ID Name INCOMP INAC-EX INAC-AS INAC-ALT INAC-COR MISINT DFW-1001 Excluding a device during triage that contains relevant information X DFW-1002 Use of triage technology results in changes to the target media X DFW-1003 Triage tool applies a simplification that does not correctly represent the meaning of the digital data X X X DFW-1004 Data copied does not include all sectors from LBA0 to LBA max due to the data copying process stopping prematurely X DFW-1005 Dogs fail to find a digital device X DFW-1006 Acquisition tool does not copy data from HPA X DFW-1007 Acquisition tool does not copy data from DCO X DFW-1008 Missing the existence of a device by missing synchronisation artefacts X DFW-1009 Missing the existence of a device by incorrectly parsing synchronisation artefacts X DFW-1010 Misattributing activity to the wrong device X DFW-1011 Suggesting the existence of a device that does not exist X DFW-1012 Interaction with the target devices to read data causes changes X DFW-1013 During acquisition the data copying process results in extra bytes X DFW-1014 Accessing the drive to copy data changes original data X DFW-1015 Powering on SSD results in sectors being wiped by TRIM operation X X X DFW-1016 Data copied from sectors on source device are not transferred correctly for storage X X DFW-1017 Files or data that is relevant to the investigation is missed X DFW-1018 Data is collected that is not relevant to the investigation X DFW-1019 Data is collected and assigned to incorrect device X DFW-1020 Content of data collected is incorrect X DFW-1021 Metadata of data collected is missing X DFW-1022 Metadata of data collected is incorrect X DFW-1023 Collection process changes content of data on target X X DFW-1024 Collection process changes metadata of data on target X X DFW-1025 Data relevant to the case is excluded as part of the filtering process X DFW-1026 Selective extraction of a backup implies partial collection when it is in reality a full collection followed by deletion. X DFW-1027 Including data that was meant to be excluded with the selected filters X DFW-1028 Due to the use of time based filters data extracted may be presented out of context X DFW-1029 Memory smearing may result in pointers being inconsistent within the memory image X X DFW-1030 Loading a memory imaging tool makes changes to the data in memory that is being acquired X DFW-1031 Loading a memory imaging tool overwrites relevant data within memory X DFW-1032 Not all memory is acquired X DFW-1033 Data referenced in memory is located within pagefile or swapfile but is not collected X DFW-1034 Missing data from the running system due to the device being compromised (e.g. rootkit) X DFW-1035 Collecting incorrect data from a running system due to the device being compromised (e.g. rootkit) X X X X DFW-1036 Overwriting relevant data with changes caused by running the live tools X X DFW-1037 Presenting data from a mobile backup as complete, when it is in reality a partial set of files from the device X DFW-1038 Backup process returns an incomplete set of backup data X DFW-1039 Backup data collection overwrites important data X X DFW-1040 Not considering SD Card acquisition in addition to other extractions performed X DFW-1041 Not considering file system acquisition as alternative X DFW-1042 Disk image was tampered with, but manipulated to have a collision with original hash X DFW-1043 Data is written to forensic format that does not preserve the original raw data X DFW-1044 Failing to extract a decryption key that is present X DFW-1045 Extracting an incorrect decryption key X DFW-1046 File not recovered from the stored backup X DFW-1047 File recovered from backup that did not exist X DFW-1048 File recovered from backup but presented in the wrong location X DFW-1049 File content recovered incorrectly from backup X DFW-1050 Failure to highlight that there are other apps present for which data is not available X DFW-1051 Failure to highlight that not all app data may be present in a backup X DFW-1052 Incorrect retrieval of results from an index X X DFW-1053 Incorrect parsing of a supplied regular expression used for keyword searching X X X DFW-1054 Data not indexed for keyword searching due to text encoding X DFW-1055 Data not indexed for keyword searching due to missing substring feature X DFW-1056 Data not indexed for keyword searching due to case sensitivity problem X DFW-1057 Relevant keyword results not captured by the case-type keyword list used X DFW-1058 Results appear in an ‘artefact’ or ‘result’ but the context, source or provenance of result is unclear X DFW-1059 Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical X DFW-1060 A relevant piece of media was not flagged as relevant X X DFW-1061 An irrelevant piece of media was flagged as relevant X DFW-1062 The grade or specific tag given to item is incorrect X DFW-1063 Incorrectly parsing the partitions table(s) X X DFW-1064 Making incorrect assumptions about sector size e.g. 512 rather than 4096 X DFW-1065 Failing to correctly parse start sector pointers from partition tables X X