ID	Name
DFW-1001	Excluding a device during triage that contains relevant information
DFW-1002	Use of triage technology results in changes to the target media
DFW-1003	Triage tool applies a simplification that does not correctly represent the meaning of the digital data
DFW-1004	Data copied does not include all sectors from LBA0 to LBA max due to the data copying process stopping prematurely
DFW-1005	Dogs fail to find a digital device
DFW-1006	Acquisition tool does not copy data from HPA
DFW-1007	Acquisition tool does not copy data from DCO
DFW-1008	Missing the existence of a device by missing synchronisation artefacts
DFW-1009	Missing the existence of a device by incorrectly parsing synchronisation artefacts
DFW-1010	Misattributing activity to the wrong device
DFW-1011	Suggesting the existence of a device that does not exist
DFW-1012	Interaction with the target devices to read data causes changes
DFW-1013	During acquisition the data copying process results in extra bytes
DFW-1014	Accessing the drive to copy data changes original data
DFW-1015	Powering on SSD results in sectors being wiped by TRIM operation
DFW-1016	Data copied from sectors on source device are not transferred correctly for storage
DFW-1017	Files or data that is relevant to the investigation is missed
DFW-1018	Data is collected that is not relevant to the investigation
DFW-1019	Data is collected and assigned to incorrect device
DFW-1020	Content of data collected is incorrect
DFW-1021	Metadata of data collected is missing
DFW-1022	Metadata of data collected is incorrect
DFW-1023	Collection process changes content of data on target
DFW-1024	Collection process changes metadata of data on target
DFW-1025	Data relevant to the case is excluded as part of the filtering process
DFW-1026	Selective extraction of a backup implies partial collection when it is in reality a full collection followed by deletion.
DFW-1027	Including data that was meant to be excluded with the selected filters
DFW-1028	Due to the use of time based filters data extracted may be presented out of context
DFW-1029	Memory smearing may result in pointers being inconsistent within the memory image
DFW-1030	Loading a memory imaging tool makes changes to the data in memory that is being acquired
DFW-1031	Loading a memory imaging tool overwrites relevant data within memory
DFW-1032	Not all memory is acquired
DFW-1033	Data referenced in memory is located within pagefile or swapfile but is not collected
DFW-1034	Missing data from the running system due to the device being compromised (e.g. rootkit)
DFW-1035	Collecting incorrect data from a running system due to the device being compromised (e.g. rootkit)
DFW-1036	Overwriting relevant data with changes caused by running the live tools
DFW-1037	Presenting data from a mobile backup as complete, when it is in reality a partial set of files from the device
DFW-1038	Backup process returns an incomplete set of backup data
DFW-1039	Backup data collection overwrites important data
DFW-1040	Not considering SD Card acquisition in addition to other extractions performed
DFW-1041	Not considering file system acquisition as alternative
DFW-1042	Disk image was tampered with, but manipulated to have a collision with original hash
DFW-1043	Data is written to forensic format that does not preserve the original raw data
DFW-1044	Failing to extract a decryption key that is present
DFW-1045	Extracting an incorrect decryption key
DFW-1046	File not recovered from the stored backup
DFW-1047	File recovered from backup that did not exist
DFW-1048	File recovered from backup but presented in the wrong location
DFW-1049	File content recovered incorrectly from backup
DFW-1050	Failure to highlight that there are other apps present for which data is not available
DFW-1051	Failure to highlight that not all app data may be present in a backup
DFW-1052	Incorrect retrieval of results from an index
DFW-1053	Incorrect parsing of a supplied regular expression used for keyword searching
DFW-1054	Data not indexed for keyword searching due to text encoding
DFW-1055	Data not indexed for keyword searching due to missing substring feature
DFW-1056	Data not indexed for keyword searching due to case sensitivity problem
