Search for indicators of clock tampering DFT-1130 Search for indicators of encrypted data DFT-1131 Search for indicators of trail obfuscation DFT-1132 Search for indicators of artifact wiping DFT-1133 Extract artifacts from AI companion app(s) DFT-1134 Use time anchors to estimate clock offset DFT-1137 Extract browser history artifacts DFT-1138 Extract browser cache artifacts DFT-1139 Extract browser session artifacts DFT-1140 Extract browser autofill artifacts DFT-1141 Extract browser bookmark artifacts DFT-1142 Extract browser download artifacts DFT-1143 Extract browser configuration artifacts DFT-1144 Enumerate browser profiles DFT-1145 Extract browser extensions artifacts DFT-1146 Extract browser synchronization artifacts DFT-1147 Extract browser cookie artifacts DFT-1148 Extract browser web storage artifacts DFT-1149 Extract artifacts from the file versioning feature DFT-1150 Recover non-allocated files using residual file metadata DFT-1151 Keyword search (over extracted artifacts) DFT-1153 Apply offset to a timestamp DFT-1154 Reconstruct an identity associated with an event DFT-1155 Reconstruct that a specific event may have occurred DFT-1156 Reconstruct if an event could have functionally occurred on a system given its capabilities DFT-1157 Extract device data using exposed service DFT-1158 Configure device to enable a service needed for data extraction DFT-1159 Extract mobile data via deployed agent DFT-1160 Collect data with 'cloud backup restore' approach DFT-1161 Collect data from cloud service via API using credentials DFT-1162 Read data from a device via In-System Programming (ISP) DFT-1163 Capture mobile device screenshots (automatically) DFT-1164 Read data directly from a block device DFT-1165 Extract software configuration information DFT-1166 Connect directly to storage media DFT-1167 Extract search terms from URLs DFT-1168 Identify volumes DFT-1169 Filter files related to an application DFT-1170 Read contents from logical forensic container file(s) DFT-1171 Access a file system via live operating system DFT-1172 Read bitstream from raw image file(s) DFT-1173 Extract data from captured screenshots DFT-1174 Read evidential files stored directly on local file system DFT-1175 Extract data from an Android device using content queries DFT-1176 Classify if an image is potentially synthetically generated DFT-1177 Extract artifacts from multiplayer game app(s) DFT-1178 Store bitstream data in a raw image format DFT-1179 Extract artifacts from drone/UAV app(s) DFT-1180 Extract file(s) from a pre-deletion container DFT-1181 Extract artifacts from smart home app(s) DFT-1182 Filter a timeline for relevant entries DFT-1184 Sort a timeline so entries are ordered chronologically DFT-1185 Extract data from operating system notifications DFT-1186 Compute per-file hash values DFT-1187 Extract content from compound files DFT-1190 Extract operating system version(s) from data source DFT-1191 Parse allocated structures in Windows HIVE files DFT-1192 Disable connectivity using device configuration settings DFT-1193 Read metadata from within a forensic image container DFT-1194 Classify if audio is potentially synthetically generated DFT-1195 Generate Alternative Hypotheses DFT-1196 Extract operating system installation date DFT-1197 Determine mount point mappings within an operating system DFT-1198 Compute hash of data read from source device DFT-1199 Compute hash of stored bitstream data DFT-1200 Evaluate observations in light of hypotheses DFT-1202 Verify automated results manually DFT-1203 Use an AI-based prompt for interrogating case data DFT-1204 Verify hash of stored bitstream data matches a stored hash DFT-1205 Decode raw data into data value(s) DFT-1206 Decode a number from raw data DFT-1208 Store acquisition metadata along with a forensic image format