DFW-1066 Missing deleted but recoverable partitions from unpartitioned space X DFW-1067 Failure to check the integrity of partition table (where possible e.g. GPT) X DFW-1068 Failing to identify the existence of an allocated file X DFW-1069 Failing to identify the existence of an allocated directory X DFW-1070 Failing to recover the complete contents of an allocated file X DFW-1071 Failing to recover a complete listing of an allocated directory X DFW-1072 Recovering incorrect contents of an allocated file X DFW-1073 Recovering an incorrect listing of an allocated directory X DFW-1074 Attributing a file to the wrong directory X DFW-1075 Presenting a file that does not exist X DFW-1076 Presenting a directory that does not exist X DFW-1077 Presenting a non-allocated file as an allocated file X X DFW-1078 Presenting an allocated file as non-allocated X X DFW-1079 Recovering incorrect metadata about a file X DFW-1080 Recovering incorrect metadata about a directory X DFW-1081 Failing to recover file system metadata X DFW-1082 Recovering file system metadata incorrectly X DFW-1083 Failure to recover additional specialised file system specific content e.g. Alternate Data Streams X DFW-1084 Failure to correctly recover specialised file system specific content e.g. Alternate Data Streams X DFW-1085 Missing messages from the live set of messages X DFW-1086 Failing to recover deleted but recoverable messages X DFW-1087 Presenting a live message that did not exist X DFW-1088 Presenting a deleted message that did not exist X DFW-1089 Recovering a live message with incorrect content X DFW-1090 Recovering a live message with incorrect metadata X DFW-1091 Recovering a deleted message with incorrect content X DFW-1092 Recovering a deleted message with incorrect metadata X DFW-1093 Presenting a deleted message as live X X DFW-1094 Attributing a message to the incorrect sender X DFW-1095 Attributing a message to the incorrect thread X DFW-1096 Failing to recover attachments for a live message X DFW-1097 Failing to recover attachment for a deleted message X DFW-1098 Assigning incorrect metadata to a message attachment X DFW-1099 Assigning an attachment to an incorrect messages X DFW-1100 Tool fails to display special effects or highlight within a message X DFW-1101 Failure to recover message edits if available X DFW-1102 Failure to display that a message had a previous state X X DFW-1103 Failure to carve salvageable content X DFW-1104 Incorrect carving of a complete file X X DFW-1105 Incorrect reassembly of a file X X DFW-1106 Incorrect attribution of salvaged content to a current file system rather than a previous one X X DFW-1107 Failure to repair a content fragment X X DFW-1108 Failure to recover history resulting from private browsing X DFW-1109 Incorrect recovery of information regarding a web visit from allocated data X X X DFW-1110 Failure to recover browser history from live data X DFW-1111 Incorrect recovery of information regarding a web visit from non-allocated data X X X DFW-1112 Failure to recover browser history from non-allocated data X DFW-1113 Misinterpretation a URL located on disk/memory as a web visit X X DFW-1114 Failure to locate a relevant device at a physical crime scene X DFW-1115 Device is remote wiped because faraday environment was insufficient. X X DFW-1116 Last wifi connection is overwritten because faraday environment was insufficient. X X DFW-1117 Calls, messages or other data was received and overwrote relevant data because faraday environment was insufficient. X X DFW-1118 Hardware write blocker fails to prevent modifications to the attached device. X DFW-1119 Hardware write blocker hides the existence of an HPA. X DFW-1120 Hardware write blocker hides the existence of an DCO. X DFW-1121 Image format parsing fails to to present all blocks from within a forensic container image in their ‘flat’ (dd) representation X DFW-1122 Image format parsing presents incorrect data within sectors of the image X DFW-1123 Image format parsing presents incorrect forensic image metadata X DFW-1124 Failure to compute hash of source device correctly during disk image verification X X DFW-1125 Failure to validate hash properly during disk image verification X X DFW-1126 Failure to validate hash properly allowing an incomplete disk image to present as validated X DFW-1127 Failure to validate disk image metadata X DFW-1128 Disk image has been replaced with tampered version along with updated stored hash X DFW-1129 File type is incorrectly identified X DFW-1130 Missing assignment of a file type: reporting a file as unknown when it has a known type within the digital forensic science body of knowledge X DFW-1131 Missing recognition of multiple file types: reporting a file as a limited set of types, or a single type, when it can be interpreted as having more than one, such as a GIF and Java Jar X X DFW-1132 Incorrectly computing the hash of one or more files within a disk image due to incorrect hash algorithm implementation X X DFW-1133 Tool fails to express uncertainty in the classification of file recovery results, e.g., where