ID	Name	Description	Synonyms
DFT-1001	Triage devices or media	Digital forensic triage is a partial forensic examination conducted under (significant) time and resource constraints [DFCite-1115].	[]
DFT-1002	Copy sectors from storage media	Copying of sectors from a storage media, typically LBA~0~ to LBA~max~ to a bitstream that can be stored in a image format (DFT-1025).	['disk imaging']
DFT-1003	Copy pages from physical memory	Involves creating a copy of the live memory data of a running system	['Memory imaging', 'RAM dump', 'RAM imaging', 'memory dump']
DFT-1004	Collect logical files selectively	Views a set of files (typically via direct access from previewing) and acquires a subset of them.	['Logical imaging', 'Logical acquisition']
DFT-1005	Search a crime scene for relevant physical evidence	The process of 'carefully documenting the conditions at a crime scene and identifying all relevant physical evidence.' (Birzer 2018).	['Crime scene investigation', 'Crime scene examination', 'Crime scene processing', 'Incident scene examination', 'Scene search']
DFT-1006	Search a crime scene using digital sniffer dogs	The use of canines to locate obscured digital storage devices.	['Digital Storage Device Dogs', 'Electronic Storage Detection (ESD) sniffing dog', 'Storage Detection Police Dogs', 'Digital detection dogs', 'Digi-dogs']
DFT-1007	Detect the potential existence of digital devices using a SyncTriage-based approach	A technique developed in Hargreaves & Marshall (2018) whereby synchronization artifacts on a device are examined and used to identify the existence of a related device. Also sometimes used to infer activity that occurred on an inaccessible or unavailable device. 	[]
DFT-1008	Detect the potential existence of digital devices by profiling network traffic		[]
DFT-1009	Locate potential digital evidence sources via cloud account identifiers		[]
DFT-1010	Place device in a faraday environment	Place a device in an environment designed to shield a mobile phone or small digital device from radio waves entering the environment and reaching the device, and to stop radio waves escaping from the environment (adapted from Lennox-Steele & Nisbet (2016))	[]
DFT-1011	Store seized devices or media in evidence bags		[]
DFT-1012	Write protect storage media using a hardware write blocker	A hardware write blocking device [should] prevent any change to data in the user area of a hard drive while allowing access to all data on a hard drive. (Lyle 2006)	[]
DFT-1013	Write protect storage media using a software write blocker	Use of a software-based tool that prevents a computer from writing to computer storage media connected to it (NIST 2006)	[]
DFT-1014	Document the chain of custody	A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer [DFCite-1147].	['CoC', 'Continuity of evidence']
DFT-1015	Collect logical files selectively based on privacy preserving criteria	Previewing a data source and selecting a subset of the data for collection into a container such as a tar/zip file or a forensic image format for the purposes of protecting the privacy of the complainant or witness.	[]
DFT-1016	Collect specific pieces of information from a live running device	Running commands on a live system to collect specific pieces of information e.g. running processes or open ports	['Live response data collection', 'Volatile data collection']
DFT-1017	Capture network packets		[]
DFT-1018	Collect data from a remote networked device		[]
DFT-1019	Extract a backup from a mobile device	Using the in-built backup capability of a device to extract a subset of its contents	[]
DFT-1020	Extract the file system from a mobile device	Accessing the file system(s) of the device and extracting a set of files (full or partial depending on level of access)	['file system extraction']
DFT-1021	Extract artifacts from a configuration file	Examination of a file that was designed for storing configuration information for a piece of software (e.g. an application or operating system feature)	['configuration file examination']
DFT-1022	Capture mobile device screenshots (manually)	An examiner directly manipulates the target mobile device using the device's input interface (i.e., keypads and buttons), and records the content shown on the display of the device. (Fukami et al 2021)	[]
DFT-1023	Collect data from cloud service via a live web page using credentials		[]
DFT-1024	Collect data from cloud service via submission of request to service provider		[]
DFT-1025	Store bitstream data in a forensic image format	Storage of bitstream data recovered from a digital device	['store disk image container', 'store image file', 'write data to a forensic image format', 'write data to a disk image container']
DFT-1026	Store data in standard archive format	Storing acquired data in a standard archive format such as rar, tar or zip	[]
