Objective	ID	Name
Prepare for a digital investigation	DFT-1110	Preserve reference data
Find potential digital evidence sources	DFT-1005	Search a crime scene for relevant physical evidence
Find potential digital evidence sources	DFT-1006	Search a crime scene using digital sniffer dogs
Find potential digital evidence sources	DFT-1009	Locate potential digital evidence sources via cloud account identifiers
Find potential digital evidence sources	DFT-1008	Detect the potential existence of digital devices by profiling network traffic
Find potential digital evidence sources	DFT-1007	Detect the potential existence of digital devices using a SyncTriage-based approach
Prioritize digital evidence sources	DFT-1001	Triage devices or media
Preserve digital evidence	DFT-1011	Store seized devices or media in evidence bags
Preserve digital evidence	DFT-1010	Place device in a faraday environment
Preserve digital evidence	DFT-1012	Write protect storage media using a hardware write blocker
Preserve digital evidence	DFT-1013	Write protect storage media using a software write blocker
Preserve digital evidence	DFT-1114	Preserve memory contents via Cold Boot Attack
Preserve digital evidence	DFT-1192	Disable connectivity using device configuration settings
Access device data for acquisition	DFT-1029	Read data from a desoldered eMMC via a chip reader
Access device data for acquisition	DFT-1171	Access a file system via live operating system
Access device data for acquisition	DFT-1113	Access internal storage via bootable environment
Access device data for acquisition	DFT-1028	Physically remove a storage chip from a device (chip-off)
Access device data for acquisition	DFT-1166	Connect directly to storage media
Access device data for acquisition	DFT-1112	Locate and remove physical disks from a device
Overcome protection mechanisms	DFT-1039	Downgrade apps to facilitate data extraction
Overcome protection mechanisms	DFT-1034	Attack a stored credential or device using a brute force approach
Overcome protection mechanisms	DFT-1035	Attack a stored credential or device using a dictionary-based approach
Overcome protection mechanisms	DFT-1033	Extract credential(s) from an accessible device to attempt access to a more secure device or service
Overcome protection mechanisms	DFT-1031	Recover encryption/decryption key from memory
Overcome protection mechanisms	DFT-1041	Gain access to a device via a Pin2Pwn approach
Overcome protection mechanisms	DFT-1038	Attack a stored credential or device using a rainbow table-based approach
Overcome protection mechanisms	DFT-1032	Recover encryption/decryption key information using side channel attacks
Overcome protection mechanisms	DFT-1036	Recover information about a potential device PIN or pattern lock using a smudge attack
Overcome protection mechanisms	DFT-1037	Obtain password from the device's owner
Overcome protection mechanisms	DFT-1040	Exploit a mobile device to facilitate privileged access for data extraction
Overcome protection mechanisms	DFT-1158	Configure device to enable a service needed for data extraction
Acquire data	DFT-1163	Capture mobile device screenshots (automatically)
Acquire data	DFT-1023	Collect data from cloud service via a live web page using credentials
Acquire data	DFT-1024	Collect data from cloud service via submission of request to service provider
Acquire data	DFT-1104	Collect data using open source intelligence
Acquire data	DFT-1160	Collect data with 'cloud backup restore' approach
Acquire data	DFT-1030	Read data from unmanaged NAND
Acquire data	DFT-1002	Copy sectors from storage media
Acquire data	DFT-1157	Extract device data using exposed service
Acquire data	DFT-1019	Extract a backup from a mobile device (s)
Acquire data	DFT-1159	Extract mobile data via deployed agent
Acquire data	DFT-1016	Collect specific pieces of information from a live running device
Acquire data	DFT-1003	Copy pages from physical memory
Acquire data	DFT-1022	Capture mobile device screenshots (manually)
Acquire data	DFT-1017	Capture network packets
Acquire data	DFT-1162	Read data from a device via In-System Programming (ISP)
Acquire data	DFT-1027	Read data from a device using JTAG (s)
Acquire data	DFT-1111	Record system clock offset
Acquire data	DFT-1018	Collect data from a remote networked device
Acquire data	DFT-1004	Collect logical files selectively
Acquire data	DFT-1015	Collect logical files selectively based on privacy preserving criteria (s)