content may be partly overwritten. X DFW-1134 Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected X X DFW-1135 Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected X X DFW-1136 Data cannot be read from a device due to the device having failed physically X DFW-1137 Failing to determine password as it is not in the dictionary used X DFW-1138 Failing to identify password in the time available X DFW-1139 System locks after X failed dictionary attempts X X DFW-1140 Failing to determine password as it is not in the search space X DFW-1141 Failing to determine password via brute force in the time available X DFW-1142 System locks after X failed brute force attempts X X DFW-1143 Data is not read from remapped sectors e.g. G-Lists during the acquisition process X DFW-1144 Failure to identify timestamps in a data source X DFW-1145 Failure to extract timestamps from a data source X DFW-1146 Failure to consider non-timestamp based timing information X DFW-1147 Failure to normalise timestamps correctly during timeline generation X X DFW-1148 Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock X DFW-1149 Failure to consider timestamp inaccuracy at time of inferred event X X X X DFW-1150 Misinterpreting events from automated processes as user generated ones X X DFW-1151 Incorrectly decoding a timestamp from a data source X DFW-1152 Generated report does not include all bookmarks X DFW-1153 Report generated from bookmarks does not render all content (e.g. previews, string extracts) correctly X X DFW-1154 Report generated from bookmarks stored in manner that does not prevent tampering or corruption X DFW-1155 Bookmark added by examiner is not recorded X DFW-1156 Bookmark added by examiner is is recorded with incorrect tag/label/category X DFW-1157 Use of mobile exploit changes/overwrites data that was relevant to the investigation X X DFW-1158 Use of mobile exploit renders device unusable or 'bricked' X DFW-1159 Presenting a mobile file system acquisition as a bitwise copy of the device X DFW-1160 Failure to copy relevant files from the mobile device X DFW-1161 Lack of privileges for file system acquisition X DFW-1162 Changing relevant files during file system acquisition X X DFW-1163 Changing relevant file metadata during file system acquisition X X DFW-1164 Files are still encrypted using file-based encryption so inaccessible X DFW-1165 Failure to preserve original timestamps from the data source in an archive X X X DFW-1166 Consideration of live database content only X DFW-1167 Combining data from multiple tables that should not be joined X X X DFW-1168 Data extracted from a table is assigned an incorrect interpretation X X DFW-1169 Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value X X X DFW-1170 Failure to recover data stored in Write Ahead Log (WAL) files X DFW-1171 Failure to recover data stored in database journal files X DFW-1172 Relevant reference data missed as its necessity was not known at time of preservation X X X DFW-1173 The recorded time offset is incorrect because the trusted time source used for reference was incorrect X X DFW-1174 Failure to find internal attached storage media X DFW-1175 Failure to find internal unattached storage media X DFW-1176 Unable to physically remove/detach internal storage media X DFW-1177 Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence X X DFW-1178 Inability to load the forensic bootable environment due to system configuration X DFW-1179 Failure to detect internal disk from bootable environment X DFW-1180 Failing to decrypt internal disk using the bootable environment X DFW-1182 Bootable environment overwrites relevant data on the target device X X DFW-1183 Failure to identify the existence of a connected device X DFW-1184 Presenting devices 'seen' as devices connected X X X DFW-1185 Failure to enumerate all files in a standard archive format X DFW-1186 Missing files with file name/path-based pattern matching due to renaming X DFW-1187 Failure to match file name/path pattern due to mismatch of search term used and pattern match engine. X DFW-1188 Failure to match file name/path pattern due to implementation error in matching engine. X DFW-1189 Artifact extraction is incomplete due to app version changes. X DFW-1190 Interpretation of app data is incorrect due to app version changes. X DFW-1191 Missing changes in app artifacts during research since app interaction is needed to cause changes X DFW-1192 Relevant results not captured by the case-specific keywords used X DFW-1193 Keyword results missed since relevant keyword is split over a sector or cluster boundary X DFW-1194 Keyword results missed since relevant keyword is inside compressed or encoded data X DFW-1195 Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file X X DFW-1196 One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image X DFW-1197 Data not indexed for keyword searching due to compression X DFW-1198 Data not indexed for keyword searching due to file or content encoding X DFW-1199 Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical X DFW-1200 Failure to conduct