SOLVE-IT Knowledge Base Changelog
July 2026
2026-07-16 Added technique (TRWM): Extract operating system installation date (DFT-1196) d3ae3a02026-07-15 Added technique (TRWM): Generate Alternative Hypotheses (DFT-1195) 43fedec2026-07-14 Updated weakness: Report generated from bookmarks stored in manner that does not prevent tampering or corruption (DFW-1154) 8107a7d2026-07-14 Added mitigation (AUTOIMPLEMENT): Cryptographically sign generated forensic analysis reports with an asymmetric key (DFM-1299) 36a1e402026-07-13 Added weakness (AUTOIMPLEMENT): Relevant keywords not returned by live search due to improper handling of character encoding (DFW-1378) eb24b222026-07-12 Added technique (AUTOIMPLEMENT): Classify if audio is potentially synthetically generated (DFT-1194) 70a2f1a2026-07-10 Updated technique: Collect data from cloud service via API using credentials (DFT-1161) 5531de12026-07-09 Added technique (TRWM): Read metadata from within a forensic image container (DFT-1193) 3557ded2026-07-09 Added technique (TRWM): Disable connectivity using device configuration settings (DFT-1192) ac383592026-07-09 Updated technique (AUTOIMPLEMENT): Keyword search (over extracted artifacts) (DFT-1151) 3449f562026-07-09 Updated technique (AUTOIMPLEMENT): Keyword search (over extracted artifacts) (DFT-1151) 3449f562026-07-09 Updated technique (AUTOIMPLEMENT): Keyword search (over extracted artifacts) (DFT-1151) 3449f562026-07-09 Updated technique (AUTOIMPLEMENT): Locate relevant files by path (DFT-1118) 46f83602026-07-09 Updated technique (AUTOIMPLEMENT): Locate relevant files by path (DFT-1118) 46f83602026-07-09 Updated technique (AUTOIMPLEMENT): Locate relevant files by path (DFT-1118) 46f83602026-07-09 Updated technique (AUTOIMPLEMENT): Document the chain of custody (DFT-1014) 113b2c62026-07-09 Updated technique (AUTOIMPLEMENT): Document the chain of custody (DFT-1014) 113b2c62026-07-09 Updated technique (AUTOIMPLEMENT): Document the chain of custody (DFT-1014) 113b2c62026-07-09 Updated technique (AUTOIMPLEMENT): Document the chain of custody (DFT-1014) 113b2c62026-07-07 Added weakness: Failing to acquire data because of filtering (DFW-1339) 94402a92026-07-07 Updated weakness: Failing to acquire data due to omission of undocumented endpoints (DFW-1338) d0f76492026-07-07 Updated weakness: Failing to acquire data due to omission of undocumented endpoints (DFW-1338) 1286a872026-07-07 Deleted weakness: Important traces of user activity may remain in API responses, but if related artefacts are not thoroughly analysed, critical forensic information may be missed or misinterpreted (DFW-1323) 94402a92026-07-07 Added technique (TRWM): Parse allocated structures in Windows HIVE files (DFT-1191) 85323962026-07-07 Added technique (TRWM): Parse allocated structures in Windows HIVE files (DFT-1191) 85323962026-07-07 Added technique (TRWM): Parse allocated structures in Windows HIVE files (DFT-1191) 85323962026-07-07 Added technique (TRWM): Parse allocated structures in Windows HIVE files (DFT-1191) 85323962026-07-07 Added technique (TRWM): Parse allocated structures in Windows HIVE files (DFT-1191) 85323962026-07-07 Updated technique: DFT-1161 125a6d82026-07-07 Updated technique: DFT-1161 3e7ce3b2026-07-07 Updated mitigation: Monitor structural changes to the target API and update parsing logic to prevent silent data loss (DFM-1277) 6d739c12026-07-07 Updated mitigation: Collect from all available API endpoints, including undocumented ones identified via client reverse engineering (DFM-1276) d376f2c2026-07-07 Updated reference: DFCite-1161 b33ea502026-07-07 Updated reference: DFCite-1160 b894ec72026-07-07 Updated reference: DFCite-1159 399ba6d2026-07-06 Added technique (TRWM): Extract operating system version(s) from data source (DFT-1190) 63fa5482026-07-06 Added technique (TRWM): Extract operating system version(s) from data source (DFT-1190) 63fa5482026-07-06 Added technique (TRWM): Extract operating system version(s) from data source (DFT-1190) 63fa5482026-07-06 Added technique (TRWM): Extract operating system version(s) from data source (DFT-1190) 63fa5482026-07-06 Added technique (TRWM): Extract operating system version(s) from data source (DFT-1190) 63fa548
June 2026
2026-06-30 Updated mitigation (AUTOIMPLEMENT): Testing to ensure that the software and hardware disk imaging setup can detect HPAs (DFM-1005) 42611092026-06-30 Updated mitigation (AUTOIMPLEMENT): Testing to ensure that the software and hardware disk imaging setup can detect HPAs (DFM-1005) 42611092026-06-30 Updated mitigation (AUTOIMPLEMENT): Testing to ensure that the software and hardware disk imaging setup can detect HPAs (DFM-1005) 42611092026-06-30 Updated mitigation (AUTOIMPLEMENT): Testing to ensure that the software and hardware disk imaging setup can detect HPAs (DFM-1005) 42611092026-06-30 Updated mitigation (AUTOIMPLEMENT): Testing to ensure that the software and hardware disk imaging setup can detect HPAs (DFM-1005) 42611092026-06-26 Updated weakness: Inability to enable required service due to locked device (DFW-1274) c27d9872026-06-26 Updated weakness: Inability to enable required service due to locked device (DFW-1274) c27d9872026-06-26 Updated weakness: Inability to enable required service due to locked device (DFW-1274) c27d9872026-06-26 Updated weakness: Inability to enable required service due to locked device (DFW-1274) c27d9872026-06-26 Updated weakness: Inability to enable required service due to locked device (DFW-1274) c27d9872026-06-26 Updated technique: Extract data from operating system notifications (DFT-1185) 56b751a2026-06-26 Updated technique: Extract data from operating system notifications (DFT-1185) 56b751a2026-06-26 Updated technique: Extract data from operating system notifications (DFT-1185) 56b751a2026-06-26 Updated technique: Extract data from operating system notifications (DFT-1185) 56b751a2026-06-26 Updated technique: Extract data from operating system notifications (DFT-1185) 56b751a2026-06-26 Updated technique: Extract data from operating system notifications (DFT-1185) 56b751a2026-06-26 Updated technique: Sort a timeline so entries are ordered chronologically (DFT-1184) da638e52026-06-26 Updated technique: Sort a timeline so entries are ordered chronologically (DFT-1184) da638e52026-06-26 Updated technique: Sort a timeline so entries are ordered chronologically (DFT-1184) da638e52026-06-26 Updated technique: Sort a timeline so entries are ordered chronologically (DFT-1184) da638e52026-06-26 Updated technique: Sort a timeline so entries are ordered chronologically (DFT-1184) da638e52026-06-26 Updated technique: Sort a timeline so entries are ordered chronologically (DFT-1184) da638e52026-06-26 Updated technique: Filter a timeline for relevant entries (DFT-1182) 0aa8d5f2026-06-26 Updated technique: Filter a timeline for relevant entries (DFT-1182) 0aa8d5f2026-06-26 Updated technique: Filter a timeline for relevant entries (DFT-1182) 0aa8d5f2026-06-26 Updated technique: Filter a timeline for relevant entries (DFT-1182) 0aa8d5f2026-06-26 Updated technique: Filter a timeline for relevant entries (DFT-1182) 0aa8d5f2026-06-26 Updated technique: Filter a timeline for relevant entries (DFT-1182) 0aa8d5f2026-06-26 Updated technique: Extract artifacts from smart home app(s) (DFT-1181) 25673942026-06-26 Updated technique: Extract artifacts from smart home app(s) (DFT-1181) 25673942026-06-26 Updated technique: Extract artifacts from smart home app(s) (DFT-1181) 25673942026-06-26 Updated technique: Extract artifacts from smart home app(s) (DFT-1181) 25673942026-06-26 Updated technique: Extract artifacts from smart home app(s) (DFT-1181) 25673942026-06-26 Updated technique: Extract artifacts from smart home app(s) (DFT-1181) 25673942026-06-26 Updated technique: Extract artifacts from drone/UAV app(s) (DFT-1179) 49cb7cc2026-06-26 Updated technique: Extract artifacts from drone/UAV app(s) (DFT-1179) 49cb7cc2026-06-26 Updated technique: Extract artifacts from drone/UAV app(s) (DFT-1179) 49cb7cc2026-06-26 Updated technique: Extract artifacts from drone/UAV app(s) (DFT-1179) 49cb7cc2026-06-26 Updated technique: Extract artifacts from drone/UAV app(s) (DFT-1179) 49cb7cc2026-06-26 Updated technique: Extract artifacts from drone/UAV app(s) (DFT-1179) 49cb7cc2026-06-26 Updated technique: Store bitstream data in a raw image format (DFT-1178) 85be12e2026-06-26 Updated technique: Store bitstream data in a raw image format (DFT-1178) 85be12e2026-06-26 Updated technique: Store bitstream data in a raw image format (DFT-1178) 85be12e2026-06-26 Updated technique: Store bitstream data in a raw image format (DFT-1178) 85be12e2026-06-26 Updated technique: Store bitstream data in a raw image format (DFT-1178) 85be12e2026-06-26 Updated technique: Store bitstream data in a raw image format (DFT-1178) 85be12e2026-06-26 Updated technique: Extract artifacts from multiplayer game app(s) (DFT-1177) ff2c0872026-06-26 Updated technique: Extract artifacts from multiplayer game app(s) (DFT-1177) ff2c0872026-06-26 Updated technique: Extract artifacts from multiplayer game app(s) (DFT-1177) ff2c0872026-06-26 Updated technique: Extract artifacts from multiplayer game app(s) (DFT-1177) ff2c0872026-06-26 Updated technique: Extract artifacts from multiplayer game app(s) (DFT-1177) ff2c0872026-06-26 Updated technique: Extract artifacts from multiplayer game app(s) (DFT-1177) ff2c0872026-06-26 Updated technique: Classify if an image is potentially synthetically generated (DFT-1176) b23fde92026-06-26 Updated technique: Classify if an image is potentially synthetically generated (DFT-1176) b23fde92026-06-26 Updated technique: Classify if an image is potentially synthetically generated (DFT-1176) b23fde92026-06-26 Updated technique: Classify if an image is potentially synthetically generated (DFT-1176) b23fde92026-06-26 Updated technique: Classify if an image is potentially synthetically generated (DFT-1176) b23fde92026-06-26 Updated technique: Classify if an image is potentially synthetically generated (DFT-1176) b23fde92026-06-26 Updated technique: Extract data from an Android device using content queries (DFT-1175) c064ce62026-06-26 Updated technique: Extract data from an Android device using content queries (DFT-1175) c064ce62026-06-26 Updated technique: Extract data from an Android device using content queries (DFT-1175) c064ce62026-06-26 Updated technique: Extract data from an Android device using content queries (DFT-1175) c064ce62026-06-26 Updated technique: Extract data from an Android device using content queries (DFT-1175) c064ce62026-06-26 Updated technique: Extract data from an Android device using content queries (DFT-1175) c064ce62026-06-26 Updated technique: Read evidential files stored directly on local file system (DFT-1174) 081ecd82026-06-26 Updated technique: Read evidential files stored directly on local file system (DFT-1174) 081ecd82026-06-26 Updated technique: Read evidential files stored directly on local file system (DFT-1174) 081ecd82026-06-26 Updated technique: Read evidential files stored directly on local file system (DFT-1174) 081ecd82026-06-26 Updated technique: Read evidential files stored directly on local file system (DFT-1174) 081ecd82026-06-26 Updated technique: Read evidential files stored directly on local file system (DFT-1174) 081ecd82026-06-26 Updated technique: Read bitstream from raw image file(s) (DFT-1172) a7eaf992026-06-26 Updated technique: Read bitstream from raw image file(s) (DFT-1172) a7eaf992026-06-26 Updated technique: Read bitstream from raw image file(s) (DFT-1172) a7eaf992026-06-26 Updated technique: Read bitstream from raw image file(s) (DFT-1172) a7eaf992026-06-26 Updated technique: Read bitstream from raw image file(s) (DFT-1172) a7eaf992026-06-26 Updated technique: Read bitstream from raw image file(s) (DFT-1172) a7eaf992026-06-26 Updated technique: Access a file system via live operating system (DFT-1171) 41854d02026-06-26 Updated technique: Access a file system via live operating system (DFT-1171) 41854d02026-06-26 Updated technique: Access a file system via live operating system (DFT-1171) 41854d02026-06-26 Updated technique: Access a file system via live operating system (DFT-1171) 41854d02026-06-26 Updated technique: Access a file system via live operating system (DFT-1171) 41854d02026-06-26 Updated technique: Access a file system via live operating system (DFT-1171) 41854d02026-06-26 Updated technique: Read contents from logical forensic container file(s) (DFT-1170) 12050ab2026-06-26 Updated technique: Read contents from logical forensic container file(s) (DFT-1170) 12050ab2026-06-26 Updated technique: Read contents from logical forensic container file(s) (DFT-1170) 12050ab2026-06-26 Updated technique: Read contents from logical forensic container file(s) (DFT-1170) 12050ab2026-06-26 Updated technique: Read contents from logical forensic container file(s) (DFT-1170) 12050ab2026-06-26 Updated technique: Read contents from logical forensic container file(s) (DFT-1170) 12050ab2026-06-26 Updated technique: Read data directly from a block device (DFT-1164) ef4d6ab2026-06-26 Updated technique: Read data directly from a block device (DFT-1164) ef4d6ab2026-06-26 Updated technique: Read data directly from a block device (DFT-1164) ef4d6ab2026-06-26 Updated technique: Read data directly from a block device (DFT-1164) ef4d6ab2026-06-26 Updated technique: Read data directly from a block device (DFT-1164) ef4d6ab2026-06-26 Updated technique: Read data directly from a block device (DFT-1164) ef4d6ab2026-06-26 Updated technique: Capture mobile device screenshots (automatically) (DFT-1163) c2396892026-06-26 Updated technique: Capture mobile device screenshots (automatically) (DFT-1163) c2396892026-06-26 Updated technique: Capture mobile device screenshots (automatically) (DFT-1163) c2396892026-06-26 Updated technique: Capture mobile device screenshots (automatically) (DFT-1163) c2396892026-06-26 Updated technique: Capture mobile device screenshots (automatically) (DFT-1163) c2396892026-06-26 Updated technique: Capture mobile device screenshots (automatically) (DFT-1163) c2396892026-06-26 Updated technique: Reconstruct if an event could have functionally occurred on a system given its capabilities (DFT-1156) 2a212542026-06-26 Updated technique: Reconstruct if an event could have functionally occurred on a system given its capabilities (DFT-1156) 2a212542026-06-26 Updated technique: Reconstruct if an event could have functionally occurred on a system given its capabilities (DFT-1156) 2a212542026-06-26 Updated technique: Reconstruct if an event could have functionally occurred on a system given its capabilities (DFT-1156) 2a212542026-06-26 Updated technique: Reconstruct if an event could have functionally occurred on a system given its capabilities (DFT-1156) 2a212542026-06-26 Updated technique: Reconstruct if an event could have functionally occurred on a system given its capabilities (DFT-1156) 2a212542026-06-26 Updated technique: Reconstruct that a specific event may have occurred (DFT-1155) 2a212542026-06-26 Updated technique: Reconstruct that a specific event may have occurred (DFT-1155) 2a212542026-06-26 Updated technique: Reconstruct that a specific event may have occurred (DFT-1155) 2a212542026-06-26 Updated technique: Reconstruct that a specific event may have occurred (DFT-1155) 2a212542026-06-26 Updated technique: Reconstruct that a specific event may have occurred (DFT-1155) 2a212542026-06-26 Updated technique: Reconstruct that a specific event may have occurred (DFT-1155) 2a212542026-06-26 Updated technique: Reconstruct an identity associated with an event (DFT-1154) 2a212542026-06-26 Updated technique: Reconstruct an identity associated with an event (DFT-1154) 2a212542026-06-26 Updated technique: Reconstruct an identity associated with an event (DFT-1154) 2a212542026-06-26 Updated technique: Reconstruct an identity associated with an event (DFT-1154) 2a212542026-06-26 Updated technique: Reconstruct an identity associated with an event (DFT-1154) 2a212542026-06-26 Updated technique: Reconstruct an identity associated with an event (DFT-1154) 2a212542026-06-26 Updated technique: Extract artifacts from the file versioning feature (DFT-1149) ce507102026-06-26 Updated technique: Extract artifacts from the file versioning feature (DFT-1149) ce507102026-06-26 Updated technique: Extract artifacts from the file versioning feature (DFT-1149) ce507102026-06-26 Updated technique: Extract artifacts from the file versioning feature (DFT-1149) ce507102026-06-26 Updated technique: Extract artifacts from the file versioning feature (DFT-1149) ce507102026-06-26 Updated technique: Extract artifacts from the file versioning feature (DFT-1149) ce507102026-06-26 Updated technique: Extract browser web storage artifacts (DFT-1148) f122fa12026-06-26 Updated technique: Extract browser web storage artifacts (DFT-1148) f122fa12026-06-26 Updated technique: Extract browser web storage artifacts (DFT-1148) f122fa12026-06-26 Updated technique: Extract browser web storage artifacts (DFT-1148) f122fa12026-06-26 Updated technique: Extract browser web storage artifacts (DFT-1148) f122fa12026-06-26 Updated technique: Extract browser web storage artifacts (DFT-1148) f122fa12026-06-26 Updated technique: Extract browser cookie artifacts (DFT-1147) f122fa12026-06-26 Updated technique: Extract browser cookie artifacts (DFT-1147) f122fa12026-06-26 Updated technique: Extract browser cookie artifacts (DFT-1147) f122fa12026-06-26 Updated technique: Extract browser cookie artifacts (DFT-1147) f122fa12026-06-26 Updated technique: Extract browser cookie artifacts (DFT-1147) f122fa12026-06-26 Updated technique: Extract browser cookie artifacts (DFT-1147) f122fa12026-06-26 Updated technique: Extract browser synchronization artifacts (DFT-1146) f122fa12026-06-26 Updated technique: Extract browser synchronization artifacts (DFT-1146) f122fa12026-06-26 Updated technique: Extract browser synchronization artifacts (DFT-1146) f122fa12026-06-26 Updated technique: Extract browser synchronization artifacts (DFT-1146) f122fa12026-06-26 Updated technique: Extract browser synchronization artifacts (DFT-1146) f122fa12026-06-26 Updated technique: Extract browser synchronization artifacts (DFT-1146) f122fa12026-06-26 Updated technique: Extract browser extensions artifacts (DFT-1145) f122fa12026-06-26 Updated technique: Extract browser extensions artifacts (DFT-1145) f122fa12026-06-26 Updated technique: Extract browser extensions artifacts (DFT-1145) f122fa12026-06-26 Updated technique: Extract browser extensions artifacts (DFT-1145) f122fa12026-06-26 Updated technique: Extract browser extensions artifacts (DFT-1145) f122fa12026-06-26 Updated technique: Extract browser extensions artifacts (DFT-1145) f122fa12026-06-26 Updated technique: Enumerate browser profiles (DFT-1144) f122fa12026-06-26 Updated technique: Enumerate browser profiles (DFT-1144) f122fa12026-06-26 Updated technique: Enumerate browser profiles (DFT-1144) f122fa12026-06-26 Updated technique: Enumerate browser profiles (DFT-1144) f122fa12026-06-26 Updated technique: Enumerate browser profiles (DFT-1144) f122fa12026-06-26 Updated technique: Enumerate browser profiles (DFT-1144) f122fa12026-06-26 Updated technique: Extract browser configuration artifacts (DFT-1143) f122fa12026-06-26 Updated technique: Extract browser configuration artifacts (DFT-1143) f122fa12026-06-26 Updated technique: Extract browser configuration artifacts (DFT-1143) f122fa12026-06-26 Updated technique: Extract browser configuration artifacts (DFT-1143) f122fa12026-06-26 Updated technique: Extract browser configuration artifacts (DFT-1143) f122fa12026-06-26 Updated technique: Extract browser configuration artifacts (DFT-1143) f122fa12026-06-26 Updated technique: Extract browser download artifacts (DFT-1142) f122fa12026-06-26 Updated technique: Extract browser download artifacts (DFT-1142) f122fa12026-06-26 Updated technique: Extract browser download artifacts (DFT-1142) f122fa12026-06-26 Updated technique: Extract browser download artifacts (DFT-1142) f122fa12026-06-26 Updated technique: Extract browser download artifacts (DFT-1142) f122fa12026-06-26 Updated technique: Extract browser download artifacts (DFT-1142) f122fa12026-06-26 Updated technique: Extract browser bookmark artifacts (DFT-1141) f122fa12026-06-26 Updated technique: Extract browser bookmark artifacts (DFT-1141) f122fa12026-06-26 Updated technique: Extract browser bookmark artifacts (DFT-1141) f122fa12026-06-26 Updated technique: Extract browser bookmark artifacts (DFT-1141) f122fa12026-06-26 Updated technique: Extract browser bookmark artifacts (DFT-1141) f122fa12026-06-26 Updated technique: Extract browser bookmark artifacts (DFT-1141) f122fa12026-06-26 Updated technique: Extract browser autofill artifacts (DFT-1140) f122fa12026-06-26 Updated technique: Extract browser autofill artifacts (DFT-1140) f122fa12026-06-26 Updated technique: Extract browser autofill artifacts (DFT-1140) f122fa12026-06-26 Updated technique: Extract browser autofill artifacts (DFT-1140) f122fa12026-06-26 Updated technique: Extract browser autofill artifacts (DFT-1140) f122fa12026-06-26 Updated technique: Extract browser autofill artifacts (DFT-1140) f122fa12026-06-26 Updated technique: Extract browser session artifacts (DFT-1139) f122fa12026-06-26 Updated technique: Extract browser session artifacts (DFT-1139) f122fa12026-06-26 Updated technique: Extract browser session artifacts (DFT-1139) f122fa12026-06-26 Updated technique: Extract browser session artifacts (DFT-1139) f122fa12026-06-26 Updated technique: Extract browser session artifacts (DFT-1139) f122fa12026-06-26 Updated technique: Extract browser session artifacts (DFT-1139) f122fa12026-06-26 Updated technique: Extract browser cache artifacts (DFT-1138) f122fa12026-06-26 Updated technique: Extract browser cache artifacts (DFT-1138) f122fa12026-06-26 Updated technique: Extract browser cache artifacts (DFT-1138) f122fa12026-06-26 Updated technique: Extract browser cache artifacts (DFT-1138) f122fa12026-06-26 Updated technique: Extract browser cache artifacts (DFT-1138) f122fa12026-06-26 Updated technique: Extract browser cache artifacts (DFT-1138) f122fa12026-06-26 Updated technique: Extract browser history artifacts (DFT-1137) f122fa12026-06-26 Updated technique: Extract browser history artifacts (DFT-1137) f122fa12026-06-26 Updated technique: Extract browser history artifacts (DFT-1137) f122fa12026-06-26 Updated technique: Extract browser history artifacts (DFT-1137) f122fa12026-06-26 Updated technique: Extract browser history artifacts (DFT-1137) f122fa12026-06-26 Updated technique: Extract browser history artifacts (DFT-1137) f122fa12026-06-26 Updated technique: Extract artifacts from AI companion app(s) (DFT-1133) e7247912026-06-26 Updated technique: Extract artifacts from AI companion app(s) (DFT-1133) e7247912026-06-26 Updated technique: Extract artifacts from AI companion app(s) (DFT-1133) e7247912026-06-26 Updated technique: Extract artifacts from AI companion app(s) (DFT-1133) e7247912026-06-26 Updated technique: Extract artifacts from AI companion app(s) (DFT-1133) e7247912026-06-26 Updated technique: Extract artifacts from AI companion app(s) (DFT-1133) e7247912026-06-26 Updated technique: Index a data source for keyword searching (DFT-1121) e7247912026-06-26 Updated technique: Index a data source for keyword searching (DFT-1121) e7247912026-06-26 Updated technique: Index a data source for keyword