DFT-1027	Read data from a device using JTAG		[]
DFT-1028	Physically remove a storage chip from a device (chip-off)		['chip-off']
DFT-1029	Read data from a desoldered eMMC via a chip reader		[]
DFT-1030	Read data from unmanaged NAND		[]
DFT-1031	Recover encryption/decryption key from memory	This describes the technique whereby an attempt is made to extract key material from memory, or a memory acquisition of a running system to fascinate the decryption of some data 	[]
DFT-1032	Recover encryption/decryption key information using side channel attacks		[]
DFT-1033	Extract credential(s) from an accessible device to attempt access to a more secure device or service	Accessing a device with limited or no security to obtain a credential (e.g. password, PIN, token) that can be used to access another device or service.	[]
DFT-1034	Attack a stored credential or device using a brute force approach	A brute force attack, or exhaustive search is a password cracking approach where every combination of characters is tested until the correct one is found. This method is "guaranteed to work" given infinite time and resources which in a real-life scenario is not feasible.	['brute force attack', 'exhaustive password search']
DFT-1035	Attack a stored credential or device using a dictionary-based approach	A dictionary attack is a password cracking technique where an attacker uses a list of passwords, called a dictionary, to attempt to guess a password.	['dictionary attack']
DFT-1036	Recover information about a potential device PIN or pattern lock using a smudge attack		[]
DFT-1037	Obtain password from the device's owner		[]
DFT-1038	Attack a stored credential or device using a rainbow table-based approach		['rainbow table attack']
DFT-1039	Downgrade apps to facilitate data extraction	Downgrading an app to a version in which data is available e.g. via a backup method	[]
DFT-1040	Exploit a mobile device to facilitate privileged access for data extraction	A process that typically exploits a security flaw in a specific device or operating system to enable users to perform higher privileged functions on a device (derived from Grover 2013)	['mobile device exploit', 'rooting', 'jailbreaking']
DFT-1041	Gain access to a device via a Pin2Pwn approach		[]
DFT-1042	Verify hash of copied data matches the hash of the data read from source device	Compares a hash of data read from a source device with a hash computed by reading back the copy of that data stored in a raw image or a forensic image container. 

The source hash may be computed as the data is read during imaging, or by reading the source device again at a later point. 

What distinguishes this technique is that the reference hash comes from reading the source device, rather than from a stored record of that hash. Comparison against a stored hash, whether inside the image file, in a separate file, or held externally, is covered by DFT-1204.	[]
DFT-1043	Read bitstream from forensic image container file(s)	The decoding of a forensic format such as EWF such that the raw sectors can be accessed by a forensic tool (typically performed on-the-fly internally in a tool.)	['Read forensic format', 'Read forensic image', 'Access forensic image', 'Access forensic image content', 'Decode forensic image bitstream']
DFT-1044	Decode data stored in a mobile backup format	Processing an extracted mobile device backup to access the files contained within.	[]
DFT-1045	Read contents from standard archive file(s)	Extract files from a common archive format e.g. TAR, RAR, ZIP	[]
DFT-1046	Redact digital forensic tool results to protect privileged material		[]
DFT-1047	Filter files using a hashset to reduce files examined	After hashing a set of files, compare the hashes against a known hashset to identify and remove known files from further examination.	['hash matching (reduce)']
DFT-1048	Protect privacy by only partially processing data from a source	Limiting the scope of file processing based on type, date or other criteria to protect privacy.	[]
DFT-1049	Keyword search	This technique involves searching data in the case for specific strings	['string search']
DFT-1050	Locate relevant files using a hashset to identify files of interest		['Hash matching (locate)']
DFT-1051	Locate potentially relevant files using fuzzy hash matching		[]
DFT-1052	Generate timeline	The extraction and normalisation of timestamps from a data source into a set of timeline entries	['timelining', 'timeline generation']
DFT-1053	Extract 'entities' from a data source	Extracting common types of entity in a data source e.g. email addresses, IP addresses, domain names, URLs, credit card numbers, etc.	['entity extraction']
DFT-1054	Review artifacts or content manually for relevant material	Manual examination of files or artifacts to determine their relevance to the investigation.	[]