iterative keyword searching due to excessive time taken per search X DFW-1201 Failure to recover live messages to or from the AI companion app X DFW-1202 Failure to recover deleted but recoverable messages to or from the AI companion app X DFW-1203 Presenting a message from the user or AI companion app that did not exist X DFW-1204 Presenting a deleted message to the AI companion app as a live one, or vice versa X DFW-1205 Presenting a message to the AI chat app as from the AI companion app, or vice versa X DFW-1206 Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app X DFW-1207 Failure to display a message to or from the AI companion app in the context of other messages X DFW-1208 Failure to recover live images sent to or from the AI companion app X DFW-1209 Failure to recover deleted but recoverable images sent to or from the AI companion app X DFW-1210 Presenting an image sent from the user or AI companion app that did not exist X DFW-1211 Presenting a deleted image sent to the AI companion app as a live one, or vice versa X DFW-1212 Presenting an image sent to the AI chat app as from the AI companion app, or vice versa X DFW-1213 Failure to display an image to or from the AI companion app in the context of other messages X DFW-1214 Failure to recover live records of calls to or from the AI companion app X DFW-1215 Failure to recover deleted but recoverable records of calls to or from the AI companion app X DFW-1216 Presenting a call to or from the AI companion app that did not exist X DFW-1217 Presenting a deleted call to the AI companion app as a live one, or vice versa X DFW-1218 Presenting a call to the AI companion app as from the AI companion app, or vice versa X DFW-1219 Failure to recover metadata associated with an interaction with the AI companion app X DFW-1220 Presenting an incorrect timestamp associated with an interaction with the AI companion app X DFW-1221 Failure to recover account details from the AI app data X DFW-1222 Presenting account details that did not exist X DFW-1223 Live access to the device (for extraction) updates last access times for an account X X DFW-1224 Presenting a deleted account as live, or vice versa X DFW-1225 Failure to recover relevant app settings X DFW-1226 Failure to recover relevant AI bot settings X DFW-1227 Associating a configured bot with the wrong account X DFW-1228 Log entry missing due to incorrect parsing of logfile X DFW-1229 Log entry missing due to being stored in archived copies of logs X DFW-1230 Log entry missing due to rotation size or timing X DFW-1231 Interpreting log entry absence as evidence of deletion rather than logging configuration X DFW-1232 Failure to extract log entry timestamp X DFW-1233 Failure to communicate imprecision in log entry timestamp X DFW-1234 Event time presented incorrectly due to incorrect timezone handling X X X X DFW-1235 Failure to extract log entry type X DFW-1236 Incorrectly interpreting a log entry type based on a different version of the generating software or operating system X X DFW-1243 Missing browser history data as it was conducted outside of configured retention period X DFW-1244 Missing browser history data as it was cleared by user X DFW-1245 Relying on times stored in browser history that are not representative of exact web page visit time X X DFW-1246 Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database X X X DFW-1247 Attributing saved browser bookmarks to a user but they were bundled with the browser installation X DFW-1248 Missing browser downloads as the files were saved to a non-standard location X DFW-1249 Missing a web browser profile as it was stored outside of the usual browser profile folders X DFW-1250 Incomplete browser activity extraction due to not considering the browser cache artifacts X DFW-1251 Incomplete browser activity extraction due to failure to consider multiple profiles X DFW-1252 Assuming that data stored in the cache was viewed by the user X X DFW-1253 Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information X X DFW-1254 Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information X DFW-1255 Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL) X DFW-1256 Incorrect attribution of metadata to file content that was the result of 'file tunnelling' X X DFW-1257 Missing content that is relevant to a keyword search but it has not been extracted as 'artifacts' X DFW-1258 Failure to present uncertainty associated with automated interpretation of data into artifacts X X DFW-1259 Image format parsing fails to identify or assemble split forensic images X X DFW-1260 Failure to derive clock offset due to inability to locate a suitable time anchor X DFW-1261 Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring X X DFW-1262 Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time X X DFW-1263 Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring X X DFW-1264 Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp X X DFW-1265 Offset applied to timestamp is incorrect due to variations in time zone over the history of data source X DFW-1266 Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings X DFW-1267 Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source X DFW-1268 Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used X DFW-1269 Failure to apply time offset to a timeline entry X X X X DFW-1270 Inability to create a device backup due to locked device X DFW-1271 Inability to access required service as it is not enabled X DFW-1272 Failure to preserve all relevant timestamps of files obtained using exposed services on a device X DFW-1273 Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device X DFW-1274 Inability to enable required service due to locked device X DFW-1275 Failure to store data due to size limitations of archive format used X DFW-1276 Relevant data is overwritten by deploying an agent to a mobile device X DFW-1277 Connection over a direct media interface causes changes to the target media X X X DFW-1278 Data copied does not include all sectors from LBA0 to LBA max due to the data copying process skipping some sectors or bytes X DFW-1279 Failure to recover live message from a multiplayer gaming app X DFW-1280 Presenting a live contact from a gaming app as a deleted one or vice versa X DFW-1281 Failure to recover the gaming app configuration X DFW-1282 Recovering the gaming app configuration incorrectly X X DFW-1283 Failure to recover a live account used in a gaming application X DFW-1284 Failure to recover a previous but removed account used in a gaming application X DFW-1285 Recovering an account used for a gaming application that was not actually used X DFW-1286 Describing a live gaming app account as deleted/removed or vice versa X X DFW-1287 Failure to recover deleted message from a multiplayer gaming app X DFW-1288 Presenting a live message from a gaming app that does not exist X DFW-1289 Presenting a deleted message from a gaming app that does not exist X DFW-1290 Presenting a live message from a gaming app as deleted or vice versa X DFW-1291 Failure to recover a live contact from a gaming app X DFW-1292 Failure to recover a deleted contact from a gaming app X DFW-1293 Presenting a live contact from a gaming app that does not exist X DFW-1294 Presenting a deleted contact from a gaming app that does not exist X DFW-1295 The filtered timeline misses relevant entries because filtering criteria was too strict X X DFW-1296 The filtered timeline misses relevant entries because the tool did not filter correctly X DFW-1297 The filtered timeline includes entries that are not relevant because the filtering criteria was too broad X X DFW-1298 The filtered timeline includes entries that are not relevant because the tool did not filter correctly X X DFW-1299 A filtered timeline is presented as a full timeline X DFW-1300 Missing deleted but recoverable volumes from unpartitioned space X DFW-1308 Sorted timeline is missing timeline entries due to tool error during sort process X DFW-1309 Sorted timeline is missing timeline entries because timeline contained entries not based on timestamps X DFW-1310 Sorted timeline has additional timeline entries due to tool error during sort process X DFW-1311 Timeline entry is in an incorrect sequence due to resolution of the timestamp used X DFW-1312 Timeline entry is in an incorrect sequence due to underlying timestamp being based on an incorrect clock X DFW-1313 Timeline entry is in an incorrect sequence due to timezone already applied to timestamp X DFW-1314 Timeline entry is in an incorrect sequence due to a time offset being applied that is incorrect for the timeline entry X DFW-1315 Failure to recover a notification due to not attempting to parse the relevant data X DFW-1316 Failure to recover a notification due to a tool error parsing the relevant data X DFW-1317 Failure to recover a notification due to it being deleted because of the expiry time set X DFW-1318 Failure to recover a notification due to it being deleted because of it being viewed and cleared X DFW-1319 Associating a notification with an incorrect application due to tool error X DFW-1320 Failure to extract the creation time of a notification due to tool error X DFW-1321 Presenting the incorrect time for a notification due to tool error X DFW-1324 Failure to extract the operating system version due to a tool accessing the wrong artifact X DFW-1325 Failure to extract the operating system version because a tool parses the relevant artefact incorrectly X DFW-1326 Extracting an incorrect operating system version because a tool uses an incorrect or outdated artifact X DFW-1327 Extracting an incorrect operating system version because a tool parses the relevant artefact incorrectly X DFW-1328 Extracting a previous operating system version as if it were the current because a tool uses an incorrect or outdated artifact X DFW-1329 Failure to highlight previous versions of the operating system that were used on the device X DFW-1330 Failure to recover an allocated Registry key because of a parsing error in the tool used X DFW-1331 Failure to recover last modified time associated with an allocated Registry key because of a parsing error in the