searching (DFT-1121) e7247912026-06-26 Updated technique: Index a data source for keyword searching (DFT-1121) e7247912026-06-26 Updated technique: Index a data source for keyword searching (DFT-1121) e7247912026-06-26 Updated technique: Index a data source for keyword searching (DFT-1121) e7247912026-06-26 Updated technique: Extract artifacts from app data automatically (DFT-1120) e7247912026-06-26 Updated technique: Extract artifacts from app data automatically (DFT-1120) e7247912026-06-26 Updated technique: Extract artifacts from app data automatically (DFT-1120) e7247912026-06-26 Updated technique: Extract artifacts from app data automatically (DFT-1120) e7247912026-06-26 Updated technique: Extract artifacts from app data automatically (DFT-1120) e7247912026-06-26 Updated technique: Extract artifacts from app data automatically (DFT-1120) e7247912026-06-26 Updated technique: Locate relevant files by path (DFT-1118) 41854d02026-06-26 Updated technique: Locate relevant files by path (DFT-1118) 41854d02026-06-26 Updated technique: Locate relevant files by path (DFT-1118) 41854d02026-06-26 Updated technique: Locate relevant files by path (DFT-1118) 41854d02026-06-26 Updated technique: Locate relevant files by path (DFT-1118) 41854d02026-06-26 Updated technique: Locate relevant files by path (DFT-1118) 41854d02026-06-26 Updated technique: Reconstruct the time that an event may have occurred (DFT-1117) 2a212542026-06-26 Updated technique: Reconstruct the time that an event may have occurred (DFT-1117) 2a212542026-06-26 Updated technique: Reconstruct the time that an event may have occurred (DFT-1117) 2a212542026-06-26 Updated technique: Reconstruct the time that an event may have occurred (DFT-1117) 2a212542026-06-26 Updated technique: Reconstruct the time that an event may have occurred (DFT-1117) 2a212542026-06-26 Updated technique: Reconstruct the time that an event may have occurred (DFT-1117) 2a212542026-06-26 Updated technique: Extract references to connected devices (DFT-1116) 41854d02026-06-26 Updated technique: Extract references to connected devices (DFT-1116) 41854d02026-06-26 Updated technique: Extract references to connected devices (DFT-1116) 41854d02026-06-26 Updated technique: Extract references to connected devices (DFT-1116) 41854d02026-06-26 Updated technique: Extract references to connected devices (DFT-1116) 41854d02026-06-26 Updated technique: Extract references to connected devices (DFT-1116) 41854d02026-06-26 Updated technique: Visualize geolocation information (DFT-1115) e7247912026-06-26 Updated technique: Visualize geolocation information (DFT-1115) e7247912026-06-26 Updated technique: Visualize geolocation information (DFT-1115) e7247912026-06-26 Updated technique: Visualize geolocation information (DFT-1115) e7247912026-06-26 Updated technique: Visualize geolocation information (DFT-1115) e7247912026-06-26 Updated technique: Visualize geolocation information (DFT-1115) e7247912026-06-26 Updated technique: Preserve memory contents via Cold Boot Attack (DFT-1114) 286d7a52026-06-26 Updated technique: Preserve memory contents via Cold Boot Attack (DFT-1114) 286d7a52026-06-26 Updated technique: Preserve memory contents via Cold Boot Attack (DFT-1114) 286d7a52026-06-26 Updated technique: Preserve memory contents via Cold Boot Attack (DFT-1114) 286d7a52026-06-26 Updated technique: Preserve memory contents via Cold Boot Attack (DFT-1114) 286d7a52026-06-26 Updated technique: Preserve memory contents via Cold Boot Attack (DFT-1114) 286d7a52026-06-26 Updated technique: Locate and remove physical disks from a device (DFT-1112) 7feab462026-06-26 Updated technique: Locate and remove physical disks from a device (DFT-1112) 7feab462026-06-26 Updated technique: Locate and remove physical disks from a device (DFT-1112) 7feab462026-06-26 Updated technique: Locate and remove physical disks from a device (DFT-1112) 7feab462026-06-26 Updated technique: Locate and remove physical disks from a device (DFT-1112) 7feab462026-06-26 Updated technique: Locate and remove physical disks from a device (DFT-1112) 7feab462026-06-26 Updated technique: Record system clock offset (DFT-1111) e7247912026-06-26 Updated technique: Record system clock offset (DFT-1111) e7247912026-06-26 Updated technique: Record system clock offset (DFT-1111) e7247912026-06-26 Updated technique: Record system clock offset (DFT-1111) e7247912026-06-26 Updated technique: Record system clock offset (DFT-1111) e7247912026-06-26 Updated technique: Record system clock offset (DFT-1111) e7247912026-06-26 Updated technique: Preserve reference data (DFT-1110) e7247912026-06-26 Updated technique: Preserve reference data (DFT-1110) e7247912026-06-26 Updated technique: Preserve reference data (DFT-1110) e7247912026-06-26 Updated technique: Preserve reference data (DFT-1110) e7247912026-06-26 Updated technique: Preserve reference data (DFT-1110) e7247912026-06-26 Updated technique: Preserve reference data (DFT-1110) e7247912026-06-26 Updated technique: Extract artifacts from payment app(s) (DFT-1109) e7247912026-06-26 Updated technique: Extract artifacts from payment app(s) (DFT-1109) e7247912026-06-26 Updated technique: Extract artifacts from payment app(s) (DFT-1109) e7247912026-06-26 Updated technique: Extract artifacts from payment app(s) (DFT-1109) e7247912026-06-26 Updated technique: Extract artifacts from payment app(s) (DFT-1109) e7247912026-06-26 Updated technique: Extract artifacts from payment app(s) (DFT-1109) e7247912026-06-26 Updated technique: Extract artifacts from reminders app(s) (DFT-1108) e7247912026-06-26 Updated technique: Extract artifacts from reminders app(s) (DFT-1108) e7247912026-06-26 Updated technique: Extract artifacts from reminders app(s) (DFT-1108) e7247912026-06-26 Updated technique: Extract artifacts from reminders app(s) (DFT-1108) e7247912026-06-26 Updated technique: Extract artifacts from reminders app(s) (DFT-1108) e7247912026-06-26 Updated technique: Extract artifacts from reminders app(s) (DFT-1108) e7247912026-06-26 Updated technique: Extract artifacts from health/fitness app(s) (DFT-1107) e7247912026-06-26 Updated technique: Extract artifacts from health/fitness app(s) (DFT-1107) e7247912026-06-26 Updated technique: Extract artifacts from health/fitness app(s) (DFT-1107) e7247912026-06-26 Updated technique: Extract artifacts from health/fitness app(s) (DFT-1107) e7247912026-06-26 Updated technique: Extract artifacts from health/fitness app(s) (DFT-1107) e7247912026-06-26 Updated technique: Extract artifacts from health/fitness app(s) (DFT-1107) e7247912026-06-26 Updated technique: Classify if a video is potentially synthetically generated (DFT-1106) b23fde92026-06-26 Updated technique: Classify if a video is potentially synthetically generated (DFT-1106) b23fde92026-06-26 Updated technique: Classify if a video is potentially synthetically generated (DFT-1106) b23fde92026-06-26 Updated technique: Classify if a video is potentially synthetically generated (DFT-1106) b23fde92026-06-26 Updated technique: Classify if a video is potentially synthetically generated (DFT-1106) b23fde92026-06-26 Updated technique: Classify if a video is potentially synthetically generated (DFT-1106) b23fde92026-06-26 Updated technique: Examine memory dump from an application (DFT-1105) 498c5e42026-06-26 Updated technique: Examine memory dump from an application (DFT-1105) 498c5e42026-06-26 Updated technique: Examine memory dump from an application (DFT-1105) 498c5e42026-06-26 Updated technique: Examine memory dump from an application (DFT-1105) 498c5e42026-06-26 Updated technique: Examine memory dump from an application (DFT-1105) 498c5e42026-06-26 Updated technique: Examine memory dump from an application (DFT-1105) 498c5e42026-06-26 Updated technique: Virtualize suspect system for previewing (DFT-1103) ab3db762026-06-26 Updated technique: Virtualize suspect system for previewing (DFT-1103) ab3db762026-06-26 Updated technique: Virtualize suspect system for previewing (DFT-1103) ab3db762026-06-26 Updated technique: Virtualize suspect system for previewing (DFT-1103) ab3db762026-06-26 Updated technique: Virtualize suspect system for previewing (DFT-1103) ab3db762026-06-26 Updated technique: Virtualize suspect system for previewing (DFT-1103) ab3db762026-06-26 Updated technique: Decode data extracted from unmanaged NAND (DFT-1102) 6454efb2026-06-26 Updated technique: Decode data extracted from unmanaged NAND (DFT-1102) 6454efb2026-06-26 Updated technique: Decode data extracted from unmanaged NAND (DFT-1102) 6454efb2026-06-26 Updated technique: Decode data extracted from unmanaged NAND (DFT-1102) 6454efb2026-06-26 Updated technique: Decode data extracted from unmanaged NAND (DFT-1102) 6454efb2026-06-26 Updated technique: Decode data extracted from unmanaged NAND (DFT-1102) 6454efb2026-06-26 Updated technique: Conduct cell site survey (DFT-1101) 18407762026-06-26 Updated technique: Conduct cell site survey (DFT-1101) 18407762026-06-26 Updated technique: Conduct cell site survey (DFT-1101) 18407762026-06-26 Updated technique: Conduct cell site survey (DFT-1101) 18407762026-06-26 Updated technique: Conduct cell site survey (DFT-1101) 18407762026-06-26 Updated technique: Conduct cell site survey (DFT-1101) 18407762026-06-26 Updated technique: Extract metadata from within images (DFT-1100) 8024f0d2026-06-26 Updated technique: Extract metadata from within images (DFT-1100) 8024f0d2026-06-26 Updated technique: Extract metadata from within images (DFT-1100) 8024f0d2026-06-26 Updated technique: Extract metadata from within images (DFT-1100) 8024f0d2026-06-26 Updated technique: Extract metadata from within images (DFT-1100) 8024f0d2026-06-26 Updated technique: Extract metadata from within images (DFT-1100) 8024f0d2026-06-26 Updated technique: Repair a damaged or incomplete file using grafting (DFT-1099) 6c9589f2026-06-26 Updated technique: Repair a damaged or incomplete file using grafting (DFT-1099) 6c9589f2026-06-26 Updated technique: Repair a damaged or incomplete file using grafting (DFT-1099) 6c9589f2026-06-26 Updated technique: Repair a damaged or incomplete file using grafting (DFT-1099) 6c9589f2026-06-26 Updated technique: Repair a damaged or incomplete file using grafting (DFT-1099) 6c9589f2026-06-26 Updated technique: Repair a damaged or incomplete file using grafting (DFT-1099) 6c9589f2026-06-26 Updated technique: Enumerate operating system user accounts (DFT-1098) 64451ab2026-06-26 Updated technique: Enumerate operating system user accounts (DFT-1098) 64451ab2026-06-26 Updated technique: Enumerate operating system user accounts (DFT-1098) 64451ab2026-06-26 Updated technique: Enumerate operating system user accounts (DFT-1098) 64451ab2026-06-26 Updated technique: Enumerate operating system user accounts (DFT-1098) 64451ab2026-06-26 Updated technique: Enumerate operating system user accounts (DFT-1098) 64451ab2026-06-26 Updated technique: Extract operating system artifacts indicating installed software (DFT-1097) ab55aeb2026-06-26 Updated technique: Extract operating system artifacts indicating installed software (DFT-1097) ab55aeb2026-06-26 Updated technique: Extract operating system artifacts indicating installed software (DFT-1097) ab55aeb2026-06-26 Updated technique: Extract operating system artifacts indicating installed software (DFT-1097) ab55aeb2026-06-26 Updated technique: Extract operating system artifacts indicating installed software (DFT-1097) ab55aeb2026-06-26 Updated technique: Extract operating system artifacts indicating installed software (DFT-1097) ab55aeb2026-06-26 Updated technique: Extract operating system artifacts indicating program execution (DFT-1096) 643136e2026-06-26 Updated technique: Extract operating system artifacts indicating program execution (DFT-1096) 643136e2026-06-26 Updated technique: Extract operating system artifacts indicating program execution (DFT-1096) 643136e2026-06-26 Updated technique: Extract operating system artifacts indicating program execution (DFT-1096) 643136e2026-06-26 Updated technique: Extract operating system artifacts indicating program execution (DFT-1096) 643136e2026-06-26 Updated technique: Extract operating system artifacts indicating program execution (DFT-1096) 643136e2026-06-26 Updated technique: Instrument a piece of running software (DFT-1095) 4ba7fbb2026-06-26 Updated technique: Instrument a piece of running software (DFT-1095) 4ba7fbb2026-06-26 Updated technique: Instrument a piece of running software (DFT-1095) 4ba7fbb2026-06-26 Updated technique: Instrument a piece of running software (DFT-1095) 4ba7fbb2026-06-26 Updated technique: Instrument a piece of running software (DFT-1095) 4ba7fbb2026-06-26 Updated technique: Instrument a piece of running software (DFT-1095) 4ba7fbb2026-06-26 Updated technique: Disclose investigation material to an authorized legal authority (DFT-1094) 44f672f2026-06-26 Updated technique: Disclose investigation material to an authorized legal authority (DFT-1094) 44f672f2026-06-26 Updated technique: Disclose investigation material to an authorized legal authority (DFT-1094) 44f672f2026-06-26 Updated technique: Disclose investigation material to an authorized legal authority (DFT-1094) 44f672f2026-06-26 Updated technique: Disclose investigation material to an authorized legal authority (DFT-1094) 44f672f2026-06-26 Updated technique: Disclose investigation material to an authorized legal authority (DFT-1094) 44f672f2026-06-26 Updated technique: Generate tag-based automated report (DFT-1092) 1abb27d2026-06-26 Updated technique: Generate tag-based automated report (DFT-1092) 1abb27d2026-06-26 Updated technique: Generate tag-based automated report (DFT-1092) 1abb27d2026-06-26 Updated technique: Generate tag-based automated report (DFT-1092) 1abb27d2026-06-26 Updated technique: Generate tag-based automated report (DFT-1092) 1abb27d2026-06-26 Updated technique: Generate tag-based automated report (DFT-1092) 1abb27d2026-06-26 Updated technique: Tag artifacts (DFT-1091) 1abb27d2026-06-26 Updated technique: Tag artifacts (DFT-1091) 1abb27d2026-06-26 Updated technique: Tag artifacts (DFT-1091) 1abb27d2026-06-26 Updated technique: Tag artifacts (DFT-1091) 1abb27d2026-06-26 Updated technique: Tag artifacts (DFT-1091) 1abb27d2026-06-26 Updated technique: Tag artifacts (DFT-1091) 1abb27d2026-06-26 Updated technique: Experiment with software to ascertain forensic artifacts (DFT-1090) 768712f2026-06-26 Updated technique: Experiment with software to ascertain forensic artifacts (DFT-1090) 768712f2026-06-26 Updated technique: Experiment with software to ascertain forensic artifacts (DFT-1090) 768712f2026-06-26 Updated technique: Experiment with software to ascertain forensic artifacts (DFT-1090) 768712f2026-06-26 Updated technique: Experiment with software to ascertain forensic artifacts (DFT-1090) 768712f2026-06-26 Updated technique: Experiment with software to ascertain forensic artifacts (DFT-1090) 768712f2026-06-26 Updated technique: Review source code of software (DFT-1089) 443948d2026-06-26 Updated technique: Review source code of software (DFT-1089) 443948d2026-06-26 Updated technique: Review source code of software (DFT-1089) 443948d2026-06-26 Updated technique: Review source code of software (DFT-1089) 443948d2026-06-26 Updated technique: Review source code of software (DFT-1089) 443948d2026-06-26 Updated technique: Review source code of software (DFT-1089) 443948d2026-06-26 Updated technique: Reconstruct an relations between events properties of events (DFT-1088) 2a212542026-06-26 Updated technique: Reconstruct an relations between events properties of events (DFT-1088) 2a212542026-06-26 Updated technique: Reconstruct an relations between events properties of events (DFT-1088) 2a212542026-06-26 Updated technique: Reconstruct an relations between events properties of events (DFT-1088) 2a212542026-06-26 Updated technique: Reconstruct an relations between events properties of events (DFT-1088) 2a212542026-06-26 Updated technique: Reconstruct an relations between events properties of events (DFT-1088) 2a212542026-06-26 Updated technique: Reconstruct the location-based properties of an event (DFT-1087) 2a212542026-06-26 Updated technique: Reconstruct the location-based properties of an event (DFT-1087) 2a212542026-06-26 Updated technique: Reconstruct the location-based properties of an event (DFT-1087) 2a212542026-06-26 Updated technique: Reconstruct the location-based properties of an event (DFT-1087) 2a212542026-06-26 Updated technique: Reconstruct the location-based properties of an event (DFT-1087) 2a212542026-06-26 Updated technique: Reconstruct the location-based properties of an event (DFT-1087) 2a212542026-06-26 Updated technique: Analyze timeline (DFT-1086) 9bf489f2026-06-26 Updated technique: Analyze timeline (DFT-1086) 9bf489f2026-06-26 Updated technique: Analyze timeline (DFT-1086) 9bf489f2026-06-26 Updated technique: Analyze timeline (DFT-1086) 9bf489f2026-06-26 Updated technique: Analyze timeline (DFT-1086) 9bf489f2026-06-26 Updated technique: Analyze timeline (DFT-1086) 9bf489f2026-06-26 Updated technique: Conflate specific account identifiers to a single user identity (DFT-1085) 64451ab2026-06-26 Updated technique: Conflate specific account identifiers to a single user identity (DFT-1085) 64451ab2026-06-26 Updated technique: Conflate specific account identifiers to a single user identity (DFT-1085) 64451ab2026-06-26 Updated technique: Conflate specific account identifiers to a single user identity (DFT-1085) 64451ab2026-06-26 Updated technique: Conflate specific account identifiers to a single user identity (DFT-1085) 64451ab2026-06-26 Updated technique: Conflate specific account identifiers to a single user identity (DFT-1085) 64451ab2026-06-26 Updated technique: Extract potentially user-identifying content from account information (DFT-1084) 64451ab2026-06-26 Updated technique: Extract potentially user-identifying content from account information (DFT-1084) 64451ab2026-06-26 Updated technique: Extract potentially user-identifying content from account information (DFT-1084) 64451ab2026-06-26 Updated technique: Extract potentially user-identifying content from account information (DFT-1084) 64451ab2026-06-26 Updated technique: Extract potentially user-identifying content from account information (DFT-1084) 64451ab2026-06-26 Updated technique: Extract potentially user-identifying content from account information (DFT-1084) 64451ab2026-06-26 Updated technique: Extract artifacts from operating system memory structures (DFT-1083) 46dcef12026-06-26 Updated technique: Extract artifacts from operating system memory structures (DFT-1083) 46dcef12026-06-26 Updated technique: Extract artifacts from operating system memory structures (DFT-1083) 46dcef12026-06-26 Updated technique: Extract artifacts from operating system memory structures (DFT-1083) 46dcef12026-06-26 Updated technique: Extract artifacts from operating system memory structures (DFT-1083) 46dcef12026-06-26 Updated technique: Extract artifacts from operating system memory structures (DFT-1083) 46dcef12026-06-26 Updated technique: Examine document content (DFT-1082) 9a79b6d2026-06-26 Updated technique: Examine document content (DFT-1082) 9a79b6d2026-06-26 Updated technique: Examine document content (DFT-1082) 9a79b6d2026-06-26 Updated technique: Examine document content (DFT-1082) 9a79b6d2026-06-26 Updated technique: Examine document content (DFT-1082) 9a79b6d2026-06-26 Updated technique: Examine document content (DFT-1082) 9a79b6d2026-06-26 Updated technique: Examine image/picture content (DFT-1081) 9a79b6d2026-06-26 Updated technique: Examine image/picture content (DFT-1081) 9a79b6d2026-06-26 Updated technique: Examine image/picture content (DFT-1081) 9a79b6d2026-06-26 Updated technique: Examine image/picture content (DFT-1081) 9a79b6d2026-06-26 Updated technique: Examine image/picture content (DFT-1081) 9a79b6d2026-06-26 Updated technique: Examine image/picture content (DFT-1081) 9a79b6d2026-06-26 Updated technique: Examine video content (DFT-1080) 9a79b6d2026-06-26 Updated technique: Examine video content (DFT-1080) 9a79b6d2026-06-26 Updated technique: Examine video content (DFT-1080) 9a79b6d2026-06-26 Updated technique: Examine video content (DFT-1080) 9a79b6d2026-06-26 Updated technique: Examine video content (DFT-1080) 9a79b6d2026-06-26 Updated technique: Examine video content (DFT-1080) 9a79b6d2026-06-26 Updated technique: Examine audio content (DFT-1079) 9a79b6d2026-06-26 Updated technique: Examine audio content (DFT-1079) 9a79b6d2026-06-26 Updated technique: Examine audio content (DFT-1079) 9a79b6d2026-06-26 Updated technique: Examine audio content (DFT-1079) 9a79b6d2026-06-26 Updated technique: Examine audio content (DFT-1079) 9a79b6d2026-06-26 Updated technique: Examine audio content (DFT-1079) 9a79b6d2026-06-26 Updated technique: Extract artifacts from cloud synchronization app(s) (DFT-1078) 66d2ef42026-06-26 Updated technique: Extract artifacts from cloud synchronization app(s) (DFT-1078) 66d2ef42026-06-26 Updated technique: Extract artifacts from cloud synchronization app(s) (DFT-1078) 66d2ef42026-06-26 Updated technique: Extract artifacts from cloud synchronization app(s) (DFT-1078) 66d2ef42026-06-26 Updated technique: Extract artifacts from cloud synchronization app(s) (DFT-1078) 66d2ef42026-06-26 Updated technique: Extract artifacts from cloud synchronization app(s) (DFT-1078) 66d2ef42026-06-26 Updated technique: Extract artifacts from photo management app(s) (DFT-1077) 66d2ef42026-06-26 Updated technique: Extract artifacts from photo management app(s) (DFT-1077) 66d2ef42026-06-26 Updated technique: Extract artifacts from photo management app(s) (DFT-1077) 66d2ef42026-06-26 Updated technique: Extract artifacts from photo management app(s) (DFT-1077) 66d2ef42026-06-26 Updated technique: Extract artifacts from photo management app(s) (DFT-1077) 66d2ef42026-06-26 Updated technique: Extract artifacts from photo management app(s) (DFT-1077) 66d2ef42026-06-26 Updated technique: Extract artifacts from log files (DFT-1076) 66d2ef42026-06-26 Updated technique: Extract artifacts from log files (DFT-1076) 66d2ef42026-06-26 Updated technique: Extract artifacts from log files (DFT-1076) 66d2ef42026-06-26 Updated technique: Extract artifacts from log files (DFT-1076) 66d2ef42026-06-26 Updated technique: Extract artifacts from log files (DFT-1076) 66d2ef42026-06-26 Updated technique: Extract artifacts from log files (DFT-1076) 66d2ef42026-06-26 Updated technique: Extract artifacts from maps/travel app(s) (DFT-1075) 66d2ef42026-06-26 Updated technique: Extract artifacts from maps/travel app(s) (DFT-1075) 66d2ef42026-06-26 Updated technique: Extract artifacts from maps/travel app(s) (DFT-1075) 66d2ef42026-06-26 Updated technique: Extract artifacts from maps/travel app(s) (DFT-1075) 66d2ef42026-06-26 Updated technique: Extract artifacts from maps/travel app(s) (DFT-1075) 66d2ef42026-06-26 Updated technique: Extract artifacts from maps/travel app(s) (DFT-1075) 66d2ef42026-06-26 Updated technique: Extract artifacts from social network app(s) (DFT-1074) 66d2ef42026-06-26 Updated technique: Extract artifacts from social network app(s) (DFT-1074) 66d2ef42026-06-26 Updated technique: Extract artifacts from social network app(s) (DFT-1074) 66d2ef42026-06-26 Updated technique: Extract artifacts from social network app(s) (DFT-1074) 66d2ef42026-06-26 Updated technique: Extract artifacts from social network app(s) (DFT-1074) 66d2ef42026-06-26 Updated technique: Extract artifacts from social network app(s) (DFT-1074) 66d2ef42026-06-26 Updated technique: Extract artifacts from calendar app(s) (DFT-1073) 66d2ef42026-06-26 Updated technique: Extract artifacts from calendar app(s) (DFT-1073) 66d2ef42026-06-26 Updated technique: Extract artifacts from calendar app(s) (DFT-1073) 66d2ef42026-06-26 Updated technique: Extract artifacts from calendar app(s) (DFT-1073) 66d2ef42026-06-26 Updated technique: Extract artifacts from calendar app(s) (DFT-1073) 66d2ef42026-06-26 Updated technique: Extract artifacts from calendar app(s) (DFT-1073) 66d2ef42026-06-26 Updated technique: Extract artifacts from chat app(s) (DFT-1072) 66d2ef42026-06-26 Updated technique: Extract artifacts from chat app(s) (DFT-1072) 66d2ef42026-06-26 Updated technique: Extract artifacts from chat app(s) (DFT-1072) 66d2ef42026-06-26 Updated technique: Extract artifacts from chat app(s) (DFT-1072) 66d2ef42026-06-26 Updated technique: Extract artifacts from chat app(s) (DFT-1072) 66d2ef42026-06-26 Updated technique: Extract artifacts from chat app(s) (DFT-1072) 66d2ef42026-06-26 Updated technique: Extract data from SQLite database(s) (DFT-1071) 66d2ef42026-06-26 Updated technique: Extract data from SQLite database(s) (DFT-1071) 66d2ef42026-06-26 Updated technique: Extract data from SQLite database(s) (DFT-1071) 66d2ef42026-06-26 Updated technique: Extract data from SQLite database(s) (DFT-1071) 66d2ef42026-06-26 Updated technique: Extract data from SQLite database(s) (DFT-1071) 66d2ef42026-06-26 Updated technique: Extract data from SQLite database(s) (DFT-1071) 66d2ef42026-06-26 Updated technique: Extract artifacts from email client(s) or webmail access (DFT-1070) 66d2ef42026-06-26 Updated technique: Extract artifacts from email client(s) or webmail access (DFT-1070) 66d2ef42026-06-26 Updated technique: Extract artifacts from email client(s) or webmail access (DFT-1070) 66d2ef42026-06-26 Updated technique: Extract artifacts from email client(s) or webmail access (DFT-1070) 66d2ef42026-06-26 Updated technique: Extract artifacts from email client(s) or webmail access (DFT-1070) 66d2ef42026-06-26 Updated technique: Extract artifacts from email client(s) or webmail access (DFT-1070) 66d2ef42026-06-26 Updated technique: Extract artifacts from a web browser (DFT-1069) 2a494232026-06-26 Updated technique: Extract artifacts from a web browser (DFT-1069) 2a494232026-06-26 Updated technique: Extract artifacts from a web browser (DFT-1069) 2a494232026-06-26 Updated technique: Extract artifacts from a web browser (DFT-1069) 2a494232026-06-26 Updated technique: Extract artifacts from a web browser (DFT-1069) 2a494232026-06-26 Updated technique: Extract artifacts from a web browser (DFT-1069) 2a494232026-06-26 Updated technique: Extract operating system artifacts indicating recently used files (DFT-1068) d9e4f992026-06-26 Updated technique: Extract operating system artifacts indicating recently used files (DFT-1068) d9e4f992026-06-26 Updated technique: Extract operating system artifacts indicating recently used files (DFT-1068) d9e4f992026-06-26 Updated technique: Extract operating system artifacts indicating recently used files (DFT-1068) d9e4f992026-06-26 Updated technique: Extract operating system artifacts indicating recently used files (DFT-1068) d9e4f992026-06-26 Updated technique: Extract operating system artifacts indicating recently used files (DFT-1068) d9e4f992026-06-26 Updated technique: Extract artifacts from operating system cloud synchronization features (DFT-1067) 75638bb2026-06-26 Updated technique: Extract artifacts from operating system cloud synchronization features (DFT-1067) 75638bb2026-06-26 Updated technique: Extract artifacts from operating system cloud synchronization features (DFT-1067) 75638bb2026-06-26 Updated technique: Extract artifacts from operating system cloud synchronization features (DFT-1067) 75638bb2026-06-26 Updated technique: Extract artifacts from operating system cloud synchronization features (DFT-1067) 75638bb2026-06-26 Updated technique: Extract artifacts from operating system cloud synchronization features (DFT-1067) 75638bb2026-06-26 Updated technique: Extract artifacts from operating system log files (DFT-1066) eb588f82026-06-26 Updated technique: Extract artifacts from operating system log files (DFT-1066) eb588f82026-06-26 Updated technique: Extract artifacts from operating system log files (DFT-1066) eb588f82026-06-26 Updated technique: Extract artifacts from operating system log files (DFT-1066) eb588f82026-06-26 Updated technique: Extract artifacts from operating system log files (DFT-1066) eb588f82026-06-26 Updated technique: Extract artifacts from operating system log files (DFT-1066) eb588f82026-06-26 Updated technique: Extract artifacts from operating system-level content indexer(s) (DFT-1065) 343469b2026-06-26 Updated technique: Extract artifacts from operating system-level content indexer(s) (DFT-1065) 343469b2026-06-26 Updated technique: Extract artifacts from operating system-level content indexer(s) (DFT-1065) 343469b2026-06-26 Updated technique: Extract artifacts from operating system-level content indexer(s) (DFT-1065) 343469b2026-06-26 Updated technique: Extract artifacts from operating system-level content indexer(s) (DFT-1065) 343469b2026-06-26 Updated technique: Extract artifacts from operating system-level content indexer(s) (DFT-1065) 343469b2026-06-26 Updated technique: Carve non-allocated files (DFT-1064) 90d62b62026-06-26 Updated technique: Carve non-allocated files (DFT-1064) 90d62b62026-06-26 Updated technique: Carve non-allocated files (DFT-1064) 90d62b62026-06-26 Updated technique: Carve non-allocated files (DFT-1064) 90d62b62026-06-26 Updated technique: Carve non-allocated files (DFT-1064) 90d62b62026-06-26 Updated technique: Carve non-allocated files (DFT-1064) 90d62b62026-06-26 Updated technique: Decrypt encrypted file systems/volumes (DFT-1062) 666e8b82026-06-26 Updated technique: Decrypt encrypted file systems/volumes (DFT-1062) 666e8b82026-06-26 Updated technique: Decrypt encrypted file systems/volumes (DFT-1062) 666e8b82026-06-26 Updated technique: Decrypt encrypted file systems/volumes (DFT-1062) 666e8b82026-06-26 Updated technique: Decrypt encrypted file systems/volumes (DFT-1062) 666e8b82026-06-26 Updated technique: Decrypt encrypted file systems/volumes (DFT-1062) 666e8b82026-06-26 Updated technique: Search for mismatched file extensions (DFT-1058) dfb8b702026-06-26 Updated technique: Search for mismatched file extensions (DFT-1058) dfb8b702026-06-26 Updated technique: Search for mismatched file extensions (DFT-1058) dfb8b702026-06-26 Updated technique: Search for mismatched file extensions (DFT-1058) dfb8b702026-06-26 Updated technique: Search for mismatched file extensions (DFT-1058) dfb8b702026-06-26 Updated technique: Search for mismatched file extensions (DFT-1058) dfb8b702026-06-26 Updated technique: Search for indicators of steganography (DFT-1057) 07aaf5d2026-06-26 Updated technique: Search for indicators of steganography (DFT-1057) 07aaf5d2026-06-26 Updated technique: Search for indicators of steganography (DFT-1057) 07aaf5d2026-06-26 Updated technique: Search for indicators of steganography (DFT-1057) 07aaf5d2026-06-26 Updated technique: Search for indicators of steganography (DFT-1057) 07aaf5d2026-06-26 Updated technique: Search for indicators of steganography (DFT-1057) 07aaf5d2026-06-26 Updated technique: Enumerate connections between artifacts (DFT-1056) 7bea6652026-06-26 Updated technique: Enumerate connections between artifacts (DFT-1056) 7bea6652026-06-26 Updated technique: Enumerate connections between artifacts (DFT-1056) 7bea6652026-06-26 Updated technique: Enumerate connections between artifacts (DFT-1056) 7bea6652026-06-26 Updated technique: Enumerate connections between artifacts (DFT-1056) 7bea6652026-06-26 Updated technique: Enumerate connections between artifacts (DFT-1056) 7bea6652026-06-26 Updated technique: Examine file and folder structure (DFT-1055) 376ec672026-06-26 Updated technique: Examine file and folder structure (DFT-1055) 376ec672026-06-26 Updated technique: Examine file and folder structure (DFT-1055) 376ec672026-06-26 Updated technique: Examine file and folder structure (DFT-1055) 376ec672026-06-26 Updated technique: Examine file and folder structure (DFT-1055) 376ec672026-06-26 Updated technique: Examine file and folder structure (DFT-1055) 376ec672026-06-26 Updated technique: Review artifacts or content manually for relevant material (DFT-1054) e3059b72026-06-26 Updated technique: Review artifacts or content manually for relevant material (DFT-1054) e3059b72026-06-26 Updated technique: Review artifacts or content manually for relevant material (DFT-1054) e3059b72026-06-26 Updated technique: Review artifacts or content manually for relevant material (DFT-1054) e3059b72026-06-26 Updated technique: Review artifacts or content manually for relevant material (DFT-1054) e3059b72026-06-26 Updated technique: Review artifacts or content manually for relevant material (DFT-1054) e3059b72026-06-26 Updated technique: Extract ‘entities’ from a data source (DFT-1053) c8e52132026-06-26 Updated technique: Extract ‘entities’ from a data source (DFT-1053) c8e52132026-06-26 Updated technique: Extract ‘entities’ from a data source (DFT-1053) c8e52132026-06-26 Updated technique: Extract ‘entities’ from a data source (DFT-1053) c8e52132026-06-26 Updated technique: Extract ‘entities’ from a data source (DFT-1053) c8e52132026-06-26 Updated technique: Extract ‘entities’ from a data source (DFT-1053) c8e52132026-06-26 Updated technique: Generate timeline (DFT-1052) 90f73452026-06-26 Updated technique: Generate timeline (DFT-1052) 90f73452026-06-26 Updated technique: Generate timeline (DFT-1052) 90f73452026-06-26 Updated technique: Generate timeline (DFT-1052) 90f73452026-06-26 Updated technique: Generate timeline (DFT-1052) 90f73452026-06-26 Updated technique: Generate timeline (DFT-1052) 90f73452026-06-26 Updated technique: Locate potentially relevant files using fuzzy hash matching (DFT-1051) 75c22cd2026-06-26 Updated technique: Locate potentially relevant files using fuzzy hash matching (DFT-1051) 75c22cd2026-06-26 Updated technique: Locate potentially relevant files using fuzzy hash matching (DFT-1051) 75c22cd2026-06-26 Updated technique: Locate potentially relevant files using fuzzy hash matching (DFT-1051) 75c22cd2026-06-26 Updated technique: Locate potentially relevant files using fuzzy hash matching (DFT-1051) 75c22cd2026-06-26 Updated technique: Locate potentially relevant files using fuzzy hash matching (DFT-1051) 75c22cd2026-06-26 Updated technique: Locate relevant files using a hashset to identify files of interest (DFT-1050) 34b51092026-06-26 Updated technique: Locate relevant files using a hashset to identify files of interest (DFT-1050) 34b51092026-06-26 Updated technique: Locate relevant files using a hashset to identify files of interest (DFT-1050) 34b51092026-06-26 Updated technique: Locate relevant files using a hashset to identify files of interest (DFT-1050) 34b51092026-06-26 Updated technique: Locate relevant files using a hashset to identify files of interest (DFT-1050) 34b51092026-06-26 Updated technique: Locate relevant files using a hashset to identify files of interest (DFT-1050) 34b51092026-06-26 Updated technique: Keyword search (DFT-1049) a8050cc2026-06-26 Updated technique: Keyword search (DFT-1049) a8050cc2026-06-26 Updated technique: Keyword search (DFT-1049) a8050cc2026-06-26 Updated technique: Keyword search (DFT-1049) a8050cc2026-06-26 Updated technique: Keyword search (DFT-1049) a8050cc2026-06-26 Updated technique: Keyword search (DFT-1049) a8050cc2026-06-26 Updated technique: Protect privacy by only partially processing data from a source (DFT-1048) 99028d82026-06-26 Updated technique: Protect privacy by only partially processing data from a source (DFT-1048) 99028d82026-06-26 Updated technique: Protect privacy by only partially processing data from a source (DFT-1048) 99028d82026-06-26 Updated technique: Protect privacy by only partially processing data from a source (DFT-1048) 99028d82026-06-26 Updated technique: Protect privacy by only partially processing data from a source (DFT-1048) 99028d82026-06-26 Updated technique: Protect privacy by only partially processing data from a source (DFT-1048) 99028d82026-06-26 Updated technique: Filter files using a hashset to reduce files examined (DFT-1047) a06bd822026-06-26 Updated technique: Filter files using a hashset to reduce files examined (DFT-1047) a06bd822026-06-26 Updated technique: Filter files using a hashset to reduce files examined (DFT-1047) a06bd822026-06-26 Updated technique: Filter files using a hashset to reduce files examined (DFT-1047) a06bd822026-06-26 Updated technique: Filter files using a hashset to reduce files examined (DFT-1047) a06bd822026-06-26 Updated technique: Filter files using a hashset to reduce files examined (DFT-1047) a06bd822026-06-26 Updated technique: Redact digital forensic tool results to protect privileged material (DFT-1046) 6b461362026-06-26 Updated technique: Redact digital forensic tool results to protect privileged material (DFT-1046) 6b461362026-06-26 Updated technique: Redact digital forensic tool results to protect privileged material (DFT-1046) 6b461362026-06-26 Updated technique: Redact digital forensic tool results to protect privileged material (DFT-1046) 6b461362026-06-26 Updated technique: Redact digital forensic tool results to protect privileged material (DFT-1046) 6b461362026-06-26 Updated technique: Redact digital forensic tool results to protect privileged material (DFT-1046) 6b461362026-06-26 Updated technique: Read contents from standard archive file(s) (DFT-1045) ec8f6012026-06-26 Updated technique: Read contents from standard archive file(s) (DFT-1045) ec8f6012026-06-26 Updated technique: Read contents from standard archive file(s) (DFT-1045) ec8f6012026-06-26 Updated technique: Read contents from standard archive file(s) (DFT-1045) ec8f6012026-06-26 Updated technique: Read contents from standard archive file(s) (DFT-1045) ec8f6012026-06-26 Updated technique: Read contents from standard archive file(s) (DFT-1045) ec8f6012026-06-26 Updated technique: Decode data stored in a mobile backup format (DFT-1044) 7c125e92026-06-26 Updated technique: Decode data stored in a mobile backup format (DFT-1044) 7c125e92026-06-26 Updated technique: Decode data stored in a mobile backup format (DFT-1044) 7c125e92026-06-26 Updated technique: Decode data stored in a mobile backup format (DFT-1044) 7c125e92026-06-26 Updated technique: Decode data stored in a mobile backup format (DFT-1044) 7c125e92026-06-26 Updated technique: Decode data stored in a mobile backup format (DFT-1044) 7c125e92026-06-26 Updated technique: Read bitstream from forensic image container file(s) (DFT-1043) b28f8032026-06-26 Updated technique: Read bitstream from forensic image container file(s) (DFT-1043) b28f8032026-06-26 Updated technique: Read bitstream from forensic image container file(s) (DFT-1043) b28f8032026-06-26 Updated technique: Read bitstream from forensic image container file(s) (DFT-1043) b28f8032026-06-26 Updated technique: Read bitstream from forensic image container file(s) (DFT-1043) b28f8032026-06-26 Updated technique: Read bitstream from forensic image container file(s) (DFT-1043) b28f8032026-06-26 Updated technique: Verify hash of imaged data matches the hash of the source device (DFT-1042) a26c3c12026-06-26 Updated technique: Verify hash of imaged data matches the hash of the source device (DFT-1042) a26c3c12026-06-26 Updated technique: Verify hash of imaged data matches the hash of the source device (DFT-1042) a26c3c12026-06-26 Updated technique: Verify hash of imaged data matches the hash of the source device (DFT-1042) a26c3c12026-06-26 Updated technique: Verify hash of imaged data matches the hash of the source device (DFT-1042) a26c3c12026-06-26 Updated technique: Verify hash of imaged data matches the hash of the source device (DFT-1042) a26c3c12026-06-26 Updated technique: Gain access to a device via a Pin2Pwn approach (DFT-1041) 57516d32026-06-26 Updated technique: Gain access to a device via a Pin2Pwn approach (DFT-1041) 57516d32026-06-26 Updated technique: Gain access to a device via a Pin2Pwn approach (DFT-1041) 57516d32026-06-26 Updated technique: Gain access to a device via a Pin2Pwn approach (DFT-1041) 57516d32026-06-26 Updated technique: Gain access to a device via a Pin2Pwn approach (DFT-1041) 57516d32026-06-26 Updated technique: Gain access to a device via a Pin2Pwn approach (DFT-1041) 57516d32026-06-26 Updated technique: Exploit a mobile device to facilitate privileged access for data extraction (DFT-1040) 48a3bf02026-06-26 Updated technique: Exploit a mobile device to facilitate privileged access for data extraction (DFT-1040) 48a3bf02026-06-26 Updated technique: Exploit a mobile device to facilitate privileged access for data extraction (DFT-1040) 48a3bf02026-06-26 Updated technique: Exploit a mobile device to facilitate privileged access for data extraction (DFT-1040) 48a3bf02026-06-26 Updated technique: Exploit a mobile device to facilitate privileged access for data extraction (DFT-1040) 48a3bf02026-06-26 Updated technique: Exploit a mobile device to facilitate privileged access for data extraction (DFT-1040) 48a3bf02026-06-26 Updated technique: Attack a stored credential or device using a rainbow table-based approach (DFT-1038) 7a8c43d2026-06-26 Updated technique: Attack a stored credential or device using a rainbow table-based approach (DFT-1038) 7a8c43d2026-06-26 Updated technique: Attack a stored credential or device using a rainbow table-based approach (DFT-1038) 7a8c43d2026-06-26 Updated technique: Attack a stored credential or device using a rainbow table-based approach (DFT-1038) 7a8c43d2026-06-26 Updated technique: Attack a stored credential or device using a rainbow table-based approach (DFT-1038) 7a8c43d2026-06-26 Updated technique: Attack a stored credential or device using a rainbow table-based approach (DFT-1038) 7a8c43d2026-06-26 Updated technique: Obtain password from the device’s owner (DFT-1037) 757fdb42026-06-26 Updated technique: Obtain password from the device’s owner (DFT-1037) 757fdb42026-06-26 Updated technique: Obtain password from the device’s owner (DFT-1037) 757fdb42026-06-26 Updated technique: Obtain password from the device’s owner (DFT-1037) 757fdb42026-06-26 Updated technique: Obtain password from the device’s owner (DFT-1037) 757fdb42026-06-26 Updated technique: Obtain password from the device’s owner (DFT-1037) 757fdb42026-06-26 Updated technique: Recover information about a potential device PIN or pattern lock using a smudge attack (DFT-1036) 8c686732026-06-26 Updated technique: Recover information about a potential device PIN or pattern lock using a smudge attack (DFT-1036) 8c686732026-06-26 Updated technique: Recover information about a potential device PIN or pattern lock using a smudge attack (DFT-1036) 8c686732026-06-26 Updated technique: Recover information about a potential device PIN or pattern lock using a smudge attack (DFT-1036) 8c686732026-06-26 Updated technique: Recover information about a potential device PIN or pattern lock using a smudge attack (DFT-1036) 8c686732026-06-26 Updated technique: Recover information about a potential device PIN or pattern lock using a smudge attack (DFT-1036) 8c686732026-06-26 Updated technique: Attack a stored credential or device using a dictionary-based approach (DFT-1035) 965d39c2026-06-26 Updated technique: Attack a stored credential or device using a dictionary-based approach (DFT-1035) 965d39c2026-06-26 Updated technique: Attack a stored credential or device using a dictionary-based approach (DFT-1035) 965d39c2026-06-26 Updated technique: Attack a stored credential or device using a dictionary-based approach (DFT-1035) 965d39c2026-06-26 Updated technique: Attack a stored credential or device using a dictionary-based approach (DFT-1035) 965d39c2026-06-26 Updated technique: Attack a stored credential or device using a dictionary-based approach (DFT-1035) 965d39c2026-06-26 Updated technique: Attack a stored credential or device using a brute force approach (DFT-1034) db4882e2026-06-26 Updated technique: Attack a stored credential or device using a brute force approach (DFT-1034) db4882e2026-06-26 Updated technique: Attack a stored credential or device using a brute force approach (DFT-1034) db4882e2026-06-26 Updated technique: Attack a stored credential or device using a brute force approach (DFT-1034) db4882e2026-06-26 Updated technique: Attack a stored credential or device using a brute force approach (DFT-1034) db4882e2026-06-26 Updated technique: Attack a stored credential or device using a brute force approach (DFT-1034) db4882e2026-06-26 Updated technique: Extract credential(s) from an accessible device to attempt access to a more secure device or service (DFT-1033) d9480bc2026-06-26 Updated technique: Extract credential(s) from an accessible device to attempt access to a more secure device or service (DFT-1033) d9480bc2026-06-26 Updated technique: Extract credential(s) from an accessible device to attempt access to a more secure device or service (DFT-1033) d9480bc2026-06-26 Updated technique: Extract credential(s) from an accessible device to attempt access to a more secure device or service (DFT-1033) d9480bc2026-06-26 Updated technique: Extract credential(s) from an accessible device to attempt access to a more secure device or service (DFT-1033) d9480bc2026-06-26 Updated technique: Extract credential(s) from an accessible device to attempt access to a more secure device or service (DFT-1033) d9480bc2026-06-26 Updated technique: Recover encryption/decryption key information using side channel attacks (DFT-1032) 7e235852026-06-26 Updated technique: Recover encryption/decryption key information using side channel attacks (DFT-1032) 7e235852026-06-26 Updated technique: Recover encryption/decryption key information using side channel attacks (DFT-1032) 7e235852026-06-26 Updated technique: Recover encryption/decryption key information using side channel attacks (DFT-1032) 7e235852026-06-26 Updated technique: Recover encryption/decryption key information using side channel attacks (DFT-1032) 7e235852026-06-26 Updated technique: Recover encryption/decryption key information using side channel attacks (DFT-1032) 7e235852026-06-26 Updated technique: Recover encryption/decryption key from memory (DFT-1031) d63e70b2026-06-26 Updated technique: Recover encryption/decryption key from memory (DFT-1031) d63e70b2026-06-26 Updated technique: Recover encryption/decryption key from memory (DFT-1031) d63e70b2026-06-26 Updated technique: Recover encryption/decryption key from memory (DFT-1031) d63e70b2026-06-26 Updated technique: Recover encryption/decryption key from memory (DFT-1031) d63e70b2026-06-26 Updated technique: Recover encryption/decryption key from memory (DFT-1031) d63e70b2026-06-26 Updated technique: Read data from unmanaged NAND (DFT-1030) 0c4b0172026-06-26 Updated technique: Read data from unmanaged NAND (DFT-1030) 0c4b0172026-06-26 Updated technique: Read data from unmanaged NAND (DFT-1030) 0c4b0172026-06-26 Updated technique: Read data from unmanaged NAND (DFT-1030) 0c4b0172026-06-26 Updated technique: Read data from unmanaged NAND (DFT-1030) 0c4b0172026-06-26 Updated technique: Read data from unmanaged NAND (DFT-1030) 0c4b0172026-06-26 Updated