DFT-1055	Examine file and folder structure	The process of examining the directory hierarchy, file and folder names (rather than file contents) to identify potentially relevant material.	['Directory structure review']
DFT-1056	Enumerate connections between artifacts	Finds references between artifacts, such as operating system artifacts that refer to a specific file	[]
DFT-1057	Search for indicators of steganography	Searching for the presence of current or historical steganography software on a system	[]
DFT-1058	Search for mismatched file extensions	Checking the content of a file against its file extension to identify mismatches.	[]
DFT-1059	Identify partitions	Partitions are defined as ‘allocated contiguous sets of sectors from storage media’. This involves recovering the list of partitions that exist on a storage media.	['media management analysis']
DFT-1060	Enumerate allocated files and folders	This involves parsing the allocated file system data structures and reconstructing the file system of the target media or device.	['file system parsing']
DFT-1061	Recover non-allocated files	The recovery of files from non-allocated space	['Deleted file recovery', 'Deleted data recovery']
DFT-1062	Decrypt encrypted file systems/volumes	The process of decrypting an encrypted file system/volume to make its contents accessible for analysis.	[]
DFT-1063	Identify file types	Applying a process that identifies the types of files.	[]
DFT-1064	Carve non-allocated files	The process of recovering files from non-allocated space using only the structural properties of files.	['file carving']
DFT-1065	Extract artifacts from operating system-level content indexer(s)	Examine information from operating system artifacts relating to content indexing and search capabilities e.g. Windows Desktop Search	['OS search database examination', 'operating system search database examination']
DFT-1066	Extract artifacts from operating system log files		['event log examination']
DFT-1067	Extract artifacts from operating system cloud synchronization features	Focuses on operating system level cloud syncronization features, such as iCloud Drive and OneDrive, which may be used to synchronize files between a local system and a cloud service.	[]
DFT-1068	Extract operating system artifacts indicating recently used files	The process of examining operating system files to extract artifacts that may indicate file accesses.	[]
DFT-1069	Extract artifacts from a web browser	Recovery of information left from web browsing activity (derived from Oh et al (2011))	[]
DFT-1070	Extract artifacts from email client(s) or webmail access		[]
DFT-1071	Extract data from SQLite database(s)	Examination of a SQLite database file(s) to extract information from within.	['database forensics']
DFT-1072	Extract artifacts from chat app(s)	Analysis of the files that provide the backing store for a chat or messenger application	['Messenger app analysis']
DFT-1073	Extract artifacts from calendar app(s)		[]
DFT-1074	Extract artifacts from social network app(s)		[]
DFT-1075	Extract artifacts from maps/travel app(s)		[]
DFT-1076	Extract artifacts from log files	Examination of a file that was designed for incremental logging from a piece of software (e.g. an application or operating system feature)	[]
DFT-1077	Extract artifacts from photo management app(s)		[]
DFT-1078	Extract artifacts from cloud synchronization app(s)	Involves examination of cloud synchronization artifacts from apps rather than those built into the operating system.	[]
DFT-1079	Examine audio content		[]
DFT-1080	Examine video content		[]
DFT-1081	Examine image/picture content		[]
DFT-1082	Examine document content		[]
DFT-1083	Extract artifacts from operating system memory structures	Examination of the operating system structures that allows individual processes to be listed and pages used by specific processes to be enumerated.	[]
DFT-1084	Extract potentially user-identifying content from account information	Analysis of user account information to extract content that may help identify the person associated with an account, such as usernames, real names, password hints, security questions, recovery email addresses, and profile details.	[]
DFT-1085	Conflate specific account identifiers to a single user identity		[]
DFT-1086	Analyze timeline	The process of searching, filtering, sorting, highlighting, or aggregating timeline entries to determine which are relevant for event reconstruction, or to identify times of interest (adapted from Breitinger et al. 2025)	['Timeline analysis', 'Temporal analysis']
DFT-1087	Reconstruct the location-based properties of an event	The process of assigning location properties to a reconstructed event	[]