tool used X DFW-1332 Presenting an allocated Registry key that does not exist because of a parsing error in the tool used X DFW-1333 Mapping an allocated Registry key to an incorrect point in the Registry tree structure because of a parsing error in the tool used X DFW-1334 Failure to recover allocated values associated with a Registry key because of a parsing error in the tool used X DFW-1335 Presenting an allocated Registry value that does not exist because of a parsing error in the tool used X DFW-1336 Associating an allocated Registry value with an incorrect key because of a parsing error in the tool used X DFW-1337 Presenting an allocated Registry key's modification time as the modification time for a specific value. X DFW-1338 Failing to acquire data due to omission of undocumented endpoints X DFW-1339 Failing to acquire data because of filtering X DFW-1340 Data on a mobile device is overwritten because not all relevant connectivity settings were configured correctly X X DFW-1341 Data on a mobile device is overwritten because the connectivity settings were subsequently reset by an automated process X X DFW-1342 Data is added to a mobile device because not all relevant connectivity settings were configured correctly X X DFW-1343 Data is added to a mobile device because the connectivity settings were subsequently reset by an automated process X X DFW-1344 The case number is not retrieved from the metadata inside a forensic container because of a programming error in the tool used X DFW-1345 The case description retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used X DFW-1346 The cryptographic hash is not retrieved from the metadata inside a forensic container because of a programming error in the tool used X DFW-1347 The cryptographic hash retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used X DFW-1348 The case number retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used X DFW-1349 The evidence number is not retrieved from the metadata inside a forensic container because of a programming error in the tool used X DFW-1350 The evidence number retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used X DFW-1351 The examiner name is not retrieved from the metadata inside a forensic container because of a programming error in the tool used X DFW-1352 The examiner name retrieved from the metadata inside a forensic container is incorrect because of a programming error in the tool used X DFW-1353 The notes field is not retrieved from the metadata inside a forensic container because of a programming error in the tool used X DFW-1354 The notes field retrieved from the metadata inside a forensic container are incorrect because of a programming error in the tool used X DFW-1355 The case description is not retrieved from the metadata inside a forensic container because of a programming error in the tool used X DFW-1356 Failing to acquire data due to omission of undocumented endpoints X DFW-1357 Failing to acquire data because of timeout X DFW-1358 Failing to acquire data because historical records were not acquired X DFW-1359 Failing to acquire data because of truncation during format conversions X DFW-1360 Failing to acquire data because historical records were lost during format conversions X DFW-1361 Failing to acquire data because of provider-side outages or interruptions X DFW-1362 Failing to acquire data because of client-side network outages or interruptions X DFW-1363 Failing to acquire data because of acquisition tool misconfigurations X DFW-1364 Failing to acquire data because of acquisition tool bugs or limitations X DFW-1365 Failing to acquire data because of acquisition of non-production environment" X DFW-1366 Inaccurate information collected resulting from data format conversions X DFW-1367 Failing to acquire data because of filtering X DFW-1368 Inaccurate information collected resulting from timestamp format conversions X DFW-1369 Failing to acquire data structure because metadata and relationships were not acquired X DFW-1370 Failing to acquire cloud service logs because they are stored separately from data X DFW-1371 Failing to acquire data because an outdated API was used X DFW-1372 Failing to acquire data because an outdated or incomplete schema was used X DFW-1373 Failing to acquire data because of provider-side API limiting or throttling X DFW-1374 Failing to acquire data because of client-side API limiting or throttling X DFW-1375 Failing to acquire data because of errors accessing cloud service X DFW-1376 Failing to acquire data because credentials used do not have sufficient permissions X DFW-1377 Failing to acquire data because credentials used have expired or were revoked X DFW-1378 Relevant keywords not returned by live search due to improper handling of character encoding X DFW-1379 One or more proposed hypotheses are not mutually exclusive X DFW-1380 A proposed hypothesis suffers from a lack of falsifiability X DFW-1381 A proposed hypothesis equates correlation with causation X DFW-1382 A hypothesis refers to "device user" rather than "suspect" when a specific