technique: Read data from a desoldered eMMC via a chip reader (DFT-1029) 7d5f76d2026-06-26 Updated technique: Read data from a desoldered eMMC via a chip reader (DFT-1029) 7d5f76d2026-06-26 Updated technique: Read data from a desoldered eMMC via a chip reader (DFT-1029) 7d5f76d2026-06-26 Updated technique: Read data from a desoldered eMMC via a chip reader (DFT-1029) 7d5f76d2026-06-26 Updated technique: Read data from a desoldered eMMC via a chip reader (DFT-1029) 7d5f76d2026-06-26 Updated technique: Read data from a desoldered eMMC via a chip reader (DFT-1029) 7d5f76d2026-06-26 Updated technique: Physically remove a storage chip from a device (chip-off) (DFT-1028) 411ae662026-06-26 Updated technique: Physically remove a storage chip from a device (chip-off) (DFT-1028) 411ae662026-06-26 Updated technique: Physically remove a storage chip from a device (chip-off) (DFT-1028) 411ae662026-06-26 Updated technique: Physically remove a storage chip from a device (chip-off) (DFT-1028) 411ae662026-06-26 Updated technique: Physically remove a storage chip from a device (chip-off) (DFT-1028) 411ae662026-06-26 Updated technique: Physically remove a storage chip from a device (chip-off) (DFT-1028) 411ae662026-06-26 Updated technique: Read data from a device using JTAG (DFT-1027) 073a8e92026-06-26 Updated technique: Read data from a device using JTAG (DFT-1027) 073a8e92026-06-26 Updated technique: Read data from a device using JTAG (DFT-1027) 073a8e92026-06-26 Updated technique: Read data from a device using JTAG (DFT-1027) 073a8e92026-06-26 Updated technique: Read data from a device using JTAG (DFT-1027) 073a8e92026-06-26 Updated technique: Read data from a device using JTAG (DFT-1027) 073a8e92026-06-26 Updated technique: Store data in standard archive format (DFT-1026) 108b1392026-06-26 Updated technique: Store data in standard archive format (DFT-1026) 108b1392026-06-26 Updated technique: Store data in standard archive format (DFT-1026) 108b1392026-06-26 Updated technique: Store data in standard archive format (DFT-1026) 108b1392026-06-26 Updated technique: Store data in standard archive format (DFT-1026) 108b1392026-06-26 Updated technique: Store data in standard archive format (DFT-1026) 108b1392026-06-26 Updated technique: Store bitstream data in a forensic image format (DFT-1025) 896a8452026-06-26 Updated technique: Store bitstream data in a forensic image format (DFT-1025) 896a8452026-06-26 Updated technique: Store bitstream data in a forensic image format (DFT-1025) 896a8452026-06-26 Updated technique: Store bitstream data in a forensic image format (DFT-1025) 896a8452026-06-26 Updated technique: Store bitstream data in a forensic image format (DFT-1025) 896a8452026-06-26 Updated technique: Store bitstream data in a forensic image format (DFT-1025) 896a8452026-06-26 Updated technique: Collect data from cloud service via submission of request to service provider (DFT-1024) 7b2e5cd2026-06-26 Updated technique: Collect data from cloud service via submission of request to service provider (DFT-1024) 7b2e5cd2026-06-26 Updated technique: Collect data from cloud service via submission of request to service provider (DFT-1024) 7b2e5cd2026-06-26 Updated technique: Collect data from cloud service via submission of request to service provider (DFT-1024) 7b2e5cd2026-06-26 Updated technique: Collect data from cloud service via submission of request to service provider (DFT-1024) 7b2e5cd2026-06-26 Updated technique: Collect data from cloud service via submission of request to service provider (DFT-1024) 7b2e5cd2026-06-26 Updated technique: Collect data from cloud service via a live web page using credentials (DFT-1023) 7ed144c2026-06-26 Updated technique: Collect data from cloud service via a live web page using credentials (DFT-1023) 7ed144c2026-06-26 Updated technique: Collect data from cloud service via a live web page using credentials (DFT-1023) 7ed144c2026-06-26 Updated technique: Collect data from cloud service via a live web page using credentials (DFT-1023) 7ed144c2026-06-26 Updated technique: Collect data from cloud service via a live web page using credentials (DFT-1023) 7ed144c2026-06-26 Updated technique: Collect data from cloud service via a live web page using credentials (DFT-1023) 7ed144c2026-06-26 Updated technique: Capture mobile device screenshots (manually) (DFT-1022) b0410992026-06-26 Updated technique: Capture mobile device screenshots (manually) (DFT-1022) b0410992026-06-26 Updated technique: Capture mobile device screenshots (manually) (DFT-1022) b0410992026-06-26 Updated technique: Capture mobile device screenshots (manually) (DFT-1022) b0410992026-06-26 Updated technique: Capture mobile device screenshots (manually) (DFT-1022) b0410992026-06-26 Updated technique: Capture mobile device screenshots (manually) (DFT-1022) b0410992026-06-26 Updated technique: Extract artifacts from a configuration file (DFT-1021) 1f857312026-06-26 Updated technique: Extract artifacts from a configuration file (DFT-1021) 1f857312026-06-26 Updated technique: Extract artifacts from a configuration file (DFT-1021) 1f857312026-06-26 Updated technique: Extract artifacts from a configuration file (DFT-1021) 1f857312026-06-26 Updated technique: Extract artifacts from a configuration file (DFT-1021) 1f857312026-06-26 Updated technique: Extract artifacts from a configuration file (DFT-1021) 1f857312026-06-26 Updated technique: Extract the file system from a mobile device (DFT-1020) ad813a72026-06-26 Updated technique: Extract the file system from a mobile device (DFT-1020) ad813a72026-06-26 Updated technique: Extract the file system from a mobile device (DFT-1020) ad813a72026-06-26 Updated technique: Extract the file system from a mobile device (DFT-1020) ad813a72026-06-26 Updated technique: Extract the file system from a mobile device (DFT-1020) ad813a72026-06-26 Updated technique: Extract the file system from a mobile device (DFT-1020) ad813a72026-06-26 Updated technique: Extract a backup from a mobile device (DFT-1019) 8cd562d2026-06-26 Updated technique: Extract a backup from a mobile device (DFT-1019) 8cd562d2026-06-26 Updated technique: Extract a backup from a mobile device (DFT-1019) 8cd562d2026-06-26 Updated technique: Extract a backup from a mobile device (DFT-1019) 8cd562d2026-06-26 Updated technique: Extract a backup from a mobile device (DFT-1019) 8cd562d2026-06-26 Updated technique: Extract a backup from a mobile device (DFT-1019) 8cd562d2026-06-26 Updated technique: Collect data from a remote networked device (DFT-1018) 5b5dca72026-06-26 Updated technique: Collect data from a remote networked device (DFT-1018) 5b5dca72026-06-26 Updated technique: Collect data from a remote networked device (DFT-1018) 5b5dca72026-06-26 Updated technique: Collect data from a remote networked device (DFT-1018) 5b5dca72026-06-26 Updated technique: Collect data from a remote networked device (DFT-1018) 5b5dca72026-06-26 Updated technique: Collect data from a remote networked device (DFT-1018) 5b5dca72026-06-26 Updated technique: Capture network packets (DFT-1017) 3c3383d2026-06-26 Updated technique: Capture network packets (DFT-1017) 3c3383d2026-06-26 Updated technique: Capture network packets (DFT-1017) 3c3383d2026-06-26 Updated technique: Capture network packets (DFT-1017) 3c3383d2026-06-26 Updated technique: Capture network packets (DFT-1017) 3c3383d2026-06-26 Updated technique: Capture network packets (DFT-1017) 3c3383d2026-06-26 Updated technique: Collect specific pieces of information from a live running device (DFT-1016) 174e9542026-06-26 Updated technique: Collect specific pieces of information from a live running device (DFT-1016) 174e9542026-06-26 Updated technique: Collect specific pieces of information from a live running device (DFT-1016) 174e9542026-06-26 Updated technique: Collect specific pieces of information from a live running device (DFT-1016) 174e9542026-06-26 Updated technique: Collect specific pieces of information from a live running device (DFT-1016) 174e9542026-06-26 Updated technique: Collect specific pieces of information from a live running device (DFT-1016) 174e9542026-06-26 Updated technique: Collect logical files selectively based on privacy preserving criteria (DFT-1015) d8784092026-06-26 Updated technique: Collect logical files selectively based on privacy preserving criteria (DFT-1015) d8784092026-06-26 Updated technique: Collect logical files selectively based on privacy preserving criteria (DFT-1015) d8784092026-06-26 Updated technique: Collect logical files selectively based on privacy preserving criteria (DFT-1015) d8784092026-06-26 Updated technique: Collect logical files selectively based on privacy preserving criteria (DFT-1015) d8784092026-06-26 Updated technique: Collect logical files selectively based on privacy preserving criteria (DFT-1015) d8784092026-06-26 Updated technique: Write protect storage media using a software write blocker (DFT-1013) 87e5a092026-06-26 Updated technique: Write protect storage media using a software write blocker (DFT-1013) 87e5a092026-06-26 Updated technique: Write protect storage media using a software write blocker (DFT-1013) 87e5a092026-06-26 Updated technique: Write protect storage media using a software write blocker (DFT-1013) 87e5a092026-06-26 Updated technique: Write protect storage media using a software write blocker (DFT-1013) 87e5a092026-06-26 Updated technique: Write protect storage media using a software write blocker (DFT-1013) 87e5a092026-06-26 Updated technique: Write protect storage media using a hardware write blocker (DFT-1012) 202751d2026-06-26 Updated technique: Write protect storage media using a hardware write blocker (DFT-1012) 202751d2026-06-26 Updated technique: Write protect storage media using a hardware write blocker (DFT-1012) 202751d2026-06-26 Updated technique: Write protect storage media using a hardware write blocker (DFT-1012) 202751d2026-06-26 Updated technique: Write protect storage media using a hardware write blocker (DFT-1012) 202751d2026-06-26 Updated technique: Write protect storage media using a hardware write blocker (DFT-1012) 202751d2026-06-26 Updated technique: Store seized devices or media in evidence bags (DFT-1011) 9ec5be52026-06-26 Updated technique: Store seized devices or media in evidence bags (DFT-1011) 9ec5be52026-06-26 Updated technique: Store seized devices or media in evidence bags (DFT-1011) 9ec5be52026-06-26 Updated technique: Store seized devices or media in evidence bags (DFT-1011) 9ec5be52026-06-26 Updated technique: Store seized devices or media in evidence bags (DFT-1011) 9ec5be52026-06-26 Updated technique: Store seized devices or media in evidence bags (DFT-1011) 9ec5be52026-06-26 Updated technique: Place device in a faraday environment (DFT-1010) 523860c2026-06-26 Updated technique: Place device in a faraday environment (DFT-1010) 523860c2026-06-26 Updated technique: Place device in a faraday environment (DFT-1010) 523860c2026-06-26 Updated technique: Place device in a faraday environment (DFT-1010) 523860c2026-06-26 Updated technique: Place device in a faraday environment (DFT-1010) 523860c2026-06-26 Updated technique: Place device in a faraday environment (DFT-1010) 523860c2026-06-26 Updated technique: Locate potential digital evidence sources via cloud account identifiers (DFT-1009) 53c92482026-06-26 Updated technique: Locate potential digital evidence sources via cloud account identifiers (DFT-1009) 53c92482026-06-26 Updated technique: Locate potential digital evidence sources via cloud account identifiers (DFT-1009) 53c92482026-06-26 Updated technique: Locate potential digital evidence sources via cloud account identifiers (DFT-1009) 53c92482026-06-26 Updated technique: Locate potential digital evidence sources via cloud account identifiers (DFT-1009) 53c92482026-06-26 Updated technique: Locate potential digital evidence sources via cloud account identifiers (DFT-1009) 53c92482026-06-26 Updated technique: Detect the potential existence of digital devices by profiling network traffic (DFT-1008) f23d6972026-06-26 Updated technique: Detect the potential existence of digital devices by profiling network traffic (DFT-1008) f23d6972026-06-26 Updated technique: Detect the potential existence of digital devices by profiling network traffic (DFT-1008) f23d6972026-06-26 Updated technique: Detect the potential existence of digital devices by profiling network traffic (DFT-1008) f23d6972026-06-26 Updated technique: Detect the potential existence of digital devices by profiling network traffic (DFT-1008) f23d6972026-06-26 Updated technique: Detect the potential existence of digital devices by profiling network traffic (DFT-1008) f23d6972026-06-26 Updated technique: Detect the potential existence of digital devices using a SyncTriage-based approach (DFT-1007) c1e75c52026-06-26 Updated technique: Detect the potential existence of digital devices using a SyncTriage-based approach (DFT-1007) c1e75c52026-06-26 Updated technique: Detect the potential existence of digital devices using a SyncTriage-based approach (DFT-1007) c1e75c52026-06-26 Updated technique: Detect the potential existence of digital devices using a SyncTriage-based approach (DFT-1007) c1e75c52026-06-26 Updated technique: Detect the potential existence of digital devices using a SyncTriage-based approach (DFT-1007) c1e75c52026-06-26 Updated technique: Detect the potential existence of digital devices using a SyncTriage-based approach (DFT-1007) c1e75c52026-06-26 Updated technique: Search a crime scene using digital sniffer dogs (DFT-1006) 656e86e2026-06-26 Updated technique: Search a crime scene using digital sniffer dogs (DFT-1006) 656e86e2026-06-26 Updated technique: Search a crime scene using digital sniffer dogs (DFT-1006) 656e86e2026-06-26 Updated technique: Search a crime scene using digital sniffer dogs (DFT-1006) 656e86e2026-06-26 Updated technique: Search a crime scene using digital sniffer dogs (DFT-1006) 656e86e2026-06-26 Updated technique: Search a crime scene using digital sniffer dogs (DFT-1006) 656e86e2026-06-26 Updated technique: Search a crime scene for relevant physical evidence (DFT-1005) af086b62026-06-26 Updated technique: Search a crime scene for relevant physical evidence (DFT-1005) af086b62026-06-26 Updated technique: Search a crime scene for relevant physical evidence (DFT-1005) af086b62026-06-26 Updated technique: Search a crime scene for relevant physical evidence (DFT-1005) af086b62026-06-26 Updated technique: Search a crime scene for relevant physical evidence (DFT-1005) af086b62026-06-26 Updated technique: Search a crime scene for relevant physical evidence (DFT-1005) af086b62026-06-26 Updated technique: Collect logical files selectively (DFT-1004) caa9e5d2026-06-26 Updated technique: Collect logical files selectively (DFT-1004) caa9e5d2026-06-26 Updated technique: Collect logical files selectively (DFT-1004) caa9e5d2026-06-26 Updated technique: Collect logical files selectively (DFT-1004) caa9e5d2026-06-26 Updated technique: Collect logical files selectively (DFT-1004) caa9e5d2026-06-26 Updated technique: Collect logical files selectively (DFT-1004) caa9e5d2026-06-26 Updated technique: Copy pages from physical memory (DFT-1003) 2c36e9e2026-06-26 Updated technique: Copy pages from physical memory (DFT-1003) 2c36e9e2026-06-26 Updated technique: Copy pages from physical memory (DFT-1003) 2c36e9e2026-06-26 Updated technique: Copy pages from physical memory (DFT-1003) 2c36e9e2026-06-26 Updated technique: Copy pages from physical memory (DFT-1003) 2c36e9e2026-06-26 Updated technique: Copy pages from physical memory (DFT-1003) 2c36e9e2026-06-26 Updated technique: Copy sectors from storage media (DFT-1002) c31b57b2026-06-26 Updated technique: Copy sectors from storage media (DFT-1002) c31b57b2026-06-26 Updated technique: Copy sectors from storage media (DFT-1002) c31b57b2026-06-26 Updated technique: Copy sectors from storage media (DFT-1002) c31b57b2026-06-26 Updated technique: Copy sectors from storage media (DFT-1002) c31b57b2026-06-26 Updated technique: Copy sectors from storage media (DFT-1002) c31b57b2026-06-26 Updated technique: Triage devices or media (DFT-1001) a63d1fc2026-06-26 Updated technique: Triage devices or media (DFT-1001) a63d1fc2026-06-26 Updated technique: Triage devices or media (DFT-1001) a63d1fc2026-06-26 Updated technique: Triage devices or media (DFT-1001) a63d1fc2026-06-26 Updated technique: Triage devices or media (DFT-1001) a63d1fc2026-06-26 Updated technique: Triage devices or media (DFT-1001) a63d1fc2026-06-26 Added reference: DFCite-1155 6c369512026-06-26 Added reference: DFCite-1155 6c369512026-06-26 Added reference: DFCite-1155 6c369512026-06-26 Added reference: DFCite-1155 6c369512026-06-26 Added reference: DFCite-1155 6c369512026-06-26 Added reference: DFCite-1155 6c369512026-06-26 Added reference: DFCite-1154 6c369512026-06-26 Added reference: DFCite-1154 6c369512026-06-26 Added reference: DFCite-1154 6c369512026-06-26 Added reference: DFCite-1154 6c369512026-06-26 Added reference: DFCite-1154 6c369512026-06-26 Added reference: DFCite-1154 6c369512026-06-25 Updated technique (AUTOIMPLEMENT): Instrumentation (DFT-1095) 33edcd72026-06-25 Updated technique (AUTOIMPLEMENT): Instrumentation (DFT-1095) 33edcd72026-06-25 Updated technique (AUTOIMPLEMENT): Instrumentation (DFT-1095) 33edcd72026-06-25 Updated technique (AUTOIMPLEMENT): Instrumentation (DFT-1095) 33edcd72026-06-25 Updated technique (AUTOIMPLEMENT): Instrumentation (DFT-1095) 33edcd72026-06-25 Updated technique (AUTOIMPLEMENT): Instrumentation (DFT-1095) 33edcd72026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1156 33edcd72026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1156 33edcd72026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1156 33edcd72026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1156 33edcd72026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1156 33edcd72026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1156 33edcd72026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1155 cd533fd2026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1155 cd533fd2026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1155 cd533fd2026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1155 cd533fd2026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1155 cd533fd2026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1155 cd533fd2026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1155 cd533fd2026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1155 cd533fd2026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1155 cd533fd2026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1154 d0fcaa52026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1154 d0fcaa52026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1154 d0fcaa52026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1154 d0fcaa52026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1154 d0fcaa52026-06-25 Added reference (AUTOIMPLEMENT): DFCite-1154 d0fcaa52026-06-24 Updated technique (AUTOIMPLEMENT): Place device in faraday environment (DFT-1010) 1ec328e2026-06-24 Updated technique (AUTOIMPLEMENT): Place device in faraday environment (DFT-1010) 1ec328e2026-06-24 Updated technique (AUTOIMPLEMENT): Place device in faraday environment (DFT-1010) 1ec328e2026-06-24 Updated technique (AUTOIMPLEMENT): Place device in faraday environment (DFT-1010) 1ec328e2026-06-24 Updated technique (AUTOIMPLEMENT): Place device in faraday environment (DFT-1010) 1ec328e2026-06-24 Updated technique (AUTOIMPLEMENT): Place device in faraday environment (DFT-1010) 1ec328e2026-06-24 Updated technique (AUTOIMPLEMENT): Place device in faraday environment (DFT-1010) 1ec328e2026-06-24 Updated technique (AUTOIMPLEMENT): Place device in faraday environment (DFT-1010) 1ec328e2026-06-24 Updated technique (AUTOIMPLEMENT): Place device in faraday environment (DFT-1010) 1ec328e2026-06-23 Updated technique (AUTOIMPLEMENT): Read forensic image content (bitstream) (DFT-1043) 96f54b02026-06-23 Updated technique (AUTOIMPLEMENT): Read forensic image content (bitstream) (DFT-1043) 96f54b02026-06-23 Updated technique (AUTOIMPLEMENT): Read forensic image content (bitstream) (DFT-1043) 96f54b02026-06-23 Updated technique (AUTOIMPLEMENT): Read forensic image content (bitstream) (DFT-1043) 96f54b02026-06-23 Updated technique (AUTOIMPLEMENT): Read forensic image content (bitstream) (DFT-1043) 96f54b02026-06-23 Updated technique (AUTOIMPLEMENT): Read forensic image content (bitstream) (DFT-1043) 96f54b02026-06-23 Updated technique (AUTOIMPLEMENT): Read forensic image content (bitstream) (DFT-1043) 96f54b02026-06-23 Updated technique (AUTOIMPLEMENT): Read forensic image content (bitstream) (DFT-1043) 96f54b02026-06-23 Updated technique (AUTOIMPLEMENT): Read forensic image content (bitstream) (DFT-1043) 96f54b0
May 2026