DFW-1057	Relevant keyword results not captured by the case-type keyword list used
DFW-1058	Results appear in an ‘artefact’ or ‘result’ but the context, source or provenance of result is unclear
DFW-1059	Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical
DFW-1060	A relevant piece of media was not flagged as relevant
DFW-1061	An irrelevant piece of media was flagged as relevant
DFW-1062	The grade or specific tag given to item is incorrect
DFW-1063	Incorrectly parsing the partitions table(s)
DFW-1064	Making incorrect assumptions about sector size e.g. 512 rather than 4096
DFW-1065	Failing to correctly parse start sector pointers from partition tables
DFW-1066	Missing deleted but recoverable partitions from unpartitioned space
DFW-1067	Failure to check the integrity of partition table (where possible e.g. GPT)
DFW-1068	Failing to identify the existence of an allocated file
DFW-1069	Failing to identify the existence of an allocated directory
DFW-1070	Failing to recover the complete contents of an allocated file
DFW-1071	Failing to recover a complete listing of an allocated directory
DFW-1072	Recovering incorrect contents of an allocated file
DFW-1073	Recovering an incorrect listing of an allocated directory
DFW-1074	Attributing a file to the wrong directory
DFW-1075	Presenting a file that does not exist
DFW-1076	Presenting a directory that does not exist
DFW-1077	Presenting a non-allocated file as an allocated file
DFW-1078	Presenting an allocated file as non-allocated
DFW-1079	Recovering incorrect metadata about a file
DFW-1080	Recovering incorrect metadata about a directory
DFW-1081	Failing to recover file system metadata
DFW-1082	Recovering file system metadata incorrectly
DFW-1083	Failure to recover additional specialised file system specific content e.g. Alternate Data Streams
DFW-1084	Failure to correctly recover specialised file system specific content e.g. Alternate Data Streams
DFW-1085	Missing messages from the live set of messages
DFW-1086	Failing to recover deleted but recoverable messages
DFW-1087	Presenting a live message that did not exist
DFW-1088	Presenting a deleted message that did not exist
DFW-1089	Recovering a live message with incorrect content
DFW-1090	Recovering a live message with incorrect metadata
DFW-1091	Recovering a deleted message with incorrect content
DFW-1092	Recovering a deleted message with incorrect metadata
DFW-1093	Presenting a deleted message as live
DFW-1094	Attributing a message to the incorrect sender
DFW-1095	Attributing a message to the incorrect thread
DFW-1096	Failing to recover attachments for a live message
DFW-1097	Failing to recover attachment for a deleted message
DFW-1098	Assigning incorrect metadata to a message attachment
DFW-1099	Assigning an attachment to an incorrect messages
DFW-1100	Tool fails to display special effects or highlight within a message
DFW-1101	Failure to recover message edits if available
DFW-1102	Failure to display that a message had a previous state
DFW-1103	Failure to carve salvageable content
DFW-1104	Incorrect carving of a complete file
DFW-1105	Incorrect reassembly of a file
DFW-1106	Incorrect attribution of salvaged content to a current file system rather than a previous one
DFW-1107	Failure to repair a content fragment
DFW-1108	Failure to recover history resulting from private browsing
DFW-1109	Incorrect recovery of information regarding a web visit from allocated data
DFW-1110	Failure to recover browser history from live data
DFW-1111	Incorrect recovery of information regarding a web visit from non-allocated data
DFW-1112	Failure to recover browser history from non-allocated data
DFW-1113	Misinterpretation a URL located on disk/memory as a web visit
DFW-1114	Failure to locate a relevant device at a physical crime scene
DFW-1115	Device is remote wiped because faraday environment was insufficient.
DFW-1116	Last wifi connection is overwritten because faraday environment was insufficient.
DFW-1117	Calls, messages or other data was received and overwrote relevant data because faraday environment was insufficient.
DFW-1118	Hardware write blocker fails to prevent modifications to the attached device.
DFW-1119	Hardware write blocker hides the existence of an HPA.
DFW-1120	Hardware write blocker hides the existence of an DCO.