Acquire data	DFT-1020	Extract the file system from a mobile device
Acquire data	DFT-1175	Extract data from an Android device using content queries
Acquire data	DFT-1164	Read data directly from a block device
Acquire data	DFT-1161	Collect data from cloud service via API using credentials
Acquire data	DFT-1198	Compute hash of data read from source device
Store acquired data	DFT-1025	Store bitstream data in a forensic image format
Store acquired data	DFT-1026	Store data in standard archive format
Store acquired data	DFT-1178	Store bitstream data in a raw image format
Store acquired data	DFT-1208	Store acquisition metadata along with a forensic image format
Read data from digital evidence storage formats	DFT-1045	Read contents from standard archive file(s)
Read data from digital evidence storage formats	DFT-1042	Verify hash of copied data matches the hash of the data read from source device
Read data from digital evidence storage formats	DFT-1043	Read bitstream from forensic image container file(s)
Read data from digital evidence storage formats	DFT-1044	Decode data stored in a mobile backup format
Read data from digital evidence storage formats	DFT-1102	Decode data extracted from unmanaged NAND
Read data from digital evidence storage formats	DFT-1170	Read contents from logical forensic container file(s)
Read data from digital evidence storage formats	DFT-1172	Read bitstream from raw image file(s)
Read data from digital evidence storage formats	DFT-1173	Extract data from captured screenshots
Read data from digital evidence storage formats	DFT-1174	Read evidential files stored directly on local file system
Read data from digital evidence storage formats	DFT-1193	Read metadata from within a forensic image container
Read data from digital evidence storage formats	DFT-1199	Compute hash of stored bitstream data
Read data from digital evidence storage formats	DFT-1204	Verify hash of stored bitstream data matches a stored hash
Reduce data under consideration	DFT-1047	Filter files using a hashset to reduce files examined
Reduce data under consideration	DFT-1048	Protect privacy by only partially processing data from a source
Reduce data under consideration	DFT-1046	Redact digital forensic tool results to protect privileged material
Access partitions, volumes and file systems data	DFT-1062	Decrypt encrypted file systems/volumes
Access partitions, volumes and file systems data	DFT-1061	Recover non-allocated files
Access partitions, volumes and file systems data	DFT-1150	Recover non-allocated files using residual file metadata (s)
Access partitions, volumes and file systems data	DFT-1064	Carve non-allocated files (s)
Access partitions, volumes and file systems data	DFT-1063	Identify file types
Access partitions, volumes and file systems data	DFT-1059	Identify partitions
Access partitions, volumes and file systems data	DFT-1060	Enumerate allocated files and folders
Access partitions, volumes and file systems data	DFT-1168	Identify volumes
Extract artifacts stored by the operating system	DFT-1067	Extract artifacts from operating system cloud synchronization features
Extract artifacts stored by the operating system	DFT-1065	Extract artifacts from operating system-level content indexer(s)
Extract artifacts stored by the operating system	DFT-1097	Extract operating system artifacts indicating installed software
Extract artifacts stored by the operating system	DFT-1066	Extract artifacts from operating system log files
Extract artifacts stored by the operating system	DFT-1068	Extract operating system artifacts indicating recently used files
Extract artifacts stored by the operating system	DFT-1096	Extract operating system artifacts indicating program execution
Extract artifacts stored by the operating system	DFT-1098	Enumerate operating system user accounts
Extract artifacts stored by the operating system	DFT-1083	Extract artifacts from operating system memory structures
Extract artifacts stored by the operating system	DFT-1116	Extract references to connected devices
Extract artifacts stored by the operating system	DFT-1149	Extract artifacts from the file versioning feature
Extract artifacts stored by the operating system	DFT-1180	Extract file(s) from a pre-deletion container
Extract artifacts stored by the operating system	DFT-1185	Extract data from operating system notifications
Extract artifacts stored by the operating system	DFT-1190	Extract operating system version(s) from data source