individual is under investigation X DFW-1383 A proposed hypothesis uses judgmental or loaded terminology X DFW-1384 Addressing the wrong level of the hierarchy of hypotheses required for the case X DFW-1385 A proposed hypothesis uses vague or complex phrasing X DFW-1386 A proposed hypothesis is overly specific to details in the case X DFW-1387 The operating system installation date is not recovered because the tool fails while decoding the value X DFW-1388 The operating system installation date is not recovered because the tool examines an incorrect artifact X DFW-1389 The operating system installation date extracted does not reflect the time it was installed because the artifact represents an software update, or some other event X X DFW-1390 The operating system installation date extracted does not reflect the time it was installed because the timezone conversion was applied incorrectly X X DFW-1391 The operating system installation date extracted does not reflect the time it was installed because the tool incorrectly decoded the timestamp X X DFW-1392 Presentation of the extracted operating system installation date does not highlight that there were previous operating systems installed prior to this date X DFW-1393 Failure to recover mount point mapping because multiple devices have used the mount point and older data has been overwritten X DFW-1394 Failure to recover mount point mapping because of a tool processing error X DFW-1395 Failure to recover mount point mapping because multiple operating systems are present and they use different mappings X DFW-1396 Extracting a relationship between a mount point and device/partition that is incorrect because of a tool processing error X X DFW-1397 Cryptographic hash of the source data is incorrect because not all data was read from the device X DFW-1398 Cryptographic hash of the source data is incorrect because of a hash computation error X DFW-1399 Source data is changed when cryptographic hash is being computed because of writes made to the source device X X DFW-1400 Source data is changed when cryptographic hash is being computed because of SSD TRIM operations clearing data X X DFW-1401 Calculating an incorrect hash of data stored within a forensic image because internally stored data was not decompressed correctly X X DFW-1402 Calculating an incorrect hash of data stored within a forensic image because it is split over multiple files and not all were included X X DFW-1403 Failure to evaluate observations in light of the hypotheses because the examination was scoped to extracting and reporting artifacts, with no evaluative question posed X DFW-1404 Failure to evaluate observations in light of the hypotheses because the meaning of the observations was treated as self-evident X DFW-1405 Failure to evaluate observations in light of the hypotheses because analytic output is delivered as fact X DFW-1406 Failure to consider alternative hypotheses because the examination was framed by the instructing party's proposition alone X DFW-1407 Failure to consider alternative hypotheses because the observations were assessed for how well they fitted the proposed hypothesis, a one-conditional judgment that never requires an alternative to be stated X DFW-1422 An AI response to a question does not return a relevant event because it found something else relevant and stopped searching X DFW-1423 An AI response to a question returns an event with one or more incorrect details because the supporting data was unreliable, but that was not recognised X DFW-1424 An AI response returns a sequence of events that do not reflect the true ordering of events that occurred because of failure to consider clock inaccuracies X DFW-1425 An AI response to a question presents an assertion that an event occurred as a fact not a hypothesis X DFW-1426 An AI response to a query takes a biased tone because of the phrasing of the user's prompting X DFW-1427 An AI response to a query takes a biased tone because of inherent bias in the data the model was trained on X DFW-1428 An AI response to a query takes a biased tone because of phrasing in an embedded system prompt X DFW-1429 An AI response to a query for relevant artifacts is missing one or more relevant artifacts because it found something else relevant and stopped searching X DFW-1430 An AI response to a query for relevant artifacts is missing one or more relevant artifacts because the results exceed a context window X DFW-1431 An AI response to a query for relevant artifacts is missing one or more relevant artifacts because some were not recognised as relevant X DFW-1432 An AI response to a query for relevant artifacts includes reporting artifacts that are not relevant because the model could not successfully differentiate relevance X X DFW-1433 An AI response to a question does not return a relevant event because the data needed to reconstruct the event was lost due to context window overflow X DFW-1434 An AI response to a query for relevant artifacts includes reporting artifacts that do not exist because of model hallucinations X DFW-1435 An AI response