DFW-1121	Image format parsing fails to to present all blocks from within a forensic container image in their ‘flat’ (dd) representation
DFW-1122	Image format parsing presents incorrect data within sectors of the image
DFW-1123	Image format parsing presents incorrect forensic image metadata
DFW-1124	Failure to compute hash of source device correctly during disk image verification
DFW-1125	Failure to validate hash properly during disk image verification
DFW-1126	Failure to validate hash properly allowing an incomplete disk image to present as validated
DFW-1127	Failure to validate disk image metadata
DFW-1128	Disk image has been replaced with tampered version along with updated stored hash
DFW-1129	File type is incorrectly identified
DFW-1130	Missing assignment of a file type: reporting a file as unknown when it has a known type within the digital forensic science body of knowledge 
DFW-1131	Missing recognition of multiple file types: reporting a file as a limited set of types, or a single type, when it can be interpreted as having more than one, such as a GIF and Java Jar
DFW-1132	Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation
DFW-1133	Tool fails to express uncertainty in the classification of file recovery results, e.g., where content may be partly overwritten.
DFW-1134	Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected 
DFW-1135	Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected 
DFW-1136	Data cannot be read from a device due to the device having failed physically
DFW-1137	Failing to determine password as it is not in the dictionary used
DFW-1138	Failing to identify password in the time available
DFW-1139	System locks after X failed dictionary attempts
DFW-1140	Failing to determine password as it is not in the search space
DFW-1141	Failing to determine password via brute force in the time available
DFW-1142	System locks after X failed brute force attempts
DFW-1143	Data is not read from remapped sectors e.g. G-Lists during the acquisition process
DFW-1144	Failure to identify timestamps in a data source
DFW-1145	Failure to extract timestamps from a data source
DFW-1146	Failure to consider non-timestamp based timing information
DFW-1147	Failure to normalise timestamps correctly during timeline generation
DFW-1148	Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock
DFW-1149	Failure to consider timestamp inaccuracy at time of inferred event
DFW-1150	Misinterpreting events from automated processes as user generated ones
DFW-1151	Incorrectly decoding a timestamp from a data source
DFW-1152	Generated report does not include all bookmarks
DFW-1153	Report generated from bookmarks does not render all content (e.g. previews, string extracts) correctly
DFW-1154	Report generated from bookmarks stored in manner that does not prevent tampering or corruption
DFW-1155	Bookmark added by examiner is not recorded
DFW-1156	Bookmark added by examiner is is recorded with incorrect tag/label/category
DFW-1157	Use of mobile exploit changes/overwrites data that was relevant to the investigation
DFW-1158	Use of mobile exploit renders device unusable or 'bricked'
DFW-1159	Presenting a mobile file system acquisition as a bitwise copy of the device
DFW-1160	Failure to copy relevant files from the mobile device
DFW-1161	Lack of privileges for file system acquisition
DFW-1162	Changing relevant files during file system acquisition
DFW-1163	Changing relevant file metadata during file system acquisition
DFW-1164	Files are still encrypted using file-based encryption so inaccessible
DFW-1165	Failure to preserve original timestamps from the data source in an archive
DFW-1166	Consideration of live database content only
DFW-1167	Combining data from multiple tables that should not be joined
DFW-1168	Data extracted from a table is assigned an incorrect interpretation
DFW-1169	Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value
DFW-1170	Failure to recover data stored in Write Ahead Log (WAL) files
DFW-1171	Failure to recover data stored in database journal files
DFW-1172	Relevant reference data missed as its necessity was not known at time of preservation
DFW-1173	The recorded time offset is incorrect because the trusted time source used for reference was incorrect
DFW-1174	Failure to find internal attached storage media
DFW-1175	Failure to find internal unattached storage media
DFW-1176	Unable to physically remove/detach internal storage media
DFW-1177	Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence
DFW-1178	Inability to load the forensic bootable environment due to system configuration
DFW-1179	Failure to detect internal disk from bootable environment
DFW-1180	Failing to decrypt internal disk using the bootable environment
DFW-1182	Bootable environment overwrites relevant data on the target device
DFW-1183	Failure to identify the existence of a connected device
DFW-1184	Presenting devices 'seen' as devices connected
DFW-1185	Failure to enumerate all files in a standard archive format
DFW-1186	Missing files with file name/path-based pattern matching due to renaming
DFW-1187	Failure to match file name/path pattern due to mismatch of search term used and pattern match engine.
DFW-1188	Failure to match file name/path pattern due to implementation error in matching engine.
DFW-1189	Artifact extraction is incomplete due to app version changes.