Extract artifacts stored by the operating system	DFT-1197	Determine mount point mappings within an operating system
Extract artifacts stored by the operating system	DFT-1196	Extract operating system installation date
Extract artifacts stored by applications	DFT-1069	Extract artifacts from a web browser
Extract artifacts stored by applications	DFT-1137	Extract browser history artifacts (s)
Extract artifacts stored by applications	DFT-1138	Extract browser cache artifacts (s)
Extract artifacts stored by applications	DFT-1139	Extract browser session artifacts (s)
Extract artifacts stored by applications	DFT-1140	Extract browser autofill artifacts (s)
Extract artifacts stored by applications	DFT-1141	Extract browser bookmark artifacts (s)
Extract artifacts stored by applications	DFT-1142	Extract browser download artifacts (s)
Extract artifacts stored by applications	DFT-1143	Extract browser configuration artifacts (s)
Extract artifacts stored by applications	DFT-1144	Enumerate browser profiles (s)
Extract artifacts stored by applications	DFT-1145	Extract browser extensions artifacts (s)
Extract artifacts stored by applications	DFT-1146	Extract browser synchronization artifacts (s)
Extract artifacts stored by applications	DFT-1147	Extract browser cookie artifacts (s)
Extract artifacts stored by applications	DFT-1148	Extract browser web storage artifacts (s)
Extract artifacts stored by applications	DFT-1073	Extract artifacts from calendar app(s)
Extract artifacts stored by applications	DFT-1072	Extract artifacts from chat app(s)
Extract artifacts stored by applications	DFT-1078	Extract artifacts from cloud synchronization app(s)
Extract artifacts stored by applications	DFT-1070	Extract artifacts from email client(s) or webmail access
Extract artifacts stored by applications	DFT-1075	Extract artifacts from maps/travel app(s)
Extract artifacts stored by applications	DFT-1077	Extract artifacts from photo management app(s)
Extract artifacts stored by applications	DFT-1074	Extract artifacts from social network app(s)
Extract artifacts stored by applications	DFT-1105	Examine memory dump from an application
Extract artifacts stored by applications	DFT-1107	Extract artifacts from health/fitness app(s)
Extract artifacts stored by applications	DFT-1108	Extract artifacts from reminders app(s)
Extract artifacts stored by applications	DFT-1109	Extract artifacts from payment app(s)
Extract artifacts stored by applications	DFT-1133	Extract artifacts from AI companion app(s)
Extract artifacts stored by applications	DFT-1179	Extract artifacts from drone/UAV app(s)
Extract artifacts stored by applications	DFT-1181	Extract artifacts from smart home app(s)
Extract artifacts stored by applications	DFT-1177	Extract artifacts from multiplayer game app(s)
Extract data from specific formats	DFT-1100	Extract metadata from within images
Extract data from specific formats	DFT-1187	Extract content from compound files
Extract data from specific formats	DFT-1167	Extract search terms from URLs
Extract data from specific formats	DFT-1099	Repair a damaged or incomplete file using `grafting`
Extract data from specific formats	DFT-1071	Extract data from SQLite database(s)
Extract data from specific formats	DFT-1191	Parse allocated structures in Windows HIVE files
Extract data from specific formats	DFT-1206	Decode a number from raw data
Extract data from specific formats	DFT-1205	Decode raw data into data value(s)
Extract specific artifact types	DFT-1052	Generate timeline
Extract specific artifact types	DFT-1153	Apply offset to a timestamp (s)
Extract specific artifact types	DFT-1121	Index a data source for keyword searching
Extract specific artifact types	DFT-1169	Filter files related to an application
Extract specific artifact types	DFT-1165	Extract software configuration information
Extract specific artifact types	DFT-1053	Extract 'entities' from a data source
Extract specific artifact types	DFT-1056	Enumerate connections between artifacts
Extract specific artifact types	DFT-1021	Extract artifacts from a configuration file
Extract specific artifact types	DFT-1120	Extract artifacts from app data automatically
Extract specific artifact types	DFT-1076	Extract artifacts from log files
Extract specific artifact types	DFT-1186	Compute per-file hash values
Locate potentially relevant content	DFT-1051	Locate potentially relevant files using fuzzy hash matching