2026-05-22 Updated technique (AUTOIMPLEMENT): Extract metadata from within images (DFT-1100) 8cfe75d2026-05-22 Updated technique (AUTOIMPLEMENT): Extract metadata from within images (DFT-1100) 8cfe75d2026-05-22 Updated technique (AUTOIMPLEMENT): Extract metadata from within images (DFT-1100) 8cfe75d2026-05-22 Updated technique (AUTOIMPLEMENT): Extract metadata from within images (DFT-1100) 8cfe75d2026-05-22 Updated technique (AUTOIMPLEMENT): Extract metadata from within images (DFT-1100) 8cfe75d2026-05-16 Added weakness: Important traces of user activity may remain in API responses, but if related artefacts are not thoroughly analysed, critical forensic information may be missed or misinterpreted (DFW-1323) e8b4b182026-05-16 Added weakness: API-based collection may miss some important user data due to filtering, omission of internal/undocumented endpoints, or structural changes to the API, which can lead to forensic gaps (DFW-1322) e8b4b182026-05-16 Added technique: Cloud data collection to access data via APIs using credentials (DFT-1161) e8b4b182026-05-16 Added mitigation: Cross-validate API-derived artefacts against independent sources to improve reliability (DFM-1271) e8b4b182026-05-16 Added mitigation: Systematically analyse all fields and timestamps in API responses to recover evidence that would otherwise be missed (DFM-1270) e8b4b182026-05-16 Added mitigation: Monitor structural changes to the target API and update parsing logic to prevent silent data loss (DFM-1269) e8b4b182026-05-16 Added mitigation: Collect from all available API endpoints, including internal and undocumented ones identified via client reverse engineering (DFM-1268) e8b4b182026-05-16 Added reference: DFCite-1153 e8b4b182026-05-16 Added reference: DFCite-1152 e8b4b182026-05-16 Added reference: DFCite-1151 e8b4b182026-05-14 Updated weakness (AUTOIMPLEMENT): The filtered timeline includes entries that are not relevant because the tool did not filter correctly (DFW-1298) e0fbb392026-05-14 Updated weakness (AUTOIMPLEMENT): The filtered timeline includes entries that are not relevant because the tool did not filter correctly (DFW-1298) e0fbb392026-05-14 Updated weakness (AUTOIMPLEMENT): The filtered timeline includes entries that are not relevant because the tool did not filter correctly (DFW-1298) e0fbb392026-05-14 Updated weakness (AUTOIMPLEMENT): The filtered timeline includes entries that are not relevant because the tool did not filter correctly (DFW-1298) e0fbb392026-05-14 Updated weakness (AUTOIMPLEMENT): The filtered timeline includes entries that are not relevant because the tool did not filter correctly (DFW-1298) e0fbb392026-05-14 Updated weakness (AUTOIMPLEMENT): The filtered timeline includes entries that are not relevant because the tool did not filter correctly (DFW-1298) e0fbb392026-05-14 Updated weakness (AUTOIMPLEMENT): The filtered timeline includes entries that are not relevant because the tool did not filter correctly (DFW-1298) e0fbb392026-05-14 Updated weakness (AUTOIMPLEMENT): The filtered timeline includes entries that are not relevant because the tool did not filter correctly (DFW-1298) e0fbb392026-05-14 Updated weakness (AUTOIMPLEMENT): The filtered timeline includes entries that are not relevant because the tool did not filter correctly (DFW-1298) e0fbb392026-05-14 Added mitigation (AUTOIMPLEMENT): Generate UUIDs of all timeline entries prior to a sort and ensure that all are present post-sort (DFM-1269) 8d3affd2026-05-14 Added mitigation (AUTOIMPLEMENT): Generate UUIDs of all timeline entries prior to a sort and ensure that all are present post-sort (DFM-1269) 8d3affd2026-05-14 Added mitigation (AUTOIMPLEMENT): Generate UUIDs of all timeline entries prior to a sort and ensure that all are present post-sort (DFM-1269) 8d3affd2026-05-14 Added mitigation (AUTOIMPLEMENT): Generate UUIDs of all timeline entries prior to a sort and ensure that all are present post-sort (DFM-1269) 8d3affd2026-05-14 Added mitigation (AUTOIMPLEMENT): Count timeline entries before and after sorting a timeline and check they are the same (DFM-1268) dd219f02026-05-14 Added mitigation (AUTOIMPLEMENT): Count timeline entries before and after sorting a timeline and check they are the same (DFM-1268) dd219f02026-05-14 Added mitigation (AUTOIMPLEMENT): Count timeline entries before and after sorting a timeline and check they are the same (DFM-1268) dd219f02026-05-14 Added mitigation (AUTOIMPLEMENT): Count timeline entries before and after sorting a timeline and check they are the same (DFM-1268) dd219f02026-05-14 Added mitigation (AUTOIMPLEMENT): Count timeline entries before and after sorting a timeline and check they are the same (DFM-1268) dd219f02026-05-14 Added mitigation (AUTOIMPLEMENT): Count timeline entries before and after sorting a timeline and check they are the same (DFM-1268) dd219f02026-05-14 Added mitigation (AUTOIMPLEMENT): Count timeline entries before and after sorting a timeline and check they are the same (DFM-1268) dd219f02026-05-14 Added mitigation (AUTOIMPLEMENT): Count timeline entries before and after sorting a timeline and check they are the same (DFM-1268) dd219f02026-05-14 Added mitigation (AUTOIMPLEMENT): Count timeline entries before and after sorting a timeline and check they are the same (DFM-1268) dd219f02026-05-14 Added mitigation (AUTOIMPLEMENT): Count timeline entries before and after sorting a timeline and check they are the same (DFM-1268) dd219f02026-05-07 Updated weakness: Presenting an allocated file as non-allocated (DFW-1078) 1aa4c4b2026-05-07 Updated weakness: Presenting a non-allocated file as an allocated file (DFW-1077) 1aa4c4b2026-05-07 Updated weakness: Recovering an incorrect listing of an allocated directory (DFW-1073) 1aa4c4b2026-05-07 Updated weakness: Recovering incorrect contents of an allocated file (DFW-1072) 1aa4c4b2026-05-07 Updated weakness: Failing to recover a complete listing of an allocated directory (DFW-1071) 1aa4c4b2026-05-07 Updated weakness: Failing to recover the complete contents of an allocated file (DFW-1070) 1aa4c4b2026-05-07 Updated weakness: Failing to identify the existence of an allocated directory (DFW-1069) 1aa4c4b2026-05-07 Updated weakness: Failing to identify the existence of an allocated file (DFW-1068) 1aa4c4b2026-05-07 Updated technique: Identify volumes (DFT-1168) 1aa4c4b2026-05-07 Updated technique: Enumerate allocated files and folders (DFT-1060) 1aa4c4b2026-05-05 Updated technique (AUTOIMPLEMENT): Timeline analysis (DFT-1086) db6b4ef2026-05-05 Updated technique (AUTOIMPLEMENT): Timeline analysis (DFT-1086) db6b4ef2026-05-05 Updated technique (AUTOIMPLEMENT): Timeline analysis (DFT-1086) db6b4ef2026-05-05 Updated technique (AUTOIMPLEMENT): Timeline analysis (DFT-1086) db6b4ef2026-05-05 Updated technique (AUTOIMPLEMENT): Timeline analysis (DFT-1086) db6b4ef
April 2026
2026-04-26 Added technique (AUTOIMPLEMENT): Extract content from compound files (DFT-1187) 3a978252026-04-26 Added technique (AUTOIMPLEMENT): Extract content from compound files (DFT-1187) 3a978252026-04-26 Added technique (AUTOIMPLEMENT): Extract content from compound files (DFT-1187) 3a978252026-04-26 Added technique (AUTOIMPLEMENT): Extract content from compound files (DFT-1187) 3a978252026-04-26 Added technique (AUTOIMPLEMENT): Extract content from compound files (DFT-1187) 3a978252026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added technique (AUTOIMPLEMENT): Compute per-file hash values (DFT-1186) 84b70892026-04-26 Added reference (TRWM): DFCite-1150 665c4852026-04-26 Added reference (TRWM): DFCite-1150 665c4852026-04-26 Added reference (TRWM): DFCite-1150 665c4852026-04-26 Added reference (TRWM): DFCite-1149 665c4852026-04-26 Added reference (TRWM): DFCite-1149 665c4852026-04-26 Added reference (TRWM): DFCite-1149 665c4852026-04-22 Added technique (TRWM): Extract data from OS-level notifications (DFT-1185) aba429e2026-04-22 Added technique (TRWM): Extract data from OS-level notifications (DFT-1185) aba429e2026-04-22 Added technique (TRWM): Extract data from OS-level notifications (DFT-1185) aba429e2026-04-22 Updated technique (AUTOIMPLEMENT): Browser cache examination (DFT-1138) 7bcc5962026-04-22 Added reference (AUTOIMPLEMENT): DFCite-1148 7bcc5962026-04-16 Added technique (TRWM): Sort timeline entries chronologically (DFT-1184) a2500fb2026-04-16 Added technique (TRWM): Sort timeline entries chronologically (DFT-1184) a2500fb2026-04-16 Added technique (TRWM): Sort timeline entries chronologically (DFT-1184) a2500fb
March 2026
2026-03-27 Added weakness (AUTOIMPLEMENT): Missing deleted but recoverable volumes from unpartitioned space (DFW-1300) 688253c2026-03-27 Added weakness (AUTOIMPLEMENT): Missing deleted but recoverable volumes from unpartitioned space (DFW-1300) 688253c2026-03-27 Added weakness (AUTOIMPLEMENT): Missing deleted but recoverable volumes from unpartitioned space (DFW-1300) 688253c2026-03-27 Added weakness (AUTOIMPLEMENT): Missing deleted but recoverable volumes from unpartitioned space (DFW-1300) 688253c2026-03-27 Updated technique (AUTOIMPLEMENT): Chain of custody documentation (DFT-1014) aa6a4652026-03-27 Updated technique (AUTOIMPLEMENT): Document the chain of custody (DFT-1014) 5e70b602026-03-27 Updated technique: Document the chain of custody (DFT-1014) ebff7d12026-03-27 Updated technique: Document the chain of custody (DFT-1014) 5fbddcd2026-03-27 Updated technique: Document the chain of custody (DFT-1014) 6a493372026-03-27 Added reference (AUTOIMPLEMENT): DFCite-1147 aa6a4652026-03-26 Updated technique (AUTOIMPLEMENT): Disk imaging (DFT-1002) e5428422026-03-24 Updated technique (AUTOIMPLEMENT): Access internal storage via bootable environment (DFT-1113) 5b007012026-03-24 Updated technique (AUTOIMPLEMENT): Location-based event reconstruction (DFT-1087) 103806a2026-03-24 Updated mitigation (AUTOIMPLEMENT): Estimate clock offset at a specific point in time using time anchoring (DFM-1225) 14a56c02026-03-24 Added reference (AUTOIMPLEMENT): DFCite-1146 103806a2026-03-24 Added reference (AUTOIMPLEMENT): DFCite-1020 14a56c02026-03-23 Updated technique: Filter timeline for relevant entries (DFT-1182) 98de3c72026-03-23 Updated technique (AUTOIMPLEMENT): Use time anchors to estimate clock offset (DFT-1134) fff37842026-03-23 Updated technique (AUTOIMPLEMENT): Timeline analysis (DFT-1086) f66596a2026-03-22 Added technique (TRWM): Filter timeline for relevant entries (DFT-1182) e64f1332026-03-22 Updated reference (AUTOIMPLEMENT): DFCite-1020 in DFT-1134 (DFCite-1020) be842c32026-03-22 Updated reference (AUTOIMPLEMENT): DFCite-1018 in DFT-1005 (DFCite-1018) 3d521c02026-03-21 Added technique (AUTOIMPLEMENT): Examine smart home app (DFT-1181) c001cdb2026-03-21 Added technique (AUTOIMPLEMENT): Examine smart home app (DFT-1181) c001cdb2026-03-20 Updated weakness: Tool fails to display special effects or highlight within a message (DFW-1100) 97fde6e2026-03-20 Added technique (AUTOIMPLEMENT): Extract file(s) from a pre-deletion container (DFT-1180) d0515242026-03-20 Added technique (AUTOIMPLEMENT): Extract file(s) from a pre-deletion container (DFT-1180) d0515242026-03-20 Added technique (AUTOIMPLEMENT): Extract file(s) from a pre-deletion container (DFT-1180) d0515242026-03-20 Added technique (AUTOIMPLEMENT): Extract file(s) from a pre-deletion container (DFT-1180) d0515242026-03-20 Added technique (AUTOIMPLEMENT): Extract file(s) from a pre-deletion container (DFT-1180) d0515242026-03-20 Added technique (AUTOIMPLEMENT): Extract file(s) from a pre-deletion container (DFT-1180) d0515242026-03-20 Added technique (AUTOIMPLEMENT): Extract file(s) from a pre-deletion container (DFT-1180) d0515242026-03-20 Added technique (AUTOIMPLEMENT): Extract file(s) from a pre-deletion container (DFT-1180) d0515242026-03-20 Added technique (AUTOIMPLEMENT): Extract file(s) from a pre-deletion container (DFT-1180) d0515242026-03-20 Added technique (AUTOIMPLEMENT): Extract file(s) from a pre-deletion container (DFT-1180) d0515242026-03-20 Updated technique (AUTOIMPLEMENT): Keyword search (indexed) (DFT-1124) 703df2a2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword search (indexed) (DFT-1124) 703df2a2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword search (indexed) (DFT-1124) 703df2a2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword search (indexed) (DFT-1124) 703df2a2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword search (indexed) (DFT-1124) 703df2a2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword search (indexed) (DFT-1124) 703df2a2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword search (indexed) (DFT-1124) 703df2a2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword search (indexed) (DFT-1124) 703df2a2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword search (case-type wordlists) (DFT-1122) f0f969d2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword indexing (DFT-1121) 11a07882026-03-20 Updated technique (AUTOIMPLEMENT): Keyword indexing (DFT-1121) 11a07882026-03-20 Updated technique (AUTOIMPLEMENT): Keyword indexing (DFT-1121) 11a07882026-03-20 Updated technique (AUTOIMPLEMENT): Keyword indexing (DFT-1121) 11a07882026-03-20 Updated technique (AUTOIMPLEMENT): Keyword indexing (DFT-1121) 11a07882026-03-20 Updated technique (AUTOIMPLEMENT): Keyword indexing (DFT-1121) 11a07882026-03-20 Updated technique (AUTOIMPLEMENT): Keyword indexing (DFT-1121) 11a07882026-03-20 Updated technique (AUTOIMPLEMENT): Keyword indexing (DFT-1121) 11a07882026-03-20 Updated technique (AUTOIMPLEMENT): Keyword indexing (DFT-1121) 11a07882026-03-20 Updated technique (AUTOIMPLEMENT): Keyword searching (DFT-1049) f90c0ec2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword searching (DFT-1049) f90c0ec2026-03-20 Updated technique (AUTOIMPLEMENT): Keyword searching (DFT-1049) f90c0ec2026-03-20 Updated technique (AUTOIMPLEMENT): Obtain encryption key information using side channel attacks (DFT-1032) 75ba0f02026-03-20 Updated technique (AUTOIMPLEMENT): Writing data to standard archive format (DFT-1026) f64bd882026-03-20 Updated technique (AUTOIMPLEMENT): Writing data to standard archive format (DFT-1026) f64bd882026-03-20 Updated technique (AUTOIMPLEMENT): Writing data to standard archive format (DFT-1026) f64bd882026-03-20 Updated technique (AUTOIMPLEMENT): Writing data to standard archive format (DFT-1026) f64bd882026-03-20 Updated technique (AUTOIMPLEMENT): Writing data to standard archive format (DFT-1026) f64bd882026-03-20 Updated technique (AUTOIMPLEMENT): Writing data to standard archive format (DFT-1026) f64bd882026-03-20 Updated technique (AUTOIMPLEMENT): Writing data to standard archive format (DFT-1026) f64bd882026-03-20 Updated technique (AUTOIMPLEMENT): Writing data to standard archive format (DFT-1026) f64bd882026-03-20 Updated technique (AUTOIMPLEMENT): Writing data to standard archive format (DFT-1026) f64bd882026-03-20 Updated technique (AUTOIMPLEMENT): Writing data to standard archive format (DFT-1026) f64bd882026-03-20 Updated mitigation: Manually verify relevant data (DFM-1050) 97fde6e2026-03-20 Updated mitigation: Use dual tool verification (DFM-1027) 97fde6e2026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1060 in DFT-1063 (DFCite-1060) c33d4732026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1060 in DFT-1063 (DFCite-1060) c33d4732026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1060 in DFT-1063 (DFCite-1060) c33d4732026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1060 in DFT-1063 (DFCite-1060) c33d4732026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1060 in DFT-1063 (DFCite-1060) c33d4732026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1060 in DFT-1063 (DFCite-1060) c33d4732026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1060 in DFT-1063 (DFCite-1060) c33d4732026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1060 in DFT-1063 (DFCite-1060) c33d4732026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1060 in DFT-1063 (DFCite-1060) c33d4732026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1059 in DFT-1149 (DFCite-1059) 6e82c312026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1059 in DFT-1149 (DFCite-1059) 6e82c312026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1059 in DFT-1149 (DFCite-1059) 6e82c312026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1059 in DFT-1149 (DFCite-1059) 6e82c312026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1059 in DFT-1149 (DFCite-1059) 6e82c312026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1059 in DFT-1149 (DFCite-1059) 6e82c312026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1059 in DFT-1149 (DFCite-1059) 6e82c312026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1059 in DFT-1149 (DFCite-1059) 6e82c312026-03-20 Updated reference (AUTOIMPLEMENT): DFCite-1059 in DFT-1149 (DFCite-1059) 6e82c312026-03-19 Bulk change: 271 updated items 726212a2026-03-19 Updated weakness: Presenting a deleted contact from a gaming app that does not exist (DFW-1294) 8f5a23f2026-03-19 Updated weakness: Presenting a deleted contact from a gaming app that does not exist (DFW-1294) 8f5a23f2026-03-19 Updated weakness: Presenting a deleted contact from a gaming app that does not exist (DFW-1294) 8f5a23f2026-03-19 Updated weakness: Presenting a deleted contact from a gaming app that does not exist (DFW-1294) 8f5a23f2026-03-19 Updated weakness: Presenting a live contact from a gaming app that does not exist (DFW-1293) 8f5a23f2026-03-19 Updated weakness: Presenting a live contact from a gaming app that does not exist (DFW-1293) 8f5a23f2026-03-19 Updated weakness: Presenting a live contact from a gaming app that does not exist (DFW-1293) 8f5a23f2026-03-19 Updated weakness: Presenting a live contact from a gaming app that does not exist (DFW-1293) 8f5a23f2026-03-19 Updated weakness: Failure to recover a deleted contact from a gaming app (DFW-1292) 8f5a23f2026-03-19 Updated weakness: Failure to recover a deleted contact from a gaming app (DFW-1292) 8f5a23f2026-03-19 Updated weakness: Failure to recover a deleted contact from a gaming app (DFW-1292) 8f5a23f2026-03-19 Updated weakness: Failure to recover a deleted contact from a gaming app (DFW-1292) 8f5a23f2026-03-19 Updated weakness: Failure to recover a live contact from a gaming app (DFW-1291) 8f5a23f2026-03-19 Updated weakness: Failure to recover a live contact from a gaming app (DFW-1291) 8f5a23f2026-03-19 Updated weakness: Failure to recover a live contact from a gaming app (DFW-1291) 8f5a23f2026-03-19 Updated weakness: Failure to recover a live contact from a gaming app (DFW-1291) 8f5a23f2026-03-19 Updated weakness: Presenting a live message from a gaming app as deleted or vice versa (DFW-1290) 8f5a23f2026-03-19 Updated weakness: Presenting a live message from a gaming app as deleted or vice versa (DFW-1290) 8f5a23f2026-03-19 Updated weakness: Presenting a live message from a gaming app as deleted or vice versa (DFW-1290) 8f5a23f2026-03-19 Updated weakness: Presenting a live message from a gaming app as deleted or vice versa (DFW-1290) 8f5a23f2026-03-19 Updated weakness: Presenting a deleted message from a gaming app that does not exist (DFW-1289) 8f5a23f2026-03-19 Updated weakness: Presenting a deleted message from a gaming app that does not exist (DFW-1289) 8f5a23f2026-03-19 Updated weakness: Presenting a deleted message from a gaming app that does not exist (DFW-1289) 8f5a23f2026-03-19 Updated weakness: Presenting a deleted message from a gaming app that does not exist (DFW-1289) 8f5a23f2026-03-19 Updated weakness: Presenting a live message from a gaming app that does not exist (DFW-1288) 8f5a23f2026-03-19 Updated weakness: Presenting a live message from a gaming app that does not exist (DFW-1288) 8f5a23f2026-03-19 Updated weakness: Presenting a live message from a gaming app that does not exist (DFW-1288) 8f5a23f2026-03-19 Updated weakness: Presenting a live message from a gaming app that does not exist (DFW-1288) 8f5a23f2026-03-19 Updated weakness: Failure to recover deleted message from a multiplayer gaming app (DFW-1287) 8f5a23f2026-03-19 Updated weakness: Failure to recover deleted message from a multiplayer gaming app (DFW-1287) 8f5a23f2026-03-19 Updated weakness: Failure to recover deleted message from a multiplayer gaming app (DFW-1287) 8f5a23f2026-03-19 Updated weakness: Failure to recover deleted message from a multiplayer gaming app (DFW-1287) 8f5a23f2026-03-19 Updated weakness: Describing a live gaming app account as deleted/removed or vice versa (DFW-1286) 8f5a23f2026-03-19 Updated weakness: Describing a live gaming app account as deleted/removed or vice versa (DFW-1286) 8f5a23f2026-03-19 Updated weakness: Describing a live gaming app account as deleted/removed or vice versa (DFW-1286) 8f5a23f2026-03-19 Updated weakness: Describing a live gaming app account as deleted/removed or vice versa (DFW-1286) 8f5a23f2026-03-19 Updated weakness: Recovering an account used for a gaming application that was not actually used (DFW-1285) 8f5a23f2026-03-19 Updated weakness: Recovering an account used for a gaming application that was not actually used (DFW-1285) 8f5a23f2026-03-19 Updated weakness: Recovering an account used for a gaming application that was not actually used (DFW-1285) 8f5a23f2026-03-19 Updated weakness: Recovering an account used for a gaming application that was not actually used (DFW-1285) 8f5a23f2026-03-19 Updated weakness: Failure to recover a previous but removed account used in a gaming application (DFW-1284) 8f5a23f2026-03-19 Updated weakness: Failure to recover a previous but removed account used in a gaming application (DFW-1284) 8f5a23f2026-03-19 Updated weakness: Failure to recover a previous but removed account used in a gaming application (DFW-1284) 8f5a23f2026-03-19 Updated weakness: Failure to recover a previous but removed account used in a gaming application (DFW-1284) 8f5a23f2026-03-19 Updated weakness: Failure to recover a live account used in a gaming application (DFW-1283) 8f5a23f2026-03-19 Updated weakness: Failure to recover a live account used in a gaming application (DFW-1283) 8f5a23f2026-03-19 Updated weakness: Failure to recover a live account used in a gaming application (DFW-1283) 8f5a23f2026-03-19 Updated weakness: Failure to recover a live account used in a gaming application (DFW-1283) 8f5a23f2026-03-19 Updated weakness: Recovering the gaming app configuration incorrectly (DFW-1282) 8f5a23f2026-03-19 Updated weakness: Recovering the gaming app configuration incorrectly (DFW-1282) 8f5a23f2026-03-19 Updated weakness: Recovering the gaming app configuration incorrectly (DFW-1282) 8f5a23f2026-03-19 Updated weakness: Recovering the gaming app configuration incorrectly (DFW-1282) 8f5a23f2026-03-19 Updated weakness: Failure to recover the gaming app configuration (DFW-1281) 8f5a23f2026-03-19 Updated weakness: Failure to recover the gaming app configuration (DFW-1281) 8f5a23f2026-03-19 Updated weakness: Failure to recover the gaming app configuration (DFW-1281) 8f5a23f2026-03-19 Updated weakness: Failure to recover the gaming app configuration (DFW-1281) 8f5a23f2026-03-19 Updated weakness: Presenting a live contact from a gaming app as a deleted one or vice versa (DFW-1280) 8f5a23f2026-03-19 Updated weakness: Presenting a live contact from a gaming app as a deleted one or vice versa (DFW-1280) 8f5a23f2026-03-19 Updated weakness: Presenting a live contact from a gaming app as a deleted one or vice versa (DFW-1280) 8f5a23f2026-03-19 Updated weakness: Presenting a live contact from a gaming app as a deleted one or vice versa (DFW-1280) 8f5a23f2026-03-19 Updated weakness: Failure to recover live message from a multiplayer gaming app (DFW-1279) 8f5a23f2026-03-19 Updated weakness: Failure to recover live message from a multiplayer gaming app (DFW-1279) 8f5a23f2026-03-19 Updated weakness: Failure to recover live message from a multiplayer gaming app (DFW-1279) 8f5a23f2026-03-19 Updated weakness: Failure to recover live message from a multiplayer gaming app (DFW-1279) 8f5a23f2026-03-19 Added technique (AUTOIMPLEMENT): Drone app examination (DFT-1179) a80bb252026-03-19 Added technique (AUTOIMPLEMENT): Drone app examination (DFT-1179) a80bb252026-03-19 Added technique (AUTOIMPLEMENT): Drone app examination (DFT-1179) a80bb252026-03-19 Added technique (AUTOIMPLEMENT): Drone app examination (DFT-1179) a80bb252026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) d389e0a2026-03-19 Updated technique (AUTOIMPLEMENT): Recover non-allocated files using residual file metadata (DFT-1150) 2a9f18b2026-03-19 Updated technique (AUTOIMPLEMENT): Recover non-allocated files using residual file metadata (DFT-1150) 2a9f18b2026-03-19 Updated technique (AUTOIMPLEMENT): Recover non-allocated files using residual file metadata (DFT-1150) 2a9f18b2026-03-19 Updated technique (AUTOIMPLEMENT): Recover non-allocated files using residual file metadata (DFT-1150) 2a9f18b2026-03-19 Updated technique (AUTOIMPLEMENT): Recover non-allocated files using residual file metadata (DFT-1150) 2a9f18b2026-03-19 Added reference (AUTOIMPLEMENT): DFCite-1144 2090def2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-19 Updated reference (AUTOIMPLEMENT): DFCite-1058 in DFT-1052 (DFCite-1058) 78581bf2026-03-18 Updated weakness (AUTOIMPLEMENT): Data referenced in memory is located within pagefile or swapfile but is not collected (DFW-1033) 6d0842f2026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Added technique (AUTOIMPLEMENT): Configuration file examination (DFT-1165) 361e6762026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique (AUTOIMPLEMENT): Recover non-allocated files (DFT-1061) 6e6037b2026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Updated technique: Selective file acquisition (DFT-1004) 400d4422026-03-18 Added mitigation (AUTOIMPLEMENT): Check for indications of disk backed memory pages (DFM-1240) b37bd4c2026-03-18 Added reference (AUTOIMPLEMENT): DFCite-1143 db276fc2026-03-18 Updated reference (AUTOIMPLEMENT): DFCite-1057 in DFT-1007 (DFCite-1057) 751623f2026-03-17 Added technique: Writing bitstream data to a raw image format (DFT-1178) 9f7a6e02026-03-17 Added technique: Writing bitstream data to a