SOLVE-IT eXtensions (SOLVE-IT-X)

Layering your own knowledge onto the core knowledge base

Introduction

SOLVE-IT covers core digital forensics knowledge, but organisations use different tools, training programmes have unique content, and research groups focus on specific areas. The SOLVE-IT-X extension framework lets you tailor the knowledge base to your specific operating context, overlaying your own data onto SOLVE-IT without modifying the core repository. You work from your own repository — structured as a template built on the SOLVE-IT-X framework — and write extension code that attaches your custom content to existing techniques, weaknesses, and mitigations at build time. You can keep your SOLVE-IT extensions private, or share them with others.

Using SOLVE-IT-X, gives you a custom version of the SOLVE-IT Explorer — a fully navigable, interactive HTML viewer — that presents the complete SOLVE-IT knowledge base with your additional content integrated directly into each item’s detail panel. Your extensions sit alongside the base knowledge, clearly distinguished, without affecting the shared knowledge base for anyone else. SOLVE-IT-X enables complete customisation, including hiding fields from the base data, applying custom status labels and colour coding, and presenting entirely new categories of information through whatever HTML, Markdown, or Excel output you need.

Extensions can Multiple SOLVE-IT extensions can be combined in a single build, and a configuration file controls which extensions are loaded and how they behave.

Once built, the resulting HTML viewer can be published via GitHub Pages, making it immediately accessible to your team, students, or community without requiring any additional infrastructure.

Use Case #1 Digital Forensic Laboratories

Every digital forensics laboratory operates with a specific set of technical solutions, operational procedures, and institutional knowledge that isn’t captured in the public core SOLVE-IT knowledge base. Some techniques are central to the laboratory’s work; others are rarely used. Certain weaknesses have established in-house mitigations that go beyond what’s documented publicly.

A SOLVE-IT-X extension gives a laboratory a private, navigable reference that layers this institutional knowledge directly onto the SOLVE-IT structure. For each technique, the extension can surface which tools the laboratory uses for that technique, any laboratory-specific validation procedures, notes on local configuration or known limitations, and links to internal documentation or procedures. For mitigations, it can record which have been formally implemented and in what form.

Because the extension lives in its own repository, it stays under the laboratory’s control — version-controlled, updatable, and invisible to the outside world if needed. As the core SOLVE-IT knowledge base grows and new techniques are added, the update script ensures the extension keeps pace.

The resulting Explorer matrix becomes a practical internal resource: staff can navigate the full technique hierarchy while seeing the laboratory’s own tooling and procedural context alongside the community knowledge.

Use Case #2 Digital Forensics Training

Training programmes rarely need to cover the entire SOLVE-IT knowledge base. A course on mobile device acquisition doesn’t need to surface file system analysis techniques at the same level of detail. Training content often needs to go beyond what is in the knowledge base — exercises, learning objectives, assessment criteria, illustrative case studies, or notes on common student misconceptions.

A SOLVE-IT-X extension lets a training provider build a version of the Explorer matrix tailored to a specific course or curriculum. Fields not relevant to the programme can be hidden in the configuration. Custom content — learning outcomes, exercise descriptions, worked examples — can be attached to each technique, weakness, or mitigation in the subset the course covers.

The result is a structured, browsable course companion that students can use to navigate the techniques they’re studying, with the educational context embedded directly rather than maintained as a separate document that quickly falls out of sync with the knowledge base. As the core knowledge base evolves and techniques are updated, the training extension can be updated in parallel, with the update script flagging any new entries that might be relevant to the curriculum.

Use Case #3 AI Applicability Review

The SOLVE-IT-X AI Applicability Review GitHub repo is a live example of what a substantive SOLVE-IT-X extension looks like in practice. It overlays a structured review of AI applicability across every technique in the knowledge base, tracking whether AI has been applied to each technique and at what level of maturity.

Each technique is categorised across four levels: AI capability already integrated into digital forensics tools (“In Tools”), published academic work with a working implementation (“Academic Implementation”), a proposed idea in the academic literature not yet implemented (“Academic Idea”), and an explicit determination that a non-AI approach is likely sufficient (“Non-AI”). The distinction between that last category and simply “Unassessed” is meaningful — Non-AI means someone has reviewed the technique and made a deliberate judgement, not that it has been overlooked.

The extension tracks assessment history — who assessed each technique and when — and uses this to colour-code techniques in the Explorer: recently assessed entries appear in green, previously assessed in blue, and unassessed in grey. This gives an at-a-glance picture of where the review effort is current and where it needs attention.

The built HTML output includes two documents: the interactive Explorer matrix where techniques display AI applicability badges alongside their standard SOLVE-IT content, and a standalone report organised by investigative objective that lists every technique with its full AI applicability entries and references.

Summary

The SOLVE-IT-X repository is a GitHub template, meaning you can create your own repository from it with a single click and start from a working example immediately. An extension is a folder structure that mirrors the layout of the SOLVE-IT knowledge base — a subfolder for every technique, weakness, and mitigation ID — into which you place your additional data files. The README walks through initialising an extension, writing your first extension_code.py, building locally, and deploying to GitHub Pages.

Any other questions feel free to use the SOLVE-IT-X section of the SOLVE-IT discussion forum.