SOLVE-IT’s new citation model - introducing ‘DFCites’

SOLVE-IT has moved to a new format for references. Rather than the plaintext field used in the original publication we now support bibtex and as a fallback plaintext citation files. We also introduce the concept of a ‘relevance summary’ to ensure that references added to the knowledge base are easily reviewable for relevance by busy digital forensic examiners.

What’s changed?

The original scheme used a plaintext json field in techniques, weaknesses and mitigations. The example below shows DFT-1005 wth two references as simple plaintext strings.

{
    "id": "DFT-1005",
    "name": "Conduct a search of a crime scene",
    "description": "The process of 'carefully documenting the conditions at a crime scene and identifying all relevant physical evidence.' (Birzer 2018).",
    "synonyms": ["Crime scene investigation",
                 "Crime scene examination",
                 "Crime scene processing",
                 "Incident scene examination",
                 "Scene search"],
    "details": "The UK's Forensic Science Regulator (FSR) guidance refers to \"Incident scene examination\" which takes a holistic approach and considers an incident scene in conjunction with the requirements of an investigation and the criminal justice system. The aim of incident scene examination is to identify and locate, or note the absence of, physical material which has relevance and significance to inform the investigation including, where relevant, the reconstruction of past events.",
    "subtechniques": [],
    "examples": [],
    "weaknesses": ["W1114"],
    "CASE_input_classes" : [],
    "CASE_output_classes" : ["https://ontology.solveit-df.org/solveit/observable/DeviceSet",
                             "https://ontology.unifiedcyberontology.org/uco/observable/Device",                             
                             "https://ontology.unifiedcyberontology.org/uco/observable/location"],
    "references": [
        "Birzer, M.L., 2018. Crime Scene Search. Introduction to Criminal Investigation, p.35.",
        "Forensic Science Regulator (2025) Incident scene examination (FSR-GUI-0006). GOV.UK. Available at: https://www.gov.uk/government/publications/incident-scene-examination-fsr-gui-0006"]
}

Now, a new references folder exists under the /data section of the repository. This now contains .bib and .txt files named according to their DFCite IDs. The data folder now looks like this:

data
├── techniques
├── weaknesses
├── mitigations
├── references
│   ├── DFCite-1001.bib
│   ├── DFCite-1002.bib
│   ├── DFCite-1003.bib
│   ├── DFCite-1003.txt
│   ├── DFCite-1004.txt

These references can then be used in techniques, weaknesses and mitigations in the references section, but they are not just simple IDs instead of the original text, they are now JSON objects that need to contain the fields DFCite_id and relevance_summary_280. The former is the ID that is found in the filename of the .bib and .txt files. The later is a string of maximum length 280 characters that describes why the citation is relevant to the technique, weakness or mitigation that it is cited in.

For example the technique DFT-xxxx makes use of the citation above and refers to it like so:

{
    "id": "DFT-1005",
    "name": "Conduct a search of a crime scene",
    "description": "The process of 'carefully documenting the conditions at a crime scene and identifying all relevant physical evidence.' (Birzer 2018).",
    
    ...
    
    "references": [
        {
            "DFCite_id": "DFCite-1018",
            "relevance_summary_280": "Provides the definition used in the description of this technique."
        },
        {
            "DFCite_id": "DFCite-1044",
            "relevance_summary_280": "Provides an expanded definition considering the holistic approach of crime scene examination."
        }
    ]
}

Adding DFCites

DFCites can be added through the issue tracker.

Relevance summary strings can be easily added by following the ‘edit’ link from a reference in the SOLVE-IT Explorer or directly in a specific form in the Issue tracker.

The ‘edit’ link in the SOLVE-IT Explorer to add relevance summary strings.

References without summary strings will also be faded in the References section of the SOLVE-IT Explorer.

References without relevance summaries are faded in the Explorer, highlighting where contributions are needed.

Summary

This change improves the robustness of the citation system, allows different reference formats to be used, and also ensures that references in the knowledge base are not just about a topic, but they provide some practical benefit, or were used to define or explain the technique, weakness or mitigation.

The DFCite system should provide a curated, applied set of digital forensic references, structured around the specific digital forensic techniques indexed by SOLVE-IT.