DFW-1190	Interpretation of app data is incorrect due to app version changes.
DFW-1191	Missing changes in app artifacts during research since app interaction is needed to cause changes
DFW-1192	Relevant results not captured by the case-specific keywords used
DFW-1193	Keyword results missed since relevant keyword is split over a sector or cluster boundary
DFW-1194	Keyword results missed since relevant keyword is inside compressed or encoded data
DFW-1195	Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file
DFW-1196	One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image
DFW-1197	Data not indexed for keyword searching due to compression
DFW-1198	Data not indexed for keyword searching due to file or content encoding
DFW-1199	Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical
DFW-1200	Failure to conduct iterative keyword searching due to excessive time taken per search
DFW-1201	Failure to recover live messages to or from the AI companion app
DFW-1202	Failure to recover deleted but recoverable messages to or from the AI companion app
DFW-1203	Presenting a message from the user or AI companion app that did not exist
DFW-1204	Presenting a deleted message to the AI companion app as a live one, or vice versa
DFW-1205	Presenting a message to the AI chat app as from the AI companion app, or vice versa
DFW-1206	Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app
DFW-1207	Failure to display a message to or from the AI companion app in the context of other messages
DFW-1208	Failure to recover live images sent to or from the AI companion app
DFW-1209	Failure to recover deleted but recoverable images sent to or from the AI companion app
DFW-1210	Presenting an image sent from the user or AI companion app that did not exist
DFW-1211	Presenting a deleted image sent to the AI companion app as a live one, or vice versa
DFW-1212	Presenting an image sent to the AI chat app as from the AI companion app, or vice versa
DFW-1213	Failure to display an image to or from the AI companion app in the context of other messages
DFW-1214	Failure to recover live records of calls to or from the AI companion app
DFW-1215	Failure to recover deleted but recoverable records of calls to or from the AI companion app
DFW-1216	Presenting a call to or from the AI companion app that did not exist
DFW-1217	Presenting a deleted call to the AI companion app as a live one, or vice versa
DFW-1218	Presenting a call to the AI companion app as from the AI companion app, or vice versa
DFW-1219	Failure to recover metadata associated with an interaction with the AI companion app
DFW-1220	Presenting an incorrect timestamp associated with an interaction with the AI companion app
DFW-1221	Failure to recover account details from the AI app data
DFW-1222	Presenting account details that did not exist
DFW-1223	Live access to the device (for extraction) updates last access times for an account
DFW-1224	Presenting a deleted account as live, or vice versa
DFW-1225	Failure to recover relevant app settings
DFW-1226	Failure to recover relevant AI bot settings
DFW-1227	Associating a configured bot with the wrong account
DFW-1228	Log entry missing due to incorrect parsing of logfile
DFW-1229	Log entry missing due to being stored in archived copies of logs
DFW-1230	Log entry missing due to rotation size or timing
DFW-1231	Interpreting log entry absence as evidence of deletion rather than logging configuration
DFW-1232	Failure to extract log entry timestamp
DFW-1233	Failure to communicate imprecision in log entry timestamp
DFW-1234	Event time presented incorrectly due to incorrect timezone handling
DFW-1235	Failure to extract log entry type
DFW-1236	Incorrectly interpreting a log entry type based on a different version of the generating software or operating system
DFW-1243	Missing browser history data as it was conducted outside of configured retention period
DFW-1244	Missing browser history data as it was cleared by user
DFW-1245	Relying on times stored in browser history that are not representative of exact web page visit time
DFW-1246	Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database
DFW-1247	Attributing saved browser bookmarks to a user but they were bundled with the browser installation
DFW-1248	Missing browser downloads as the files were saved to a non-standard location
DFW-1249	Missing a web browser profile as it was stored outside of the usual browser profile folders
DFW-1250	Incomplete browser activity extraction due to not considering the browser cache artifacts
DFW-1251	Incomplete browser activity extraction due to failure to consider multiple profiles
DFW-1252	Assuming that data stored in the cache was viewed by the user
DFW-1253	Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information
DFW-1254	Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information
DFW-1255	Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL)
DFW-1256	Incorrect attribution of metadata to file content that was the result of 'file tunnelling'
DFW-1257	Missing content that is relevant to a keyword search but it has not been extracted as 'artifacts'