raw image format (DFT-1178) 9f7a6e02026-03-17 Added technique: Writing bitstream data to a raw image format (DFT-1178) 9f7a6e02026-03-17 Added technique: Writing bitstream data to a raw image format (DFT-1178) 9f7a6e02026-03-17 Updated technique: Examination of a mutiplayer game app (DFT-1177) dcdf33c2026-03-17 Updated technique: Examination of a mutiplayer game app (DFT-1177) dcdf33c2026-03-17 Updated technique: Examination of a mutiplayer game app (DFT-1177) dcdf33c2026-03-17 Updated technique: Examination of a mutiplayer game app (DFT-1177) dcdf33c2026-03-17 Updated technique: Filter files related to an application (DFT-1169) dcdf33c2026-03-17 Updated technique: Filter files related to an application (DFT-1169) dcdf33c2026-03-17 Updated technique: Filter files related to an application (DFT-1169) dcdf33c2026-03-17 Updated technique: Filter files related to an application (DFT-1169) dcdf33c2026-03-17 Updated technique: Operation-based event reconstruction (DFT-1155) ca4fe292026-03-17 Updated technique: Operation-based event reconstruction (DFT-1155) ca4fe292026-03-17 Updated technique: Operation-based event reconstruction (DFT-1155) ca4fe292026-03-17 Updated technique: Operation-based event reconstruction (DFT-1155) ca4fe292026-03-17 Updated technique: Use time anchors to estimate clock offset (DFT-1134) 3f0b2e12026-03-17 Updated technique: Use time anchors to estimate clock offset (DFT-1134) 3f0b2e12026-03-17 Updated technique: Use time anchors to estimate clock offset (DFT-1134) 3f0b2e12026-03-17 Updated technique: Use time anchors to estimate clock offset (DFT-1134) 3f0b2e12026-03-17 Updated technique: AI companion app examination (DFT-1133) 3f0b2e12026-03-17 Updated technique: AI companion app examination (DFT-1133) 3f0b2e12026-03-17 Updated technique: AI companion app examination (DFT-1133) 3f0b2e12026-03-17 Updated technique: AI companion app examination (DFT-1133) 3f0b2e12026-03-17 Updated technique: Relational-based event reconstruction (DFT-1088) ca4fe292026-03-17 Updated technique: Relational-based event reconstruction (DFT-1088) ca4fe292026-03-17 Updated technique: Relational-based event reconstruction (DFT-1088) ca4fe292026-03-17 Updated technique: Relational-based event reconstruction (DFT-1088) ca4fe292026-03-17 Updated technique: Calendar app examination (DFT-1073) 3f0b2e12026-03-17 Updated technique: Calendar app examination (DFT-1073) 3f0b2e12026-03-17 Updated technique: Calendar app examination (DFT-1073) 3f0b2e12026-03-17 Updated technique: Calendar app examination (DFT-1073) 3f0b2e12026-03-17 Updated technique: Chat app examination (DFT-1072) 3f0b2e12026-03-17 Updated technique: Chat app examination (DFT-1072) 3f0b2e12026-03-17 Updated technique: Chat app examination (DFT-1072) 3f0b2e12026-03-17 Updated technique: Chat app examination (DFT-1072) 3f0b2e12026-03-17 Updated technique: Email examination (DFT-1070) 3f0b2e12026-03-17 Updated technique: Email examination (DFT-1070) 3f0b2e12026-03-17 Updated technique: Email examination (DFT-1070) 3f0b2e12026-03-17 Updated technique: Email examination (DFT-1070) 3f0b2e12026-03-17 Updated technique: Browser examination (DFT-1069) 3f0b2e12026-03-17 Updated technique: Browser examination (DFT-1069) 3f0b2e12026-03-17 Updated technique: Browser examination (DFT-1069) 3f0b2e12026-03-17 Updated technique: Browser examination (DFT-1069) 3f0b2e12026-03-17 Updated technique: Writing bitstream data to a forensic image format (DFT-1025) 9f7a6e02026-03-17 Updated technique: Writing bitstream data to a forensic image format (DFT-1025) 9f7a6e02026-03-17 Updated technique: Writing bitstream data to a forensic image format (DFT-1025) 9f7a6e02026-03-17 Updated technique: Writing bitstream data to a forensic image format (DFT-1025) 9f7a6e02026-03-17 Updated technique (TRWM): Digital sniffer dogs (DFT-1006) 3da08f42026-03-17 Added reference: DFCite-1143 9f7a6e02026-03-17 Added reference: DFCite-1143 9f7a6e02026-03-17 Added reference: DFCite-1143 9f7a6e02026-03-17 Added reference: DFCite-1143 9f7a6e02026-03-16 Updated weakness: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected (DFW-1134) 137c6d12026-03-16 Updated weakness: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected (DFW-1134) 137c6d12026-03-16 Updated weakness: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected (DFW-1134) 137c6d12026-03-16 Updated weakness: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected (DFW-1134) 137c6d12026-03-16 Added technique: Writing bitstream data to a raw image format (DFT-1177) d7ca6452026-03-16 Added technique: Writing bitstream data to a raw image format (DFT-1177) d7ca6452026-03-16 Added technique: Writing bitstream data to a raw image format (DFT-1177) d7ca6452026-03-16 Added technique: Writing bitstream data to a raw image format (DFT-1177) d7ca6452026-03-16 Updated technique: Recover non-allocated files using residual file metadata (DFT-1150) 85592c82026-03-16 Updated technique: Recover non-allocated files using residual file metadata (DFT-1150) 85592c82026-03-16 Updated technique: Recover non-allocated files using residual file metadata (DFT-1150) 85592c82026-03-16 Updated technique: Recover non-allocated files using residual file metadata (DFT-1150) 85592c82026-03-16 Updated technique: Access internal storage via bootable environment (DFT-1113) bbeae8c2026-03-16 Updated technique: Access internal storage via bootable environment (DFT-1113) bbeae8c2026-03-16 Updated technique: Access internal storage via bootable environment (DFT-1113) bbeae8c2026-03-16 Updated technique: Access internal storage via bootable environment (DFT-1113) bbeae8c2026-03-16 Updated technique: Writing bitstream data to a forensic image format (DFT-1025) d7ca6452026-03-16 Updated technique: Writing bitstream data to a forensic image format (DFT-1025) d7ca6452026-03-16 Updated technique: Writing bitstream data to a forensic image format (DFT-1025) d7ca6452026-03-16 Updated technique: Writing bitstream data to a forensic image format (DFT-1025) d7ca6452026-03-16 Updated technique: Use software write blockers to provide read only access to storage media (DFT-1013) bbeae8c2026-03-16 Updated technique: Use software write blockers to provide read only access to storage media (DFT-1013) bbeae8c2026-03-16 Updated technique: Use software write blockers to provide read only access to storage media (DFT-1013) bbeae8c2026-03-16 Updated technique: Use software write blockers to provide read only access to storage media (DFT-1013) bbeae8c2026-03-16 Updated technique: Disk imaging (DFT-1002) bbeae8c2026-03-16 Updated technique: Disk imaging (DFT-1002) bbeae8c2026-03-16 Updated technique: Disk imaging (DFT-1002) bbeae8c2026-03-16 Updated technique: Disk imaging (DFT-1002) bbeae8c2026-03-16 Updated mitigation: Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file (DFM-1082) 07ef04e2026-03-16 Updated mitigation: Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file (DFM-1082) 07ef04e2026-03-16 Updated mitigation: Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file (DFM-1082) 07ef04e2026-03-16 Updated mitigation: Analyse file system to find any duplicate references to blocks that are referenced by the non-allocated file (DFM-1082) 07ef04e2026-03-16 Updated mitigation: Check if recovered content matches with size in metadata e.g. file footer at expected location. (DFM-1081) 137c6d12026-03-16 Updated mitigation: Check if recovered content matches with size in metadata e.g. file footer at expected location. (DFM-1081) 137c6d12026-03-16 Updated mitigation: Check if recovered content matches with size in metadata e.g. file footer at expected location. (DFM-1081) 137c6d12026-03-16 Updated mitigation: Check if recovered content matches with size in metadata e.g. file footer at expected location. (DFM-1081) 137c6d12026-03-16 Updated mitigation: Analyse file content to detect incompatibility between the content and the recovered file system metadata (DFM-1079) 07ef04e2026-03-16 Updated mitigation: Analyse file content to detect incompatibility between the content and the recovered file system metadata (DFM-1079) 07ef04e2026-03-16 Updated mitigation: Analyse file content to detect incompatibility between the content and the recovered file system metadata (DFM-1079) 07ef04e2026-03-16 Updated mitigation: Analyse file content to detect incompatibility between the content and the recovered file system metadata (DFM-1079) 07ef04e2026-03-15 Updated technique (TRWM): App downgrade (DFT-1039) 772cd302026-03-14 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) 9d2e50f2026-03-14 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) 9d2e50f2026-03-14 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) 9d2e50f2026-03-14 Added technique (TRWM): Examination of a mutiplayer game app (DFT-1177) 9d2e50f2026-03-14 Added technique: Identification of synthetic images (DFT-1176) 8d1e3a32026-03-13 Updated technique: Extract references to connected devices (DFT-1116) 5dc8e0e2026-03-13 Updated technique: Extract references to connected devices (DFT-1116) 5dc8e0e2026-03-13 Updated technique: Extract references to connected devices (DFT-1116) 5dc8e0e2026-03-13 Updated technique: Extract references to connected devices (DFT-1116) 5dc8e0e2026-03-13 Updated technique: Recover non-allocated files (DFT-1061) dd19e042026-03-13 Updated technique: Recover non-allocated files (DFT-1061) dd19e042026-03-13 Updated technique: Recover non-allocated files (DFT-1061) dd19e042026-03-13 Updated technique: Recover non-allocated files (DFT-1061) dd19e042026-03-12 Added technique: Extract software configuration information (DFT-1165) 6baf9452026-03-12 Added technique: Extract software configuration information (DFT-1165) 6baf9452026-03-12 Added technique: Extract software configuration information (DFT-1165) 6baf9452026-03-12 Added technique: Extract software configuration information (DFT-1165) 6baf9452026-03-12 Updated technique: Recover non-allocated files (DFT-1061) 91196fe2026-03-12 Updated technique: Recover non-allocated files (DFT-1061) 91196fe2026-03-12 Updated technique: Recover non-allocated files (DFT-1061) 91196fe2026-03-12 Updated technique: Recover non-allocated files (DFT-1061) 91196fe2026-03-12 Updated technique: Triage (DFT-1001) 4dd2e732026-03-11 Deleted weakness: Data copied does not include all sectors from LBA0 to LBA max due to the data copying process skipping some sectors or bytes (W1278) 8f41da02026-03-11 Added weakness: Data copied does not include all sectors from LBA0 to LBA max due to the data copying process skipping some sectors or bytes (DFW-1278) 477e4c02026-03-11 Deleted weakness: Failure to decrypt internal disk using a bootable environment (DFW-1181) 8f41da02026-03-11 Deleted weakness: Failure to decrypt internal disk using a bootable environment (DFW-1181) 477e4c02026-03-10 Updated technique: Direct data read from a block device (T1164) 895d7442026-03-10 Updated technique: Access internal storage via bootable environment (T1113) 895d7442026-03-10 Updated technique: Use software write blockers to provide read only access to storage media (T1013) 895d7442026-03-10 Updated technique: Disk imaging (T1002) 895d7442026-03-10 Bulk change: 480 renamed, 195 added, 195 deleted items fac8ba92026-03-10 Bulk change: 143 added, 183 updated items 2733add2026-03-09 Added weakness: Data copied does not include all sectors from LBA0 to LBA max due to the data copying process skipping some sectors or bytes (W1278) dd5630a2026-03-09 Updated weakness: Data is not read from remapped sectors e.g. G-Lists during the acquisition process (W1143) e47bb0a2026-03-09 Updated weakness: Data cannot be read from a device du to the device having failed physically (W1136) e47bb0a2026-03-09 Updated weakness: Disk image has been replaced with tampered version along with updated stored hash (W1128) e47bb0a2026-03-09 Updated weakness: Failure to validate disk image metadata (W1127) e47bb0a2026-03-09 Updated weakness: Failure to validate hash properly during disk image verification (W1125) e47bb0a2026-03-09 Updated weakness: Failure to compute hash of source device correctly during disk image verification (W1124) e47bb0a2026-03-09 Updated weakness: Data copied from sectors on source device are not transferred correctly for storage (W1016) e47bb0a2026-03-09 Updated weakness: Accessing the drive to copy data changes original data (W1014) e47bb0a2026-03-09 Updated weakness: During acquisition the data copying process results in extra bytes (W1013) e47bb0a2026-03-09 Updated weakness: Acquisition tool does not copy data from DCO (W1007) e47bb0a2026-03-09 Updated weakness: Acquisition tool does not copy data from HPA (W1006) e47bb0a2026-03-09 Updated weakness: Data copied does not include all sectors from LBA0 to LBA max due to the data copying process stopping prematurely (W1004) dd5630a2026-03-09 Updated technique: Hash verification of source device against stored data (T1042) e47bb0a2026-03-09 Updated technique: Disk imaging (T1002) dd5630a2026-03-06 Deleted weakness: Failure to decrypt internal disk using a bootable environment (W1181) 2c477562026-03-06 Updated technique: Operation-based event reconstruction (T1155) 14ea01e2026-03-06 Updated technique: Identity-based event reconstruction (T1154) 14ea01e2026-03-06 Updated technique: Access internal storage via bootable environment (T1113) 14ea01e2026-03-06 Updated technique: EXIF data extraction (T1100) 14ea01e2026-03-06 Updated technique: User account analysis (OS) (T1098) 14ea01e2026-03-06 Updated technique: Installed programs identification (OS) (T1097) 14ea01e2026-03-06 Updated technique: Run programs identification (OS) (T1096) 14ea01e2026-03-06 Updated technique: Instrumentation (T1095) 14ea01e2026-03-06 Updated technique: Disclosure (T1094) 14ea01e2026-03-06 Updated technique: Experimentation (T1090) 14ea01e2026-03-06 Updated technique: Source code review (T1089) 14ea01e2026-03-06 Updated technique: Identify conflation (T1085) 14ea01e2026-03-06 Updated technique: Extraction of user accounts (T1084) 14ea01e2026-03-06 Updated technique: Document content analysis (T1082) 14ea01e2026-03-06 Updated technique: Image content analysis (T1081) 14ea01e2026-03-06 Updated technique: Video content analysis (T1080) 14ea01e2026-03-06 Updated technique: Audio content analysis (T1079) 14ea01e2026-03-06 Updated technique: Maps/travel app examination (T1075) 2d994bd2026-03-06 Updated technique: Recently used file identification (OS) (T1068) 14ea01e2026-03-06 Updated technique: Cloud synchronisation feature examination (OS) (T1067) 14ea01e2026-03-06 Updated technique: Log file examination (OS) (T1066) 14ea01e2026-03-06 Updated technique: Decryption of encrypted file systems/volumes (T1062) 14ea01e2026-03-06 Updated technique: Entity connection enumeration (T1056) 14ea01e2026-03-06 Updated technique: File system content inspection (T1055) 14ea01e2026-03-06 Updated technique: Entity extraction (T1053) 14ea01e2026-03-06 Updated technique: Fuzzy hash matching (T1051) 14ea01e2026-03-06 Updated technique: Hash matching (locate) (T1050) 14ea01e2026-03-06 Updated technique: Hash matching (reduce) (T1047) 14ea01e2026-03-06 Updated technique: Pin2Pwn (T1041) 14ea01e2026-03-06 Updated technique: Rainbow table-based password attack (T1038) 14ea01e2026-03-06 Updated technique: Side channel (T1032) 14ea01e2026-03-06 Updated technique: Data read from unmanaged NAND (T1030) 14ea01e2026-03-06 Updated technique: Chip-off (T1028) 14ea01e2026-03-06 Updated technique: Data read using JTAG (T1027) 14ea01e2026-03-06 Updated technique: Remote data collection (T1018) 14ea01e2026-03-06 Updated technique: Privacy preserving selective extraction (T1015) 14ea01e2026-03-06 Updated technique: Chain of custody documentation (T1014) 14ea01e2026-03-05 Updated technique: Extract data using content queries (T1175) be9fb4a2026-03-05 Updated technique: Filter files related to an application (T1169) be9fb4a2026-03-05 Updated technique: Collect data with ‘cloud backup restore’ approach (T1160) 2e13e672026-03-05 Updated technique: Browser history examination (T1137) be9fb4a2026-03-05 Updated technique: AI companion app examination (T1133) be9fb4a2026-03-05 Updated technique: Payment app examination (T1109) be9fb4a2026-03-05 Updated technique: Reminders app examination (T1108) be9fb4a2026-03-05 Updated technique: Health/Fitness app examination (T1107) be9fb4a2026-03-05 Updated technique: Photos app examination (T1077) be9fb4a2026-03-05 Updated technique: Maps/travel app examination (T1075) be9fb4a2026-03-05 Updated technique: Social network app examination (T1074) be9fb4a2026-03-05 Updated technique: Calendar app examination (T1073) be9fb4a2026-03-05 Updated technique: Chat app examination (T1072) be9fb4a2026-03-05 Updated technique: Email examination (T1070) be9fb4a2026-03-05 Updated technique: Browser examination (T1069) be9fb4a2026-03-05 Updated technique: Writing bitstream data to a forensic image format (T1025) d868a1a2026-03-05 Updated technique: Memory imaging (T1003) e6f71dc2026-03-03 Added technique: Extract data using content queries (T1175) 2b1f57e2026-03-03 Added technique: Read evidential files stored directly on local file system (T1174) 2b1f57e2026-03-03 Added technique: Extract data from captured screenshots (T1173) 2b1f57e2026-03-03 Added technique: Read data from raw image (T1172) e95f4552026-03-03 Updated technique: Access raw image content (T1172) afcdabd2026-03-03 Updated technique: Automated screenshot-based capture of a mobile device (T1163) 2b1f57e2026-03-03 Updated technique: Extract mobile data via deployed agent (T1159) 2b1f57e2026-03-03 Updated technique: Extract device data using exposed service (T1157) 2b1f57e2026-03-03 Updated technique: Determine connected devices (T1116) afec9392026-03-03 Updated technique: Decode standard archive format (T1045) 2b1f57e2026-03-03 Updated technique: Mobile backup decoding (T1044) 2b1f57e2026-03-03 Updated technique: Access forensic image content (bitstream) (T1043) afcdabd2026-03-03 Updated technique: Writing data to standard archive format (T1026) 2b1f57e2026-03-03 Updated technique: Writing bitstream data to a forensic image format (T1025) afcdabd2026-03-03 Updated technique: Mobile device screenshot based capture (T1022) 2b1f57e2026-03-03 Updated technique: Mobile file system extraction (T1020) 2b1f57e2026-03-03 Updated technique: Mobile backup extraction (T1019) 2b1f57e2026-03-03 Updated technique: Memory imaging (T1003) afcdabd2026-03-02 Updated weakness: Relevant data is overwritten by deploying an agent to a mobile device (W1276) 80a2c342026-03-02 Updated weakness: Failure to store data due to size limitations of archive format used (W1275) 80a2c342026-03-02 Updated weakness: Inability to enable required service due to locked device (W1274) 80a2c342026-03-02 Updated weakness: Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device (W1273) 80a2c342026-03-02 Updated weakness: Failure to preserve all relevant timestamps of files obtained using exposed services on a device (W1272) 80a2c342026-03-02 Updated weakness: Inability to access required service as it is not enabled (W1271) 80a2c342026-03-02 Updated weakness: Inability to create a device backup due to locked device (W1270) 80a2c342026-03-02 Updated weakness: Failure to detect internal disk from bootable environment (W1179) 80a2c342026-03-02 Updated weakness: Inability to load the forensic bootable environment due to system configuration (W1178) 80a2c342026-03-02 Updated weakness: Relevant reference data missed as its necessity was not known at time of preservation (W1172) 80a2c342026-03-02 Added technique: Access file system via live operating system (T1171) fa68cf02026-03-02 Updated technique: Automated screenshot-based capture of a mobile device (T1163) 80a2c342026-03-02 Updated technique: Use time anchors to estimate clock offset (T1134) 80a2c342026-03-02 Updated technique: Recording system clock offset (T1111) 80a2c342026-03-02 Updated technique: Access data from a desoldered eMMC via a chip reader (T1029) 80a2c342026-03-02 Updated technique: Writing data to a forensic image format (T1025) 80a2c342026-03-02 Updated technique: Memory imaging (T1003) 80a2c342026-03-02 Updated technique: Disk imaging (T1002) 80a2c342026-03-02 Updated mitigation: Obtain possible passwords/PIN codes from other devices with limited security (M1239) 80a2c342026-03-02 Updated mitigation: Configure device to enable required service (M1238) 80a2c342026-03-02 Updated mitigation: Ensure that archive format used can handle sufficiently large files (M1237) 80a2c342026-03-02 Updated mitigation: Attempt to obtain password/pincode with dictionary attacks (M1236) 80a2c342026-03-02 Updated mitigation: Attempt to obtain password/pincode with brute force attacks (M1235) 80a2c342026-03-02 Updated mitigation: Exploit device to facilitate password/pincode attacks (M1234) 80a2c342026-03-02 Updated mitigation: Test data extraction methods against reference data with known timestamps (M1233) 80a2c342026-03-02 Updated mitigation: Use a brute force attack instead (M1091) 80a2c34
February 2026