DFT-1088	Reconstruct relations between events or properties of events	The process of determining the existence and nature of relationships between entities during event reconstruction	['Relational analysis', 'Connection-based event reconstruction', 'Relation-based event reconstruction']
DFT-1089	Review source code of software	Typically to  understand it's capabilities, the artifacts it produces, or what user actions could be potentially reconstructed	[]
DFT-1090	Experiment with software to ascertain forensic artifacts	The process of running software in a controlled environment to observe its behavior and identify potential forensic artifacts.	[]
DFT-1091	Tag artifacts	Make a record of selected files or pieces of data so they can be accessed easily, or used for generating automated reports.	['Bookmark artifacts', 'Bookmarking', 'Tagging']
DFT-1092	Generate tag-based automated report	Generate a report in PDF, HTML or other format that compiles tagged (or bookmarked) items from a case into a package that can be reviewed.	['Produce bookmark-based automated report']
DFT-1093	Write expert report		[]
DFT-1094	Disclose investigation material to an authorized legal authority		[]
DFT-1095	Instrument a piece of running software	This can be done during experiments to help ascertain functionality, or potential forensic artifacts	[]
DFT-1096	Extract operating system artifacts indicating program execution	The process of examining operating system files to extract artifacts that may indicate a program has been run.	['Programs run identification (OS)']
DFT-1097	Extract operating system artifacts indicating installed software	Extraction and analysis of information that allows programs installed on an OS to be identified.	['Installed software identification (OS)']
DFT-1098	Enumerate operating system user accounts	Examination of operating system artifacts to determine user accounts	['User account analysis (OS)']
DFT-1099	Repair a damaged or incomplete file using `grafting`	Repair file by grafting different reference data onto fragment(s)	[]
DFT-1100	Extract metadata from within images	The extraction of metadata from within images (pictures). e.g. EXIF, XMP. IPTC, iTXt etc.	['EXIF extraction']
DFT-1101	Conduct cell site survey	Taking measurements to assess which cells actually provide service at a specific location (adapted from Tart et al 2012).	[]
DFT-1102	Decode data extracted from unmanaged NAND		[]
DFT-1103	Virtualize suspect system for previewing	A suspect disk image can be configured to boot as a virtual machine, which allows screenshots to be taken showing how the user's desktop looked for example.	[]
DFT-1104	Collect data using open source intelligence		[]
DFT-1105	Examine memory dump from an application	Examination of the specific structures from the memory of a specific application	[]
DFT-1106	Classify if a video is potentially synthetically generated		[]
DFT-1107	Extract artifacts from health/fitness app(s)		[]
DFT-1108	Extract artifacts from reminders app(s)		[]
DFT-1109	Extract artifacts from payment app(s)		[]
DFT-1110	Preserve reference data		[]
DFT-1111	Record system clock offset	Recording a system clock compared with trusted time source	[]
DFT-1112	Locate and remove physical disks from a device	Locate physical storage media within devices and removing them	[]
DFT-1113	Access internal storage via bootable environment	Booting the suspected computer device into an alternative operating system in order to image the attached disks.	[]
DFT-1114	Preserve memory contents via Cold Boot Attack	A precursor to extracting volatile memory (RAM) from a powered-off system by quickly rebooting or transferring the memory module to another system before residual data fades. Cooling the memory modules can significantly slow down data decay, preserving critical data such as encryption keys or passwords.	['Cold Boot Attack', 'Extracting RAM data using Cold Boot Attack']
DFT-1115	Visualize geolocation information	Presenting points or paths visually using extracted data, typically on a map	[]
DFT-1116	Extract references to connected devices	Examine artifacts and extract indicators of devices that have been connected to the target device.	[]
DFT-1117	Reconstruct the time that an event may have occurred	The process of assigning a time component to a reconstructed event	['Temporal-based event reconstruction']
DFT-1118	Locate relevant files by path	Use the path of file name to determine potential relevance of the file.	['Filename matching']
DFT-1119	Automatically scan for artifact changes caused by app updates	Monitor every version change of an application to determine if there are changes to the way the app stores data	['App update monitoring']
DFT-1120	Extract artifacts from app data automatically	The use of automation to extract pieces of data that are potentially useful for a digital forensic investigation from app data.	['Automated trace extraction']