DFW-1258	Failure to present uncertainty associated with automated interpretation of data into artifacts
DFW-1259	Image format parsing fails to identify or assemble split forensic images
DFW-1260	Failure to derive clock offset due to inability to locate a suitable time anchor
DFW-1261	Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring
DFW-1262	Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time
DFW-1263	Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring
DFW-1264	Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp
DFW-1265	Offset applied to timestamp is incorrect due to variations in time zone over the history of data source
DFW-1266	Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings
DFW-1267	Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source
DFW-1268	Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used
DFW-1269	Failure to apply time offset to a timeline entry
DFW-1270	Inability to create a device backup due to locked device
DFW-1271	Inability to access required service as it is not enabled
DFW-1272	Failure to preserve all relevant timestamps of files obtained using exposed services on a device
DFW-1273	Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device
DFW-1274	Inability to enable required service due to locked device
DFW-1275	Failure to store data due to size limitations of archive format used
DFW-1276	Relevant data is overwritten by deploying an agent to a mobile device
DFW-1277	Connection over a direct media interface causes changes to the target media
DFW-1278	Data copied does not include all sectors from LBA0 to LBA max due to the data copying process skipping some sectors or bytes
DFW-1279	Failure to recover live message from a multiplayer gaming app
DFW-1280	Presenting a live contact from a gaming app as a deleted one or vice versa
DFW-1281	Failure to recover the gaming app configuration
DFW-1282	Recovering the gaming app configuration incorrectly
DFW-1283	Failure to recover a live account used in a gaming application
DFW-1284	Failure to recover a previous but removed account used in a gaming application
DFW-1285	Recovering an account used for a gaming application that was not actually used
DFW-1286	Describing a live gaming app account as deleted/removed or vice versa
DFW-1287	Failure to recover deleted message from a multiplayer gaming app
DFW-1288	Presenting a live message from a gaming app that does not exist
DFW-1289	Presenting a deleted message from a gaming app that does not exist
DFW-1290	Presenting a live message from a gaming app as deleted or vice versa
DFW-1291	Failure to recover a live contact from a gaming app
DFW-1292	Failure to recover a deleted contact from a gaming app
DFW-1293	Presenting a live contact from a gaming app that does not exist
DFW-1294	Presenting a deleted contact from a gaming app that does not exist
DFW-1295	The filtered timeline misses relevant entries because filtering criteria was too strict
DFW-1296	The filtered timeline misses relevant entries because the tool did not filter correctly
DFW-1297	The filtered timeline includes entries that are not relevant because the filtering criteria was too broad
DFW-1298	The filtered timeline includes entries that are not relevant because the tool did not filter correctly
DFW-1299	A filtered timeline is presented as a full timeline
DFW-1300	Missing deleted but recoverable volumes from unpartitioned space
DFW-1308	Sorted timeline is missing timeline entries due to tool error during sort process
DFW-1309	Sorted timeline is missing timeline entries because timeline contained entries not based on timestamps
DFW-1310	Sorted timeline has additional timeline entries due to tool error during sort process
DFW-1311	Timeline entry is in an incorrect sequence due to resolution of the timestamp used
DFW-1312	Timeline entry is in an incorrect sequence due to underlying timestamp being based on an incorrect clock
DFW-1313	Timeline entry is in an incorrect sequence due to timezone already applied to timestamp
DFW-1314	Timeline entry is in an incorrect sequence due to a time offset being applied that is incorrect for the timeline entry
DFW-1315	Failure to recover a notification due to not attempting to parse the relevant data
DFW-1316	Failure to recover a notification due to a tool error parsing the relevant data
DFW-1317	Failure to recover a notification due to it being deleted because of the expiry time set
DFW-1318	Failure to recover a notification due to it being deleted because of it being viewed and cleared
DFW-1319	Associating a notification with an incorrect application due to tool error
DFW-1320	Failure to extract the creation time of a notification due to tool error
DFW-1321	Presenting the incorrect time for a notification due to tool error
DFW-1324	Failure to extract the operating system version due to a tool accessing the wrong artifact
DFW-1325	Failure to extract the operating system version because a tool parses the relevant artefact incorrectly
DFW-1326	Extracting an incorrect operating system version because a tool uses an incorrect or outdated artifact
DFW-1327	Extracting an incorrect operating system version because a tool parses the relevant artefact incorrectly