to a query does not provide the reasoning behind the results generated because the system is not capable of producing it X DFW-1436 An AI response to a query does not provide the reasoning behind the results generated because it was not requested X DFW-1437 An AI response to a query does not provide a measure of confidence in the reasoning provided because the system is not capable of producing it X DFW-1438 An AI response to a query does not provide a measure of confidence in the reasoning provided because it was not requested X DFW-1439 An AI response to a query provides an inaccurate reasoning behind the results generated X DFW-1440 An observation referred to in the reasoning provided by an AI system does not exist because of model hallucinations X DFW-1441 An observation that contradicts the conclusions drawn by an AI system are not presented when presenting reasoning because contradictory observations were not requested X DFW-1442 An observation that contradicts the conclusions drawn by an AI system are not included when presenting reasoning because the system stopped searching for relevant data once it found sufficient supporting information X DFW-1443 An AI response to a query does not provide an accurate confidence in the reasoning provided because the confidence value is fabricated X DFW-1444 An AI response to a question does not return a relevant event because it was not recognised as relevant X DFW-1445 An observation referred to in the reasoning provided by and AI system does not support the conclusions drawn because the system is unable to accurately reason with the observable data that is available but does so anyway X DFW-1446 An AI response to a question does not return a relevant link because it found something else relevant and stopped searching X DFW-1447 An AI response to a question does not return a relevant link because it could not correctly interpret the data needed to make the link X DFW-1448 An AI response to a question asserts a link that does not exist because because of model hallucinations X X DFW-1449 An AI response to a question asserts a link that does not exist because the supporting data was unreliable but that was not recognised X X DFW-1450 An AI response to a question does not return a relevant event because data needed to reconstruct the event was lost due to compression of the context X DFW-1451 An AI response to a question returns an event that did not occur because of model hallucinations X DFW-1452 An AI response to a question returns an event that did not occur because of an incorrect 'interpretation' of the meaning of some artifacts X DFW-1453 An AI response to a question returns an event that did not occur because the supporting data was unreliable, but that was not recognised X DFW-1454 An AI response to a question returns an event with one or more incorrect details because of model hallucinations X DFW-1455 An AI response to a question returns an event with one or more incorrect details because of an incorrect 'interpretation' of the meaning of some artifacts X DFW-1456 The decoded value is incorrect because the incorrect data type was applied for decoding X X DFW-1457 The integer decoded from some data is incorrect because the incorrect number of bytes was examined X X DFW-1458 The integer decoded from some data is incorrect because the endianness used was incorrect X X DFW-1459 The integer decoded from some data is incorrect because the decoding was signed not unsigned or vice versa X X DFW-1460 The integer decoded from some data is incorrect because it should have been decoded as a floating point number X X DFW-1461 The floating point number decoded from some data is incorrect because the incorrect number of bytes was examined X X DFW-1462 The floating point number decoded from some data is incorrect because the endianness used was incorrect X X DFW-1463 The floating point number decoded from some data is incorrect because the decoding was signed not unsigned or vice versa X X DFW-1464 The floating point number decoded from some data is incorrect because it should have been decoded as an integer X X DFW-1465 The floating point number decoded from some data is incorrect because the original value could not be fully represented within the bytes available X X DFW-1473 The examiner-entered metadata was not stored along with the forensic container because of a software error in the tool used X DFW-1474 The examiner-entered metadata was not stored along with the forensic container because the examiner did not enter the details X DFW-1475 The computed hash(s) were not stored along with the forensic container because of a software error in the tool used X DFW-1476 The examiner-entered metadata stored along with the forensic container is incorrect because of a software error in the tool used X X DFW-1477 The examiner-entered metadata stored along with the forensic container is incorrect because the examiner entered the wrong details X X DFW-1478 The computed hash(s) stored along with the forensic container is incorrect because of a software error in the tool used X