DFT-1121	Index a data source for keyword searching	Extracting strings from a data source and adding them to an index for subsequent searching.	['keyword indexing']
DFT-1122	Keyword search (case-type wordlists)	Searching for case-type specific keywords	[]
DFT-1123	Keyword search (case-specific wordlists)	Searching for case-specific keywords, e.g. people's names, places etc.	[]
DFT-1124	Keyword search (indexed)	Searching for keywords within a generated index of data in a case	['indexed search']
DFT-1125	Keyword search (live)	Searching for keywords over the raw data in a case without using an index of text content	['live search']
DFT-1126	Keyword search (live) (physical)	Searching for keywords over the raw data on a sector by sector basis	['live search']
DFT-1127	Keyword search (live) (logical)	Searching for keywords over the raw data, without an index of text content, but on a file by file basis	['live search']
DFT-1128	Search for indicators of malware	Searching for the presence of current or historical malware on a system	['virus scan', 'malware scan']
DFT-1129	Search for indicators of clock tampering	Searching for indicators that the system clock has been tampered with	[]
DFT-1130	Search for indicators of encrypted data	Searching for the presence of current or historical encrypted data on a system	[]
DFT-1131	Search for indicators of trail obfuscation	Searching for the presence of current or historical trail obfuscation on a system	[]
DFT-1132	Search for indicators of artifact wiping	Searching for the presence of current or historical artifact wiping	['artifact scrubbing']
DFT-1133	Extract artifacts from AI companion app(s)	The forensic examination of the artifacts describing the configuration or the interaction with an AI companion app or service.	[]
DFT-1134	Use time anchors to estimate clock offset	Correlate timestamps from the system clock and an external trusted time source (Time Anchoring)	['Timestamp correlation', 'Time anchoring (Vanini et al 2024)']
DFT-1137	Extract browser history artifacts	The examination of the history component of a web browser.	['web history examination', 'internet history examination']
DFT-1138	Extract browser cache artifacts	The examination of the content saved locally by browsers to improve performance	['web cache examination', 'internet cache examination']
DFT-1139	Extract browser session artifacts	The examination of sessions and open tabs and their individual histories	[]
DFT-1140	Extract browser autofill artifacts	The examination of data that is stored to autocomplete entries in forms	[]
DFT-1141	Extract browser bookmark artifacts	The examination of the links saved within a browser to facilitate quick access	[]
DFT-1142	Extract browser download artifacts	The examination of records of files downloaded with a browser	[]
DFT-1143	Extract browser configuration artifacts	The examination of a browsers configuration	[]
DFT-1144	Enumerate browser profiles	The enumeration of the separate user profiles set up within a browser	[]
DFT-1145	Extract browser extensions artifacts	The examination of the extensions installed within a browser	[]
DFT-1146	Extract browser synchronization artifacts	The examination of the settings and artifacts resulting from a browser synchronization feature	[]
DFT-1147	Extract browser cookie artifacts	The examination of stored browser cookies	[]
DFT-1148	Extract browser web storage artifacts	The examination of 	['browser storage examination', 'web storage examination', 'HTML5 storage examination', 'local storage examination']
DFT-1149	Extract artifacts from the file versioning feature	Extraction of data from the versioning system used by an operating system to store older versions of files.	['shadow copy examination', 'previous versions', "macOS 'Versions' examination", "'Revert to...' feature examination"]
DFT-1150	Recover non-allocated files using residual file metadata	Use metadata that remains in the file system to recover non-allocated files	[]
DFT-1151	Keyword search (over extracted artifacts)	Keyword searching only applied over extracted artifacts	['search artifacts only']
DFT-1153	Apply offset to a timestamp	Application of a time offset to a timestamp	[]
DFT-1154	Reconstruct an identity associated with an event	The process of attempting to link an identity (account, person etc.) to a reconstructed event	['Identity-based event reconstruction', 'Resolving the person-device gap', 'Resolving the person-account gap,']
DFT-1155	Reconstruct that a specific event may have occurred	The process of reconstructing that an operation occurred on a digital system	['Operation-based event reconstruction', 'Activity-based event reconstruction', 'Action-based event reconstruction']