DFW-1328	Extracting a previous operating system version as if it were the current because a tool uses an incorrect or outdated artifact
DFW-1329	Failure to highlight previous versions of the operating system that were used on the device
DFW-1330	Failure to recover an allocated Registry key because of a parsing error in the tool used
DFW-1331	Failure to recover last modified time associated with an allocated Registry key because of a parsing error in the tool used
DFW-1332	Presenting an allocated Registry key that does not exist because of a parsing error in the tool used
DFW-1333	Mapping an allocated Registry key to an incorrect point in the Registry tree structure because of a parsing error in the tool used
DFW-1334	Failure to recover allocated values associated with a Registry key because of a parsing error in the tool used
DFW-1335	Presenting an allocated Registry value that does not exist because of a parsing error in the tool used
DFW-1336	Associating an allocated Registry value with an incorrect key because of a parsing error in the tool used
DFW-1337	Presenting an allocated Registry key's modification time as the modification time for a specific value.
DFW-1338	Failing to acquire data due to omission of undocumented endpoints
DFW-1339	Failing to acquire data because of filtering
DFW-1340	Data on a mobile device is overwritten because not all relevant connectivity settings were configured correctly
DFW-1341	Data on a mobile device is overwritten because the connectivity settings were subsequently reset by an automated process
DFW-1342	Data is added to a mobile device because not all relevant connectivity settings were configured correctly
DFW-1343	Data is added to a mobile device because the connectivity settings were subsequently reset by an automated process
DFW-1344	The case number is not retrieved from the metadata inside a forensic container because of a programming error in the tool used
DFW-1345	The case description retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used
DFW-1346	The cryptographic hash is not retrieved from the metadata inside a forensic container because of a programming error in the tool used
DFW-1347	The cryptographic hash retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used
DFW-1348	The case number retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used
DFW-1349	The evidence number is not retrieved from the metadata inside a forensic container because of a programming error in the tool used
DFW-1350	The evidence number retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used
DFW-1351	The examiner name is not retrieved from the metadata inside a forensic container because of a programming error in the tool used
DFW-1352	The examiner name retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used
DFW-1353	The notes field is not retrieved from the metadata inside a forensic container because of a programming error in the tool used
DFW-1354	The notes field retrieved from the metadata inside a forensic container are incorrect because of a programming error in the tool used
DFW-1355	The case description is not retrieved from the metadata inside a forensic container because of a programming error in the tool used
DFW-1356	Failing to acquire data due to omission of undocumented endpoints
DFW-1357	Failing to acquire data because of timeout
DFW-1358	Failing to acquire data because historical records were not acquired
DFW-1359	Failing to acquire data because of truncation during format conversions
DFW-1360	Failing to acquire data because historical records were lost during format conversions
DFW-1361	Failing to acquire data because of provider-side outages or interruptions
DFW-1362	Failing to acquire data because of client-side network outages or interruptions
DFW-1363	Failing to acquire data because of acquisition tool misconfigurations
DFW-1364	Failing to acquire data because of acquisition tool bugs or limitations
DFW-1365	Failing to acquire data because of acquisition of non-production environment"
DFW-1366	Inaccurate information collected resulting from data format conversions
DFW-1367	Failing to acquire data because of filtering
DFW-1368	Inaccurate information collected resulting from timestamp format conversions
DFW-1369	Failing to acquire data structure because metadata and relationships were not acquired
DFW-1370	Failing to acquire cloud service logs because they are stored separately from data
DFW-1371	Failing to acquire data because an outdated API was used
DFW-1372	Failing to acquire data because an outdated or incomplete schema was used
DFW-1373	Failing to acquire data because of provider-side API limiting or throttling
DFW-1374	Failing to acquire data because of client-side API limiting or throttling
DFW-1375	Failing to acquire data because of errors accessing cloud service
DFW-1376	Failing to acquire data because credentials used do not have sufficient permissions
DFW-1377	Failing to acquire data because credentials used have expired or were revoked
DFW-1378	Relevant keywords not returned by live search due to improper handling of character encoding