2026-02-27 Added technique: Decode forensic image format (logical) (T1170) 824962c2026-02-27 Added technique: Filter files related to an application (T1169) 90ecb8b2026-02-27 Updated technique: Identify volumes (T1168) 824962c2026-02-27 Updated technique: Identify volumes (T1168) 1a8001d2026-02-27 Added technique: Direct data read from a block device (T1164) 824962c2026-02-27 Updated technique: Direct data read from a block device (T1164) 1a8001d2026-02-27 Updated technique: Identify partitions (T1059) 824962c2026-02-27 Updated technique: Identify partitions (T1059) 1a8001d2026-02-27 Updated technique: Decode forensic image format (bitstream) (T1043) 824962c2026-02-27 Updated technique: Decode forensic image format (bitstream) (T1043) 1a8001d2026-02-27 Updated technique: Access data from a desoldered eMMC via a chip reader (T1029) 824962c2026-02-27 Updated technique: Writing bitstream data to a forensic image format (T1025) 824962c2026-02-27 Updated technique: Selective file acquisition (T1004) 824962c2026-02-27 Updated technique: Selective file acquisition (T1004) 18663582026-02-27 Updated technique: Disk imaging (T1002) 824962c2026-02-26 Updated technique: Operation-based event reconstruction (T1155) 822d6ec2026-02-26 Updated technique: Browser cache examination (T1138) feb1ca02026-02-26 Updated technique: Browser cache examination (T1138) 4077b502026-02-26 Updated technique: Time-based event reconstruction (T1117) 822d6ec2026-02-26 Updated technique: Enumerate allocated files and folders (T1060) 402bd8e2026-02-25 Added technique: Identify volumes (T1168) ca811f42026-02-25 Added technique: Extract search terms from URLs (T1167) 5a737e82026-02-25 Updated technique: Browser history examination (T1137) d7804c12026-02-25 Updated technique: Automated artifact extraction from app data (T1120) 9fd85692026-02-25 Updated technique: Locate relevant files by path (T1118) 77e3e802026-02-25 Updated technique: SQLite database examination (T1071) 7bb5c4b2026-02-25 Updated technique: T1060 9613be22026-02-25 Updated technique: Enumerate allocated files and folders (T1060) 1949e9f2026-02-25 Updated technique: Identify partitions (T1059) 39f4c632026-02-25 Updated technique: Decode forensic image container format (T1043) 1f994352026-02-25 Updated technique: Decode forensic image format (T1043) 018729d2026-02-25 Updated technique: Decode forensic image format (T1043) 6f2481c2026-02-24 Added weakness: Connection over a direct media interface causes changes to the target media (W1277) 73a813e2026-02-24 Updated weakness: Interaction with the target devices to read data causes changes (W1012) 73a813e2026-02-24 Added technique: Connect directly to storage media (T1166) 73a813e2026-02-24 Added technique: Direct data read from a block device (T1164) 73a813e2026-02-24 Added mitigation: Avoid direct connection to media and use hardware write blocker instead (M1241) 73a813e2026-02-23 Deleted technique: Placeholder (T1000) bd6c94d2026-02-22 Updated technique: Disk imaging (T1002) a38ebf82026-02-20 Updated technique: Access internal storage via bootable environment (T1113) 774f5952026-02-20 Updated technique: Physical disk identification and removal (T1112) 774f5952026-02-20 Updated technique: Physical disk identification and removal (T1112) 720649b2026-02-20 Updated technique: Access data from a desoldered eMMC via a chip reader (T1029) 27ca6122026-02-20 Updated technique: Writing data to a forensic image format (T1025) 04713a92026-02-20 Updated technique: Use software write blockers to provide read only access to storage media (T1013) 774f5952026-02-20 Updated technique: Use software write blockers to provide read only access to storage media (T1013) af0b7722026-02-20 Updated technique: Connect storage medium via hardware write blocker (T1012) 774f5952026-02-20 Updated technique: Locate cloud account identifiers (T1009) 774f5952026-02-20 Updated technique: Profiling network traffic (T1008) 774f5952026-02-20 Updated technique: Use a SyncTriage-based approach to detect existence of devices (T1007) 774f5952026-02-20 Updated technique: Conduct a search of a crime scene (T1005) 774f5952026-02-20 Updated technique: Conduct a search of a crime scene (T1005) c8021642026-02-20 Updated technique: Selective file acquisition (T1004) 774f5952026-02-20 Updated technique: Memory imaging (T1003) 774f5952026-02-20 Updated technique: Disk imaging (T1002) 774f5952026-02-20 Updated technique: Disk imaging (T1002) 04713a92026-02-20 Updated technique: Triage (T1001) 774f5952026-02-20 Bulk change: 160 updated items fefad272026-02-12 Updated weakness: Inability to enable required service due to locked device (W1274) 5918cef2026-02-12 Updated weakness: Inability to enable required service due to locked device (W1274) 2ba965d2026-02-12 Added mitigation: Obtain possible passwords/PIN codes from other devices with limited security (M1239) 2ba965d2026-02-12 Added mitigation: Configure device to enable required service (M1238) 2ba965d2026-02-03 Added technique: Automated screenshot-based capture of a mobile device (T1163) 15fe7132026-02-03 Added technique: Read data from a device via In-System Programming (ISP) (T1162) e853d0b2026-02-03 Updated technique: Read data from a device via In-System Programming (ISP) (T1162) 13c1af42026-02-03 Added technique: Collect data with ‘cloud backup restore’ approach (T1160) 6327f742026-02-03 Updated technique: Cloud data collection via submission of request to service provider (T1024) afcbb8f2026-02-03 Updated technique: Cloud data collection to access data via a live web page using credentials (T1023) afcbb8f
January 2026
2026-01-18 Added weakness: Relevant data is overwritten by deploying an agent to a mobile device (W1276) abc94cd2026-01-18 Added technique: Extract mobile data via deployed agent (T1159) abc94cd2026-01-15 Added weakness: Failure to store data due to size limitations of archive format used (W1275) bca6e1b2026-01-15 Updated technique: Writing data to standard archive format (T1026) bca6e1b2026-01-15 Added mitigation: Ensure that archive format used can handle sufficiently large files (M1237) bca6e1b2026-01-13 Added weakness: Inability to enable required service due to locked device (W1274) 5c6cef82026-01-13 Added weakness: Failure to preserve full resolution of all relevant timestamps of files obtained using exposed services on a device (W1273) 5c6cef82026-01-13 Added weakness: Failure to preserve all relevant timestamps of files obtained using exposed services on a device (W1272) 5c6cef82026-01-13 Added weakness: Inability to access required service as it is not enabled (W1271) 5c6cef82026-01-13 Added weakness: Inability to create a device backup due to locked device (W1270) 5c6cef82026-01-13 Updated weakness: System locks after X failed brute force attempts (W1142) 5c6cef82026-01-13 Updated weakness: Failing to determine password via brute force in the time available (W1141) 5c6cef82026-01-13 Updated weakness: Failing to determine password as it is not in the search space (W1140) 5c6cef82026-01-13 Updated weakness: System locks after X failed dictionary attempts (W1139) 5c6cef82026-01-13 Updated weakness: Failing to identify password in the time available (W1138) 5c6cef82026-01-13 Updated weakness: Failing to determine password as it is not in the dictionary used (W1137) 5c6cef82026-01-13 Updated weakness: Not considering SD Card acquisition in addition to other extractions performed (W1040) 5c6cef82026-01-13 Added technique: Configure device to enable a service needed for data extraction (T1158) 5c6cef82026-01-13 Added technique: Extract device data using exposed service (T1157) 5c6cef82026-01-13 Updated technique: Obtain password from the device owner (T1037) 5c6cef82026-01-13 Updated technique: Extraction of credential from an accessible device (T1033) 5c6cef82026-01-13 Updated technique: Mobile backup extraction (T1019) 5c6cef82026-01-13 Added mitigation: Attempt to obtain password/pincode with dictionary attacks (M1236) 5c6cef82026-01-13 Added mitigation: Attempt to obtain password/pincode with brute force attacks (M1235) 5c6cef82026-01-13 Added mitigation: Exploit device to facilitate password/pincode attacks (M1234) 5c6cef82026-01-13 Added mitigation: Test data extraction methods against reference data with known timestamps (M1233) 5c6cef82026-01-13 Added mitigation: Configure device to enable required service (M1232) 5c6cef82026-01-13 Added mitigation: Obtain possible passwords/PIN codes from other devices with limited security (M1231) 5c6cef82026-01-13 Updated mitigation: Attempt to obtain password/passcode from the device owner (M1097) 5c6cef82026-01-13 Updated mitigation: Compare data extracted with full list of installed apps (M1020) 5c6cef82026-01-13 Updated mitigation: Consider if file system acquisition is possible/permitted (M1019) 2c6a2e32026-01-09 Updated weakness: Failure to locate a relevant device at a physical crime scene (W1114) 7635c752026-01-09 Updated technique: Conduct a search of a crime scene (T1005) 15a0da52026-01-09 Added mitigation: Adopt a systematic search pattern (M1232) 7635c752026-01-09 Added mitigation: Make use of ‘paired searching’ (M1231) 7635c752026-01-09 Updated mitigation: Use a SyncTriage style approach to determine existence other synchronized devices (M1069) ab2d1f62026-01-09 Updated mitigation: Use digital sniffer dogs to assist in locating evidence (M1068) ab2d1f62026-01-08 Updated technique: Apply offset to a timestamp (T1153) 60a98bc2026-01-08 Updated technique: Keyword search (over extracted artifacts) (T1151) 60a98bc2026-01-08 Updated technique: Browser cache examination (T1138) 60a98bc2026-01-08 Updated technique: Use time anchors to estimate clock offset (T1134) 60a98bc2026-01-08 Updated technique: Keyword search (live) (logical) (T1127) 60a98bc2026-01-08 Updated technique: Keyword search (live) (physical) (T1126) 60a98bc2026-01-08 Updated technique: Keyword search (live) (T1125) 60a98bc2026-01-08 Updated technique: Keyword search (indexed) (T1124) 60a98bc2026-01-08 Updated technique: Keyword search (case-specific wordlists) (T1123) 60a98bc2026-01-08 Updated technique: Keyword search (case-type wordlists) (T1122) 60a98bc2026-01-08 Updated technique: Keyword indexing (T1121) 60a98bc2026-01-08 Updated technique: Recording system clock offset (T1111) 60a98bc2026-01-08 Updated technique: Produce tag-based automated report (T1092) 60a98bc2026-01-08 Updated technique: Location-based event reconstruction (T1087) 60a98bc2026-01-08 Updated technique: Timeline analysis (T1086) 60a98bc2026-01-08 Updated technique: Content indexer examination (OS) (T1065) 60a98bc2026-01-08 Updated technique: Timeline generation (T1052) 60a98bc2026-01-08 Updated technique: Keyword searching (T1049) 60a98bc2026-01-08 Updated technique: Privacy protection via partial processing (T1048) 60a98bc2026-01-08 Updated technique: Hash matching (reduce) (T1047) 60a98bc2026-01-08 Updated technique: Privileged material protection (T1046) 60a98bc2026-01-08 Updated technique: Smudge attack (T1036) 60a98bc2026-01-08 Updated technique: Key recovery from memory (T1031) 60a98bc2026-01-08 Updated technique: Network packet capture (T1017) 60a98bc
December 2025
2025-12-18 Bulk change: 104 updated items bab97462025-12-06 Updated mitigation: Ensure that tools used present the uncertainty associated with automated interpretation of data (M1209) 18786e32025-12-06 Updated mitigation: Ensure that tools used present the uncertainty associated with automated interpretation of data (M1209) dc1346b2025-12-06 Updated mitigation: Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered (M1208) c165bda2025-12-06 Updated mitigation: Ensure training is in place for tool operators to separate fact from interpretation within the tool used (M1207) 64576592025-12-01 Updated weakness: Failure to consider timestamp inaccuracy at time of inferred event (W1149) 68b46212025-12-01 Updated technique: Time-based event reconstruction (T1117) 59c96822025-12-01 Updated technique: Time-based event reconstruction (T1117) 68b46212025-12-01 Updated technique: Timeline analysis (T1086) 7b77f3b2025-12-01 Updated mitigation: Check that analysis of timestamp accuracy on which event reconstruction is based has been performed (M1103) 68b4621
November 2025
2025-11-28 Updated technique: Timeline analysis (T1086) 0da96582025-11-26 Added weakness: Failure to apply time offset to a timeline entry (W1269) 4a313632025-11-26 Added weakness: Offset applied to timestamp is incorrect due to incorrect daylight savings configuration used (W1268) 4a313632025-11-26 Added weakness: Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source (W1267) 4a313632025-11-26 Added weakness: Timestamp used is an inaccurate representation of the real world time due to timezone and/or daylight savings (W1266) 4a313632025-11-26 Updated weakness: Failure to determine clock accuracy at time of inferred event (W1149) 4a313632025-11-26 Updated weakness: Timestamp used is an inaccurate representation of the real world time due to inaccurate system clock (W1148) 4a313632025-11-26 Updated technique: Apply offset to a timestamp (T1153) 4a313632025-11-26 Updated technique: Time-based event reconstruction (T1117) 4a313632025-11-26 Updated technique: Timeline analysis (T1086) 4a313632025-11-26 Updated technique: Timeline generation (T1052) 4a313632025-11-26 Added mitigation: Ensure that daylight savings offsets that are applied to timestamps are correct (M1230) 4a313632025-11-26 Added mitigation: Determine last timezone used on system (M1229) 4a313632025-11-26 Added mitigation: Record system clock offset (M1228) 4a313632025-11-26 Added mitigation: Search for indicators of clock tampering (M1227) 4a313632025-11-26 Updated mitigation: Use ‘Time Anchors’ to assess clock accuracy at time of inferred event (M1103) 4a313632025-11-26 Added mitigation: Apply time offset to timestamp (M1101) 4a313632025-11-25 Updated technique: Apply offset to a timestamp (T1153) df4e7642025-11-25 Updated technique: Use time anchors to estimate clock offset (T1134) df4e7642025-11-25 Updated technique: Timeline analysis (T1086) df4e7642025-11-25 Updated technique: Timeline generation (T1052) df4e7642025-11-25 Updated mitigation: Estimate clock offset at a specific point in time using time anchoring (M1225) df4e7642025-11-25 Updated mitigation: Periodically keep records of time offsets of significant external servers (M1220) df4e7642025-11-25 Updated mitigation: Ensure that tools and processes take into account all current knowledge on sources of local/external timestamp pairs (time anchors) (M1218) df4e7642025-11-24 Added weakness: Offset applied to timestamp is incorrect due to variations in time zone over the history of data source (W1265) 37b44c22025-11-24 Added weakness: Offset applied to timestamp is incorrect due to failure to distinguish UTC stored timestamp from local timestamp (W1264) 37b44c22025-11-24 Added weakness: Estimated clock offset is incorrect resulting from misinterpretation of locally stored timestamps when performing Time Anchoring (W1263) 5ef9b9e2025-11-24 Added weakness: Estimated clock offset is incorrect resulting from correlating two timestamps that were not written at the same time (W1262) 5ef9b9e2025-11-24 Added weakness: Estimated clock offset is incorrect resulting from an inaccurate external time source when performing Time Anchoring (W1261) 5ef9b9e2025-11-24 Added weakness: Failure to derive clock offset due to inability to locate a suitable time anchor (W1260) 5ef9b9e2025-11-24 Updated weakness: Offset applied to timestamp is incorrect due to variations in clock offset over the history of data source (W1149) 37b44c22025-11-24 Added technique: Apply offset to a timestamp (T1153) 37b44c22025-11-24 Added technique: Estimate system clock offset at a point in time (T1134) 5ef9b9e2025-11-24 Updated technique: Timeline analysis (T1086) 51e36ae2025-11-24 Added mitigation: Testing to determine whether a timestamp is in UTC or local time (M1226) 37b44c22025-11-24 Added mitigation: Estimate clock offset at a specific point in time using time anchoring (M1225) 37b44c22025-11-24 Added mitigation: Check for location artifacts to infer the time zone at a specific moment (M1224) 37b44c22025-11-24 Added mitigation: Apply time zone based offsets only to UTC stored timestamps (M1223) 37b44c22025-11-24 Added mitigation: Testing to ensure that tooling is able to extract local/external timestamp pairs (time anchors) (M1222) 5ef9b9e2025-11-24 Added mitigation: Testing of timestamp decoding within a time anchor (M1221) 5ef9b9e2025-11-24 Added mitigation: Periodically keep records of time offsets of significant external servers (M1220) 5ef9b9e2025-11-24 Added mitigation: Manual verification of timestamp decoding within a time anchor (M1219) 5ef9b9e2025-11-24 Added mitigation: Ensure that tools and processes take into account all current knoweldge on sources of local/external timestamp pairs (time anchors) (M1218) 5ef9b9e2025-11-24 Added mitigation: Consider multiple time anchors and check if timestamps from multiple external time sources agree (M1217) 5ef9b9e2025-11-24 Added mitigation: Check that the assumption is valid that the specific local/external timestamp pair should be correlated (M1216) 5ef9b9e2025-11-23 Updated weakness: Missing deleted but recoverable partitions from unpartitioned space (W1066) 87253de2025-11-23 Updated weakness: Incorrectly parsing the partitions table(s) (W1063) 87253de2025-11-23 Added technique: Functional-based event reconstruction (T1156) 06444cd2025-11-23 Added technique: Operation-based event reconstruction (T1155) 06444cd2025-11-23 Added technique: Identity-based event reconstruction (T1154) 06444cd2025-11-23 Updated technique: Time-based event reconstruction (T1117) cd049762025-11-23 Updated technique: Relational-based event reconstruction (T1088) 950ee152025-11-23 Updated technique: Location-based event reconstruction (T1087) 9f502312025-11-23 Updated technique: Identify partitions (T1059) 87253de2025-11-04 Added weakness: Image format parsing fails to identify or assemble split forensic images (W1259) 7c4de0e2025-11-04 Updated weakness: Image format parsing fails to identify or assemble split forensic images (W1259) 4c8adff2025-11-04 Updated technique: Time-based event reconstruction (T1117) 821f2512025-11-04 Updated technique: Forensic image format decoding (T1043) ba1c5e82025-11-04 Updated technique: Decode forensic image format (T1043) 99e97552025-11-04 Added mitigation: Test the parsing of split forensic images with a corrupt segment (M1215) 07053952025-11-04 Added mitigation: Ensure forensic tool UI clearly warns that there are problems while parsing a split forensic image file (M1214) 07053952025-11-04 Added mitigation: Test the parsing of split forensic images with missing segments (M1213) 07053952025-11-04 Added mitigation: Test the parsing of split forensic images with the maximum number of segments possible (M1212) 07053952025-11-04 Added mitigation: Test the parsing of split forensic images (M1211) 07053952025-11-04 Added mitigation: Use a forensic image format with internal integrity and continuity metadata (M1210) 07053952025-11-04 Updated mitigation: Use a forensic image format with internal integrity and continuity metadata (M1210) 99e9755
October 2025
2025-10-29 Added weakness: Failure to present uncertainty associated with automated interpretation of data into artifacts (W1258) f5296042025-10-29 Updated weakness: Failing to identify password in the time available (W1138) 1d36eec2025-10-29 Updated weakness: Failing to determine password as it is not in the dictionary used (W1137) 1d36eec2025-10-29 Updated technique: Automated artifact extraction (T1120) f5296042025-10-29 Added mitigation: Ensure that tools used present the uncertainty associated with automated interpretation of data (M1209) f5296042025-10-29 Added mitigation: Review critical findings from tools to ensure they are facts, or if they are an automated interpretation, ensure that any uncertainty is considered (M1208) f5296042025-10-29 Added mitigation: Ensure training is in place for tool operators to separate fact from interpretation within the tool used (M1207) f5296042025-10-29 Added mitigation: Ensure that tools used clearly separate fact from interpretation (M1206) f5296042025-10-29 Added mitigation: Use wordlist generator with case data (M1205) 1d36eec2025-10-27 Added weakness: Missing content that is relevant to a keyword search but it has not been extracted as ‘artifacts’ (W1257) e35928e2025-10-27 Added technique: Keyword search (over extracted artifacts) (T1151) e35928e2025-10-27 Updated technique: Keyword searching (T1049) e35928e2025-10-27 Updated technique: Digital sniffer dogs (T1006) abb04fe2025-10-27 Updated technique: Crime scene searching (T1005) b353a9b2025-10-27 Updated technique: Crime scene searching (T1005) daa78342025-10-27 Added mitigation: Use live keyword search over broader content of the data source (M1204) e35928e2025-10-27 Added mitigation: Use indexed keyword search over broader content of the data source (M1203) e35928e2025-10-10 Updated weakness: Incorrect time offset applied to a timeline entry (W1148) 4170ea22025-10-10 Updated technique: Disk imaging (T1002) 9b161972025-10-07 Added weakness: Incorrect attribution of metadata to file content that was the result of ‘file tunnelling’ (W1256) f9c833c2025-10-07 Added weakness: Recovered file content is incorrect due to incorrect parsing of file size information that records allocated but unwritten sectors (e.g. Valid Data Length (VDL) (W1255) f9c833c2025-10-07 Added weakness: Recovered (non-allocated) file content is incorrect due to an incorrect assumption that the file was contiguous e.g. some residual file metadata exists, but not the full reassembly information (W1254) f9c833c2025-10-07 Added weakness: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file which does not have any residual file system information (W1253) f9c833c2025-10-07 Updated weakness: Recovered (non-allocated) file content has been overwritten by the content of a newer live file but this is not detected (W1135) f7d42d52025-10-07 Updated weakness: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected (W1134) f7d42d52025-10-07 Updated weakness: Recovered (non-allocated) file content has been overwritten by the content of a newer, but also non-allocated file (which has residual file system information) but this is not detected (W1134) f9c833c2025-10-07 Added technique: Recover non-allocated files using residual file metadata in the file system (T1150) 2bdca362025-10-07 Updated technique: Recover non-allocated files using residual file metadata in the file system (T1150) 22c30722025-10-07 Updated technique: Recover non-allocated files using residual file metadata (T1150) f9c833c2025-10-07 Updated technique: Recover non-allocated files (T1061) b826f522025-10-07 Updated technique: Recover non-allocated files (T1061) 22c30722025-10-07 Updated technique: Enumerate allocated files and folders (T1060) 2bdca362025-10-07 Added mitigation: Ensure that inconsistencies between allocated data size and data written size are clearly flagged. (M1200) f9c833c2025-10-07 Added mitigation: Check all relevant file size metadata values when recovering file content (M1199) f9c833c2025-10-07 Added mitigation: Check if file system and operating system make use of an ‘allocated but unwritten’ value e.g. VDL. (M1198) f9c833c2025-10-07 Added mitigation: Check if file being recovered is resident (applicable on some file systems) (M1197) f9c833c2025-10-07 Added mitigation: Check if file being recovered is smaller than a block (M1196) f9c833c2025-10-01 Updated weakness: Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database (W1246) 81ab3062025-10-01 Updated technique: File carving (T1064) b134f0b2025-10-01 Updated technique: Non-allocated file recovery (T1061) b134f0b2025-10-01 Added mitigation: Also examine browser cache to confirm details about an older web visit when details are recovered using SQL join queries. (M1195) 81ab3062025-10-01 Added mitigation: Consider carefully page titles and other details associated with older web history visits when details are recovered using SQL join queries. (M1194) 81ab306
September 2025