DFT-1156	Reconstruct if an event could have functionally occurred on a system given its capabilities	Reconstructing the configuration or capabilities of a system at the time of an event	['Functional-based event reconstruction']
DFT-1157	Extract device data using exposed service	Use an exposed service on a device to extract data. This represents several of the mobile data extraction methods e.g. Query content providers (android), AFC (iOS).	[]
DFT-1158	Configure device to enable a service needed for data extraction	Change a setting on a device such that a service needed for data extraction is enabled. This may require a user PIN that can be obtained using other techniques.	[]
DFT-1159	Extract mobile data via deployed agent	Deploy software to a mobile device that can carry out some function, either collect data with available permissions or attempt further exploitation e.g. sandbox escape.	[]
DFT-1160	Collect data with 'cloud backup restore' approach	Restore a device's cloud backup to a donor device, then subsequently use a local acquisition approach on that donor device, e.g. T1019/T1020	[]
DFT-1161	Collect data from cloud service via API using credentials	Copying data from a cloud service using the officially supported API of the provider.	['Cloud Data Collection via RESTful API', 'API-based cloud acquisition']
DFT-1162	Read data from a device via In-System Programming (ISP)		['ISCP', 'In-circuit serial Programming']
DFT-1163	Capture mobile device screenshots (automatically)	Programmatically controlling a mobile device while capturing screenshots of the display.	[]
DFT-1164	Read data directly from a block device	Rather than imaging a block device, this involves accessing it directly without the expectation of saving block data to a forensic image format.	[]
DFT-1165	Extract software configuration information	Examination of one or more files to extract configuration information for a piece of software.	[]
DFT-1166	Connect directly to storage media	This technique describes the occasions where it is necessary to connect directly to a disk without a hardware write blocker. This would typically then involve a subseqeunt software write blocker, which then presents a write protected interface.	[]
DFT-1167	Extract search terms from URLs	Parsing a URL and extracting search terms from the parameters.	[]
DFT-1168	Identify volumes	From a partition or data from a full disk, identify volumes.	[]
DFT-1169	Filter files related to an application	This technique takes a set of files and determines which are related to a specified application.	[]
DFT-1170	Read contents from logical forensic container file(s)	Decodes logical image formats such as L01, AD1, CTR, or AFF4-L. The output here is not an image file but rather a set of files and their metadata.	['Logical image decoding', 'Read logical image']
DFT-1171	Access a file system via live operating system	This involves accessing a live system and relying on the operating system's parsing of the file system to access files.	['Access file system via the running operating system']
DFT-1172	Read bitstream from raw image file(s)	This technique reads data from a raw image e.g. a dd image.	['read dd file']
DFT-1173	Extract data from captured screenshots	Processing a screenshot captured from a device to extract data for further processing.	[]
DFT-1174	Read evidential files stored directly on local file system	Represents reading files that have been acquired or extracted directly to the local file system.	[]
DFT-1175	Extract data from an Android device using content queries	Use of content queries on Android devices via adb to extract specific pieces of data exposed by content providers.	[]
DFT-1176	Classify if an image is potentially synthetically generated	Classification of images with respect to their origin, i.e., whether they are synthetically generated or naturally captured by a camera.	['Deepfake Detection, Synthetic Image Detection, Image Source Attribution, Image Authentication, Image Source Classification']
DFT-1177	Extract artifacts from multiplayer game app(s)	Extracting artifacts from multiplayer gaming apps.	['gaming app examination']
DFT-1178	Store bitstream data in a raw image format	Storage of bitstream data recovered from a digital device as raw files.	['store dd image', 'write dd image']
DFT-1179	Extract artifacts from drone/UAV app(s)	The examination of a mobile app used to control Unmanned Areial Vehicles (UAVs) or 'drones'.	['UAV app examination']
DFT-1180	Extract file(s) from a pre-deletion container	An examination of the operating system structures that represent the 'pre-deletion' container (i.e. Recycle Bin/Trash) to extract those files and potentially additional metadata such as original path or date it was moved.	['Recycle Bin examination', 'Trash examination']
DFT-1181	Extract artifacts from smart home app(s)	Examine the data stored by an app designed to control, monitor or program smart home capabilities.	[]