DFW-1379	One or more proposed hypotheses are not mutually exclusive
DFW-1380	A proposed hypothesis suffers from a lack of falsifiability
DFW-1381	A proposed hypothesis equates correlation with causation
DFW-1382	A hypothesis refers to "device user" rather than "suspect" when a specific individual is under investigation
DFW-1383	A proposed hypothesis uses judgmental or loaded terminology
DFW-1384	Addressing the wrong level of the hierarchy of hypotheses required for the case
DFW-1385	A proposed hypothesis uses vague or complex phrasing
DFW-1386	A proposed hypothesis is overly specific to details in the case
DFW-1387	The operating system installation date is not recovered because the tool fails while decoding the value
DFW-1388	The operating system installation date is not recovered because the tool examines an incorrect artifact
DFW-1389	The operating system installation date extracted does not reflect the time it was installed because the artifact represents an software update, or some other event
DFW-1390	The operating system installation date extracted does not reflect the time it was installed because the timezone conversion was applied incorrectly
DFW-1391	The operating system installation date extracted does not reflect the time it was installed because the tool incorrectly decoded the timestamp
DFW-1392	Presentation of the extracted operating system installation date does not highlight that there were previous operating systems installed prior to this date
DFW-1393	Failure to recover mount point mapping because multiple devices have used the mount point and older data has been overwritten
DFW-1394	Failure to recover mount point mapping because of a tool processing error
DFW-1395	Failure to recover mount point mapping because multiple operating systems are present and they use different mappings
DFW-1396	Extracting a relationship between a mount point and device/partition that is incorrect because of a tool processing error
DFW-1397	Cryptographic hash of the source data is incorrect because not all data was read from the device
DFW-1398	Cryptographic hash of the source data is incorrect because of a hash computation error
DFW-1399	Source data is changed when cryptographic hash is being computed because of writes made to the source device
DFW-1400	Source data is changed when cryptographic hash is being computed because of SSD TRIM operations clearing data
DFW-1401	Calculating an incorrect hash of data stored within a forensic image because internally stored data was not decompressed correctly
DFW-1402	Calculating an incorrect hash of data stored within a forensic image because it is split over multiple files and not all were included
DFW-1403	Failure to evaluate observations in light of the hypotheses because the examination was scoped to extracting and reporting artifacts, with no evaluative question posed
DFW-1404	Failure to evaluate observations in light of the hypotheses because the meaning of the observations was treated as self-evident
DFW-1405	Failure to evaluate observations in light of the hypotheses because analytic output is delivered as fact
DFW-1406	Failure to consider alternative hypotheses because the examination was framed by the instructing party's proposition alone
DFW-1407	Failure to consider alternative hypotheses because the observations were assessed for how well they fitted the proposed hypothesis, a one-conditional judgment that never requires an alternative to be stated
DFW-1422	An AI response to a question does not return a relevant event because it found something else relevant and stopped searching
DFW-1423	An AI response to a question returns an event with one or more incorrect details because the supporting data was unreliable, but that was not recognised
DFW-1424	An AI response returns a sequence of events that do not reflect the true ordering of events that occurred because of failure to consider clock inaccuracies
DFW-1425	An AI response to a question presents an assertion that an event occurred as a fact not a hypothesis
DFW-1426	An AI response to a query takes a biased tone because of the phrasing of the user's prompting
DFW-1427	An AI response to a query takes a biased tone because of inherent bias in the data the model was trained on
DFW-1428	An AI response to a query takes a biased tone because of phrasing in an embedded system prompt
DFW-1429	An AI response to a query for relevant artifacts is missing one or more relevant artifacts because it found something else relevant and stopped searching
DFW-1430	An AI response to a query for relevant artifacts is missing one or more relevant artifacts because the results exceed a context window
DFW-1431	An AI response to a query for relevant artifacts is missing one or more relevant artifacts because some were not recognised as relevant
DFW-1432	An AI response to a query for relevant artifacts includes reporting artifacts that are not relevant because the model could not successfully differentiate relevance
DFW-1433	An AI response to a question does not return a relevant event because the data needed to reconstruct the event was lost due to context window overflow