Locate potentially relevant content	DFT-1050	Locate relevant files using a hashset to identify files of interest
Locate potentially relevant content	DFT-1049	Keyword search
Locate potentially relevant content	DFT-1125	Keyword search (live) (s)
Locate potentially relevant content	DFT-1126	Keyword search (live) (physical) (s)
Locate potentially relevant content	DFT-1127	Keyword search (live) (logical) (s)
Locate potentially relevant content	DFT-1124	Keyword search (indexed) (s)
Locate potentially relevant content	DFT-1122	Keyword search (case-type wordlists) (s)
Locate potentially relevant content	DFT-1123	Keyword search (case-specific wordlists) (s)
Locate potentially relevant content	DFT-1151	Keyword search (over extracted artifacts) (s)
Locate potentially relevant content	DFT-1118	Locate relevant files by path
Locate potentially relevant content	DFT-1086	Analyze timeline
Locate potentially relevant content	DFT-1134	Use time anchors to estimate clock offset (s)
Locate potentially relevant content	DFT-1182	Filter a timeline for relevant entries (s)
Locate potentially relevant content	DFT-1184	Sort a timeline so entries are ordered chronologically (s)
Locate potentially relevant content	DFT-1203	Use an AI-based prompt for interrogating case data
Review content for relevance	DFT-1054	Review artifacts or content manually for relevant material
Review content for relevance	DFT-1055	Examine file and folder structure
Review content for relevance	DFT-1079	Examine audio content
Review content for relevance	DFT-1194	Classify if audio is potentially synthetically generated (s)
Review content for relevance	DFT-1080	Examine video content
Review content for relevance	DFT-1106	Classify if a video is potentially synthetically generated (s)
Review content for relevance	DFT-1081	Examine image/picture content
Review content for relevance	DFT-1176	Classify if an image is potentially synthetically generated (s)
Review content for relevance	DFT-1082	Examine document content
Detect anti-forensics and other anomalies	DFT-1057	Search for indicators of steganography
Detect anti-forensics and other anomalies	DFT-1058	Search for mismatched file extensions
Detect anti-forensics and other anomalies	DFT-1128	Search for indicators of malware
Detect anti-forensics and other anomalies	DFT-1129	Search for indicators of clock tampering
Detect anti-forensics and other anomalies	DFT-1130	Search for indicators of encrypted data
Detect anti-forensics and other anomalies	DFT-1131	Search for indicators of trail obfuscation
Detect anti-forensics and other anomalies	DFT-1132	Search for indicators of artifact wiping
Establish identities	DFT-1084	Extract potentially user-identifying content from account information
Establish identities	DFT-1085	Conflate specific account identifiers to a single user identity
Create visualizations	DFT-1103	Virtualize suspect system for previewing
Create visualizations	DFT-1115	Visualize geolocation information
Conduct research	DFT-1090	Experiment with software to ascertain forensic artifacts
Conduct research	DFT-1095	Instrument a piece of running software
Conduct research	DFT-1089	Review source code of software
Conduct research	DFT-1101	Conduct cell site survey
Conduct research	DFT-1119	Automatically scan for artifact changes caused by app updates
Reconstruct events	DFT-1087	Reconstruct the location-based properties of an event
Reconstruct events	DFT-1088	Reconstruct relations between events or properties of events
Reconstruct events	DFT-1117	Reconstruct the time that an event may have occurred
Reconstruct events	DFT-1154	Reconstruct an identity associated with an event
Reconstruct events	DFT-1155	Reconstruct that a specific event may have occurred
Reconstruct events	DFT-1156	Reconstruct if an event could have functionally occurred on a system given its capabilities
Evaluate evidence	DFT-1195	Generate Alternative Hypotheses
Evaluate evidence	DFT-1200	Evaluate observations in light of hypotheses
Evaluate evidence	DFT-1202	Verify automated results manually
Document digital forensic activities	DFT-1091	Tag artifacts
Document digital forensic activities	DFT-1094	Disclose investigation material to an authorized legal authority
Document digital forensic activities	DFT-1092	Generate tag-based automated report
Document digital forensic activities	DFT-1093	Write expert report
Document digital forensic activities	DFT-1014	Document the chain of custody