DFT-1182	Filter a timeline for relevant entries	Provide some criteria that selects only a subset of timeline entries from a set. 	[]
DFT-1184	Sort a timeline so entries are ordered chronologically	Order a timeline based on the values in the timestamp entry.	[]
DFT-1185	Extract data from operating system notifications	Recovery of the notifications produced by applications that are stored by the operating system. 	['Notification analysis', 'WPN analysis']
DFT-1186	Compute per-file hash values	The process of computing one or more hash digests for each file in a set, producing per-file digests that can subsequently be used for matching, deduplication, or integrity comparison.	['File hashing', 'Per-file hashing']
DFT-1187	Extract content from compound files	The process of extracting files and objects contained within compound files, including archives, Office documents, PDFs, and email containers, surfacing the contained items as first-class files for further analysis.	['Container file expansion', 'Compound file expansion', 'Embedded file extraction']
DFT-1190	Extract operating system version(s) from data source	The process of extracting and processing the artifacts that describe the current operating system version and associated version details e.g. build, service pack etc.	[]
DFT-1191	Parse allocated structures in Windows HIVE files	Enumerate the allocated structures within HIVE files (typically Windows Registry) to extract the tree structure along with keys and their values. 	['Registry analysis']
DFT-1192	Disable connectivity using device configuration settings	This involves changing settings on a device to attempt to remove any connectivity options so that data cannot be sent or received over typical RF channels. This may involve multiple settings e.g. airplane mode and separate Bluetooth and WiFi toggles.	[]
DFT-1193	Read metadata from within a forensic image container	The processes of reading the metadata values stored within forensic container formats	[]
DFT-1194	Classify if audio is potentially synthetically generated	Classification of audio with respect to its origin, i.e., whether it is synthetically generated (e.g. text-to-speech synthesis or voice conversion) or naturally captured from a live speaker.	['Audio deepfake detection', 'Synthetic speech detection', 'Voice clone detection', 'Audio anti-spoofing', 'Speech spoofing countermeasure']
DFT-1195	Generate Alternative Hypotheses	The process of considering what are the alternative possibilities (other than the proposed hypothesis) for the digital forensic artifacts/traces that we are observing	['Claim', 'Proposition']
DFT-1196	Extract operating system installation date	Extract the date and time recorded as the installation date of the operating system.	[]
DFT-1197	Determine mount point mappings within an operating system	This involves establishing what mount points (including drive letters) within an operating system are mapped to, either a partition or device. 	['drive letter mapping']
DFT-1198	Compute hash of data read from source device	Process data accessed on a source device (e.g. attached disk or other media) and compute the cryptographic hash of the data	[]
DFT-1199	Compute hash of stored bitstream data	Cryptographically hashing either data exposed directly from a raw image or a decompressed physical image from a container format.	[]
DFT-1200	Evaluate observations in light of hypotheses	The process of assessing the probability or strength of the observations under each of two or more competing hypotheses, and expressing the strength of support for one over another.	['Evaluative interpretation', 'Evidence evaluation', 'Likelihood ratio assessment', 'Scientific interpretation']
DFT-1202	Verify automated results manually	The process of manually reviewing the results from an automated process and checking the results are correct.	['manual verification']
DFT-1203	Use an AI-based prompt for interrogating case data	Using an AI-based chat interface to query the data within a case.	[]
DFT-1204	Verify hash of stored bitstream data matches a stored hash	Compares a hash computed over stored bitstream data against a recorded hash, to assess whether the stored data has changed since it was written.	[]
DFT-1205	Decode raw data into data value(s)	The process of interpreting a sequence of bytes as a typed value, such as a number, a string, or a date, under an assumed encoding.	[]
DFT-1206	Decode a number from raw data	The process of interpreting a sequence of bytes as a numeric value under an assumed width, signedness, and byte order.	[]
DFT-1208	Store acquisition metadata along with a forensic image format	Records details such as case and examiner details, and the acquisition hash, with a forensic image container alongside the bitstream data or logical files. 	[]