DFW-1434	An AI response to a query for relevant artifacts includes reporting artifacts that do not exist because of model hallucinations
DFW-1435	An AI response to a query does not provide the reasoning behind the results generated because the system is not capable of producing it
DFW-1436	An AI response to a query does not provide the reasoning behind the results generated because it was not requested
DFW-1437	An AI response to a query does not provide a measure of confidence in the reasoning provided because the system is not capable of producing it
DFW-1438	An AI response to a query does not provide a measure of confidence in the reasoning provided because it was not requested
DFW-1439	An AI response to a query provides an inaccurate reasoning behind the results generated
DFW-1440	An observation referred to in the reasoning provided by an AI system does not exist because of model hallucinations
DFW-1441	An observation that contradicts the conclusions drawn by an AI system are not presented when presenting reasoning because contradictory observations were not requested
DFW-1442	An observation that contradicts the conclusions drawn by an AI system are not included when presenting reasoning because the system stopped searching for relevant data once it found sufficient supporting information
DFW-1443	An AI response to a query does not provide an accurate confidence in the reasoning provided because the confidence value is fabricated
DFW-1444	An AI response to a question does not return a relevant event because it was not recognised as relevant
DFW-1445	An observation referred to in the reasoning provided by and AI system does not support the conclusions drawn because the system is unable to accurately reason with the observable data that is available but does so anyway
DFW-1446	An AI response to a question does not return a relevant link because it found something else relevant and stopped searching
DFW-1447	An AI response to a question does not return a relevant link because it could not correctly interpret the data needed to make the link
DFW-1448	An AI response to a question asserts a link that does not exist because because of model hallucinations
DFW-1449	An AI response to a question asserts a link that does not exist because the supporting data was unreliable but that was not recognised
DFW-1450	An AI response to a question does not return a relevant event because data needed to reconstruct the event was lost due to compression of the context
DFW-1451	An AI response to a question returns an event that did not occur because of model hallucinations
DFW-1452	An AI response to a question returns an event that did not occur because of an incorrect 'interpretation' of the meaning of some artifacts
DFW-1453	An AI response to a question returns an event that did not occur because the supporting data was unreliable, but that was not recognised
DFW-1454	An AI response to a question returns an event with one or more incorrect details because of model hallucinations
DFW-1455	An AI response to a question returns an event with one or more incorrect details because of an incorrect 'interpretation' of the meaning of some artifacts
DFW-1456	The decoded value is incorrect because the incorrect data type was applied for decoding
DFW-1457	The integer decoded from some data is incorrect because the incorrect number of bytes was examined
DFW-1458	The integer decoded from some data is incorrect because the endianness used was incorrect
DFW-1459	The integer decoded from some data is incorrect because the decoding was signed not unsigned or vice versa
DFW-1460	The integer decoded from some data is incorrect because it should have been decoded as a floating point number
DFW-1461	The floating point number decoded from some data is incorrect because the incorrect number of bytes was examined
DFW-1462	The floating point number decoded from some data is incorrect because the endianness used was incorrect
DFW-1463	The floating point number decoded from some data is incorrect because the decoding was signed not unsigned or vice versa
DFW-1464	The floating point number decoded from some data is incorrect because it should have been decoded as an integer
DFW-1465	The floating point number decoded from some data is incorrect because the original value could not be fully represented within the bytes available
DFW-1473	The examiner-entered metadata was not stored along with the forensic container because of a software error in the tool used
DFW-1474	The examiner-entered metadata was not stored along with the forensic container because the examiner did not enter the details
DFW-1475	The computed hash(s) were not stored along with the forensic container because of a software error in the tool used
DFW-1476	The examiner-entered metadata stored along with the forensic container is incorrect because of a software error in the tool used
DFW-1477	The examiner-entered metadata stored along with the forensic container is incorrect because the examiner entered the wrong details
DFW-1478	The computed hash(s) stored along with the forensic container is incorrect because of a software error in the tool used