2025-09-30 Updated technique: File versioning feature examination (T1149) df381b22025-09-29 Added weakness: Assuming that data stored in the cache was viewed by the user (W1252) 8d4122f2025-09-29 Added weakness: Incomplete browser activity extraction due to failure to consider multiple profiles (W1251) 8d4122f2025-09-29 Added weakness: Incomplete browser activity extraction due to not considering the browser cache artifacts (W1250) 8d4122f2025-09-29 Added weakness: Missing a web browser profile as it was stored outside of the usual browser profile folders (W1249) d620c942025-09-29 Updated weakness: Missing a web browser profile as it was stored outside of the usual browser profile folders (W1249) 8d4122f2025-09-29 Added weakness: Missing browser downloads as the files were saved to a non-standard location (W1248) d620c942025-09-29 Added weakness: Attributing saved browser bookmarks to a user but they were bundled with the browser installation (W1247) d620c942025-09-29 Added weakness: Attribution of incorrect details (e.g. page title) to a browser web visit due to join queries used in underlying database (W1246) d620c942025-09-29 Added weakness: Relying on times stored in browser history that are not representative of exact web page visit time (W1245) d620c942025-09-29 Added weakness: Missing browser history data as it was cleared by user (W1244) d620c942025-09-29 Updated weakness: Missing browser history data as it was cleared by user (W1244) 8d4122f2025-09-29 Added weakness: Missing browser history data as it was conducted outside of configured retention period (W1243) d620c942025-09-29 Updated weakness: Missing browser history data as it was conducted outside of configured retention period (W1243) 8d4122f2025-09-29 Updated weakness: Misinterpretation a URL located on disk/memory as a web visit (W1113) 8d4122f2025-09-29 Added technique: Browser web storage examination (T1148) 6fa542c2025-09-29 Added technique: Browser cookie examination (T1147) d620c942025-09-29 Added technique: Browser synchronization feature examination (T1146) d620c942025-09-29 Added technique: Browser extensions examination (T1145) d620c942025-09-29 Added technique: Browser profile examination (T1144) d620c942025-09-29 Updated technique: Browser profile enumeration (T1144) 8d4122f2025-09-29 Added technique: Browser configuration examination (T1143) d620c942025-09-29 Added technique: Browser downloads examination (T1142) d620c942025-09-29 Added technique: Browser bookmarks examination (T1141) d620c942025-09-29 Added technique: Browser autofill examination (T1140) d620c942025-09-29 Added technique: Browser session examination (T1139) d620c942025-09-29 Added technique: Browser cache examination (T1138) d620c942025-09-29 Updated technique: Browser cache examination (T1138) 8d4122f2025-09-29 Added technique: Browser history examination (T1137) d620c942025-09-29 Updated technique: Browser examination (T1069) d620c942025-09-29 Updated technique: Browser examination (T1069) 8d4122f2025-09-29 Updated technique: Browser examination (T1069) 6fa542c2025-09-29 Updated technique: Placeholder (T1000) 64be6ee2025-09-29 Added mitigation: Obtain older versions of browser history files from backups or from file system versioning features (M1193) 8d4122f2025-09-29 Added mitigation: Examine browser configuration to determine history retention settings (M1192) 8d4122f2025-09-29 Added mitigation: Ensure that profile configuration is examined rather than just folders within the standard profile folder (M1191) 8d4122f2025-09-29 Added mitigation: Ensure that the context of recovered URLs is considered during event reconstruction (M1190) 8d4122f2025-09-29 Added mitigation: Conduct experiments to determine if content from the page in question is cached only when viewed in the browser (M1189) 8d4122f2025-09-29 Added mitigation: Ensure all profiles of the web browser are considered (M1188) 8d4122f2025-09-29 Added mitigation: Ensure browser cache data is also considered (M1187) 8d4122f2025-09-24 Added technique: File versioning feature examination (T1137) 96b76a82025-09-19 Updated weakness: Overwriting relevant data with changes caused by running the live tools (W1036) 3992f492025-09-19 Updated weakness: Collecting incorrect information from live system due to compromised machine (e.g. rootkit) (W1035) 3992f492025-09-19 Updated technique: Live data collection (T1016) 3992f492025-09-19 Updated mitigation: Analyze web browser memory for web browsing activity (M1067) c61ddd22025-09-19 Updated mitigation: Attempt to reconstruct browser activity from other areas of disk (M1066) c61ddd22025-09-14 Updated weakness: Incorrectly interpreting a log entry type based on a different version of the generating software or operating system (W1236) 94baa352025-09-14 Updated weakness: Failure to extract log entry type (W1235) 94baa352025-09-14 Updated weakness: Event time presented incorrectly due to incorrect timezone handling (W1234) 94baa352025-09-14 Updated weakness: Failure to communicate imprecision in log entry timestamp (W1233) 94baa352025-09-14 Updated weakness: Failure to extract log entry timestamp (W1232) 94baa352025-09-14 Updated weakness: Interpreting log entry absence as evidence of deletion rather than logging configuration (W1231) 94baa352025-09-14 Updated weakness: Log entry missing due to rotation size or timing (W1230) 94baa352025-09-14 Updated weakness: Log entry missing due to being stored in archived copies of logs (W1229) 94baa352025-09-14 Updated weakness: Log entry missing due to incorrect parsing of logfile (W1228) 94baa352025-09-14 Updated technique: Log file examination (T1076) 94baa352025-09-14 Updated mitigation: Testing of correct log entry type extraction (M1182) 94baa352025-09-14 Updated mitigation: Testing logfile parsing capability (M1181) 94baa352025-09-14 Updated mitigation: Testing correct extraction of logfile entry timestamps (M1180) 94baa352025-09-14 Updated mitigation: If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation (M1179) 94baa352025-09-14 Updated mitigation: Ensure timezone handling method for logfile timestamps is understood (M1178) 94baa352025-09-14 Updated mitigation: Ensure resolution or limitations of logfile timestamps are understood (M1177) 94baa352025-09-14 Updated mitigation: Ensure log entry type interpretation applies for the software version being examined (M1176) 94baa352025-09-14 Updated mitigation: Ensure any available archive logs are also examined (M1175) 94baa352025-09-14 Updated mitigation: Check logging settings to determine expected behaviour (M1174) 94baa352025-09-14 Updated mitigation: Check logging settings so the bounds of logging are known (M1173) 94baa352025-09-14 Updated mitigation: Also examine any older versions of the logs from backups (M1172) 94baa352025-09-02 Added weakness: Incorrectly interpreting a log entry type based on a different version of the generating software or operating system (W1209) 67cf8202025-09-02 Added weakness: Failure to extract log entry type (W1208) 67cf8202025-09-02 Added weakness: Event time presented incorrectly due to incorrect timezone handling (W1207) 67cf8202025-09-02 Added weakness: Failure to communicate imprecision in log entry timestamp (W1206) 67cf8202025-09-02 Added weakness: Failure to extract log entry timestamp (W1205) 67cf8202025-09-02 Added weakness: Interpreting log entry absence as evidence of deletion rather than logging configuration (W1204) 67cf8202025-09-02 Added weakness: Log entry missing due to rotation size or timing (W1203) 67cf8202025-09-02 Added weakness: Log entry missing due to being stored in archived copies of logs (W1202) 67cf8202025-09-02 Added weakness: Log entry missing due to incorrect parsing of logfile (W1201) 67cf8202025-09-02 Updated weakness: Image replaced with tampered version along with updated stored hash (W1128) b40bd782025-09-02 Added technique: Log file examination (T1076) c9d9e1b2025-09-02 Updated technique: Log file examination (T1076) 67cf8202025-09-02 Added technique: Configuration file examination (T1021) c9d9e1b2025-09-02 Added mitigation: Testing of correct log entry type extraction (M1164) 67cf8202025-09-02 Added mitigation: Testing logfile parsing capability (M1163) 67cf8202025-09-02 Added mitigation: Testing correct extraction of logfile entry timestamps (M1162) 67cf8202025-09-02 Added mitigation: If timestamp is local time, ensure that the system timezone was applicable at time of log entry generation (M1161) 67cf8202025-09-02 Added mitigation: Ensure timezone handling method for logfile timestamps is understood (M1160) 67cf8202025-09-02 Added mitigation: Ensure resolution or limitations of logfile timestamps are understood (M1159) 67cf8202025-09-02 Added mitigation: Ensure log entry type interpretation applies for the software version being examined (M1158) 67cf8202025-09-02 Added mitigation: Ensure any available archive logs are also examined (M1157) 67cf8202025-09-02 Added mitigation: Check logging settings to determine expected behaviour (M1156) 67cf8202025-09-02 Added mitigation: Check logging settings so the bounds of logging are known (M1155) 67cf8202025-09-02 Added mitigation: Also examine any older versions of the logs from backups (M1154) 67cf820
August 2025
2025-08-28 Updated mitigation: Check hash of image matches hash of source device (M1004) 42b020e2025-08-22 Updated technique: AI companion app examination (T1133) 8550fb12025-08-19 Added weakness (TRWM): Associating a configured bot with the wrong account (W1227) f8eef392025-08-19 Added weakness (TRWM): Failure to recover relevant AI bot settings (W1226) f8eef392025-08-19 Added weakness (TRWM): Failure to recover relevant app settings (W1225) f8eef392025-08-19 Added weakness (TRWM): Presenting a deleted account as live, or vice versa (W1224) f8eef392025-08-19 Added weakness (TRWM): Live access to the device (for extraction) updates last access times for an account (W1223) f8eef392025-08-19 Added weakness (TRWM): Presenting account details that did not exist (W1222) f8eef392025-08-19 Added weakness (TRWM): Failure to recover account details from the AI app data (W1221) f8eef392025-08-19 Added weakness (TRWM): Presenting an incorrect timestamp associated with an interaction with the AI companion app (W1220) f8eef392025-08-19 Added weakness (TRWM): Failure to recover metadata associated with an interaction with the AI companion app (W1219) f8eef392025-08-19 Added weakness (TRWM): Presenting a call to the AI companion app as from the AI companion app, or vice versa (W1218) f8eef392025-08-19 Added weakness (TRWM): Presenting a deleted call to the AI companion app as a live one, or vice versa (W1217) f8eef392025-08-19 Added weakness (TRWM): Presenting a call to or from the AI companion app that did not exist (W1216) f8eef392025-08-19 Added weakness (TRWM): Failure to recover deleted but recoverable records of calls to or from the AI companion app (W1215) f8eef392025-08-19 Added weakness (TRWM): Failure to recover live records of calls to or from the AI companion app (W1214) f8eef392025-08-19 Added weakness (TRWM): Failure to display an image to or from the AI companion app in the context of other messages (W1213) f8eef392025-08-19 Added weakness (TRWM): Presenting an image sent to the AI chat app as from the AI companion app, or vice versa (W1212) f8eef392025-08-19 Added weakness (TRWM): Presenting a deleted image sent to the AI companion app as a live one, or vice versa (W1211) f8eef392025-08-19 Added weakness (TRWM): Presenting an image sent from the user or AI companion app that did not exist (W1210) f8eef392025-08-19 Added weakness (TRWM): Failure to recover deleted but recoverable images sent to or from the AI companion app (W1209) f8eef392025-08-19 Added weakness (TRWM): Failure to recover live images sent to or from the AI companion app (W1208) f8eef392025-08-19 Added weakness (TRWM): Failure to display a message to or from the AI companion app in the context of other messages (W1207) f8eef392025-08-19 Added weakness (TRWM): Merging the contents of two deleted messages together and presenting them as a single one sent to the AI companion app (W1206) f8eef392025-08-19 Added weakness (TRWM): Presenting a message to the AI chat app as from the AI companion app, or vice versa (W1205) f8eef392025-08-19 Added weakness (TRWM): Presenting a deleted message to the AI companion app as a live one, or vice versa (W1204) f8eef392025-08-19 Added weakness (TRWM): Presenting a message from the user or AI companion app that did not exist (W1203) f8eef392025-08-19 Added weakness (TRWM): Failure to recover deleted but recoverable messages to or from the AI companion app (W1202) f8eef392025-08-19 Added weakness (TRWM): Failure to recover live messages to or from the AI companion app (W1201) f8eef392025-08-19 Added technique (TRWM): AI companion app examination (T1128) f8eef392025-08-19 Added mitigation (TRWM): Testing of the recovery of companion AI bot settings (M1171) f8eef392025-08-19 Added mitigation (TRWM): Experiments with test device to view possible settings of forensic value (M1170) f8eef392025-08-19 Added mitigation (TRWM): Testing of app settings recovery from AI companion app (M1169) f8eef392025-08-19 Added mitigation (TRWM): Request logs of access times from service provider (M1168) f8eef392025-08-19 Added mitigation (TRWM): Check time of account access is prior to device seizure time (M1167) f8eef392025-08-19 Added mitigation (TRWM): Remove all network connectivity from device (M1166) f8eef392025-08-19 Added mitigation (TRWM): Ensure data collection prior to any interaction with app (M1165) f8eef392025-08-19 Added mitigation (TRWM): Testing of account details recovery from AI companion app (M1164) f8eef392025-08-19 Added mitigation (TRWM): Testing that call record caller and recipient extraction are correct (M1163) f8eef392025-08-19 Added mitigation (TRWM): Testing of deleted call record recovery from AI companion app (M1162) f8eef392025-08-19 Added mitigation (TRWM): Testing of live call record recovery from AI companion app (M1161) f8eef392025-08-19 Added mitigation (TRWM): Testing that picture message sender and recipient extraction are correct (M1160) f8eef392025-08-19 Added mitigation (TRWM): Testing for deleted picture message recovery from AI companion app (M1159) f8eef392025-08-19 Added mitigation (TRWM): Testing for live picture message recovery from AI companion app (M1158) f8eef392025-08-19 Added mitigation (TRWM): Ensure messages are viewed in the context of the message thread (M1157) f8eef392025-08-19 Added mitigation (TRWM): Testing that message sender and recipient extraction are correct (M1156) f8eef392025-08-19 Added mitigation (TRWM): Testing for deleted message recovery from AI companion app (M1155) f8eef392025-08-19 Added mitigation (TRWM): Testing for live message recovery from AI companion app (M1154) f8eef392025-08-19 Updated mitigation (TRWM): Correlation of data extracted with data from service provider (M1055) f8eef392025-08-15 Updated weakness: Failure to determine clock accuracy at time of inferred event (W1149) a2769c72025-08-15 Added technique: Search for indicators of artifact wiping (T1132) e4c1f302025-08-15 Added technique: Search for indicators of trail obfuscation (T1131) e4c1f302025-08-15 Added technique: Search for indicators of encrypted data (T1130) e4c1f302025-08-15 Added technique: Search for indicators of clock tampering (T1129) e4c1f302025-08-15 Added technique: Search for indicators of malware (T1128) e4c1f302025-08-15 Updated technique: Time-based event reconstruction (T1117) a2769c72025-08-15 Updated technique: EXIF data extraction (T1100) 09778b02025-08-15 Updated technique: Bookmark artifacts (T1091) 09778b02025-08-15 Updated technique: Image content analysis (T1081) 09778b02025-08-15 Updated technique: Search for mismatched file extensions (T1058) e4c1f302025-08-15 Updated technique: Search for indicators of steganography (T1057) e4c1f302025-08-15 Updated technique: Entity connection enumeration (T1056) 09778b02025-08-15 Updated technique: Manual content review for relevant material (T1054) 09778b02025-08-08 Added weakness: Failure to conduct iterative keyword searching due to excessive time taken per search (W1200) 60bf0682025-08-08 Added weakness: Excessive keyword results returned from case-specific wordlists such that careful review of all results is impractical (W1199) 60bf0682025-08-08 Updated weakness: Keyword results from a tool are associated with a file, but the result was within slack space and therefore it may not have been part of that file (W1195) 60bf0682025-08-08 Updated weakness: Relevant results not captured by the case-specific keywords used (W1192) 60bf0682025-08-08 Updated weakness: Excessive keyword results returned from case-type wordlists such that careful review of all results is impractical (W1059) 60bf0682025-08-08 Updated weakness: Relevant keyword results not captured by the case-type keyword list used (W1057) 60bf0682025-08-08 Updated technique: Keyword search (live) (T1125) 60bf0682025-08-08 Updated technique: Keyword search (case-specific wordlists) (T1123) 60bf0682025-08-08 Added mitigation: Index data in the case and perform iterative keyword searching using the index (M1153) 60bf0682025-08-08 Added mitigation: Peer review of case-specific keyword list created (M1152) 60bf0682025-08-08 Updated mitigation: Check keyword results are part of allocated file, or if not perform detailed analysis to determine if the association between keyword results and file is valid (M1151) 60bf0682025-08-08 Updated mitigation: Review of case-specific keyword list by case officer (M1142) 60bf0682025-08-08 Updated mitigation: Comparison of index results with live search results (M1034) 60bf0682025-08-08 Updated mitigation: Prioritization of search results based on context (M1033) 60bf0682025-08-08 Updated mitigation: Evaluation of the effectiveness of wordlist used for case-type searching (M1032) 60bf0682025-08-03 Updated technique: Keyword search (indexed) (T1124) f1d5d662025-08-03 Updated technique: Keyword search (case-specific wordlists) (T1123) 08ef8f12025-08-03 Updated technique: Keyword search (case-type wordlists) (T1122) 94d67012025-08-03 Updated technique: Keyword searching (T1049) 774c2412025-08-02 Added weakness: Data not indexed for keyword searching due to file or content encoding (W1198) a5e6e272025-08-02 Added weakness: Data not indexed for keyword searching due to compression (W1197) a5e6e272025-08-02 Added weakness: One or more files with relevant keyword results are missed since they are not stored as text, e.g. within an image (W1196) a5e6e272025-08-02 Added weakness: One or more keyword results are associated with a file by a tool but was within slack space and therefore it may not have been part of that file (W1195) a5e6e272025-08-02 Added weakness: Keyword results missed since relevant keyword is inside compressed or encoded data (W1194) a5e6e272025-08-02 Added weakness: Keyword results missed since relevant keyword is split over a sector or cluster boundary (W1193) a5e6e272025-08-02 Updated weakness: Relevant results not captured by the case-specific keywords used (W1192) a5e6e272025-08-02 Updated weakness: Data not indexed for keyword searching due to case sensitivity problem (W1056) a5e6e272025-08-02 Updated weakness: Data not indexed for keyword searching due to missing substring feature (W1055) a5e6e272025-08-02 Updated weakness: Data not indexed for keyword searching due to text encoding (W1054) a5e6e272025-08-02 Added technique: Keyword search (live) (logical) (T1127) a5e6e272025-08-02 Added technique: Keyword search (live) (physical) (T1126) a5e6e272025-08-02 Added technique: Keyword search (live) (T1125) a5e6e272025-08-02 Added technique: Keyword search (indexed) (T1124) a5e6e272025-08-02 Updated technique: Keyword search (case-specific wordlists) (T1123) a5e6e272025-08-02 Updated technique: Keyword indexing (T1121) a5e6e272025-08-02 Updated technique: Keyword searching (T1049) a5e6e272025-08-02 Added mitigation: Check keyword results are part of allocated file, or if not perform detailed analysis to determine if association is valid (M1151) a5e6e272025-08-02 Added mitigation: Ensure keyword indexing settings mean that file formats will be decoded as required during indexing (M1150) a5e6e272025-08-02 Added mitigation: Ensure keyword indexing settings mean that decompression will be applied as required during indexing (M1149) a5e6e272025-08-02 Added mitigation: Ensure keyword indexing settings configure case sensitivity for indexing as required (M1148) a5e6e272025-08-02 Added mitigation: Ensure keyword indexing settings configure text substring handling as required during indexing (M1147) a5e6e272025-08-02 Added mitigation: Ensure keyword indexing settings capture text encodings required during indexing (M1146) a5e6e272025-08-02 Added mitigation: Apply OCR to files and search or index resulting text (M1145) a5e6e272025-08-02 Added mitigation: Use indexed keyword search (M1144) a5e6e272025-08-02 Added mitigation: Use live logical keyword search (M1143) a5e6e272025-08-02 Added mitigation: Review of case-specific keyword list by case officer via peer review (M1142) a5e6e272025-08-02 Added mitigation: Careful review of case brief for case-specific keyword list generation (M1141) a5e6e272025-08-02 Updated mitigation: Comparison of index results with live search results (M1034) a5e6e27
July 2025
2025-07-31 Added weakness: Relevant results not captured by the case-specific keywords used (W1192) f3f31412025-07-31 Updated weakness: Interpretation of app data is incorrect due to app version changes. (W1190) 80c44612025-07-31 Updated weakness: Excessive results returned such that careful review of all results is impractical (W1059) 0eaca6d2025-07-31 Updated weakness: Relevant results not captured by the case-type keyword list used (W1057) f3f31412025-07-31 Updated weakness: Incorrect parsing of a supplied regular expression used for keyword searching (W1053) f3f31412025-07-31 Updated weakness: Incorrect retrieval of results from an index (W1052) f3f31412025-07-31 Added technique: Keyword search (case-specific wordlists) (T1123) f3f31412025-07-31 Updated technique: Keyword search (case-specific wordlists) (T1123) 0eaca6d2025-07-31 Added technique: Keyword search (case-type wordlists) (T1122) f3f31412025-07-31 Added technique: Keyword indexing (T1121) f3f31412025-07-31 Updated technique: Content review for relevant material (T1054) f3f31412025-07-31 Updated technique: Keyword searching (T1049) f3f31412025-07-31 Updated technique: Mobile backup extraction (T1019) f3f31412025-07-30 Added technique: Automated artifact extraction (T1120) 40bfef82025-07-30 Updated technique: Chat app examination (T1072) 40bfef82025-07-30 Updated technique: Chat app examination (T1072) 6e0461d2025-07-29 Updated weakness: Artifact extraction is incomplete due to app version changes. (W1189) b7f65232025-07-28 Added weakness: Missing changes in app artifacts during research since app interaction is needed to cause changes (W1191) 9f134a02025-07-28 Updated weakness: Interpretation of app data is incorrect due to app changes. (W1190) 8dedd4a2025-07-28 Updated weakness: Extraction is incorrect/incomplete due to app changes. (W1189) 8dedd4a2025-07-28 Updated weakness: Artifact extraction is incorrect/incomplete due to app version changes. (W1189) 0add2ec2025-07-28 Updated weakness: Relevant reference data missed as its necessity was not known at time of preservation (W1172) 42b51642025-07-28 Updated technique: Automatically scan for changes in artifacts caused by app updates (T1119) ee5d8512025-07-28 Updated technique: Automatically scan for artifact changes caused by app updates (T1119) ce71e7e2025-07-28 Added mitigation: Use automation framework to emulate user actions to generate test data (M1140) 9f134a02025-07-28 Added mitigation: Use automated software monitoring to detect app artefact changes (M1139) 8dedd4a2025-07-28 Updated mitigation: Use automated software monitoring to detect app artefact changes (M1139) 18185b32025-07-25 Added weakness: Interpretation of app data is incorrect due to app changes. (W1190) bfd7ce32025-07-25 Added weakness: Extraction is incorrect/incomplete due to app changes. (W1189) bfd7ce32025-07-25 Added technique: Detect changes in artifacts due to app updates (T1119) 8552e0e2025-07-25 Updated technique: Detect changes in artifacts due to app updates (T1119) ca66d3c2025-07-25 Updated technique: Chat app examination (T1072) 57596a82025-07-18 Updated weakness: Data copied from sectors on source device are stored incorrectly (W1016) 6f6de572025-07-18 Updated weakness: Acquisition includes extra bytes (W1013) 6f6de572025-07-18 Updated technique: Store seized devices in evidence bags (T1011) 80e9aed2025-07-17 Updated weakness: Excessive results returned such that careful review of all results is impractical (W1059) fbe58b72025-07-08 Updated mitigation: Checking for other confirmatory indicators of the inferred device’s existence. (M1058) 5a5d5252025-07-03 Added weakness: Failure to match file name/path pattern due to implementation error in matching engine. (W1188) ff523a52025-07-03 Added weakness: Failure to match file name/path pattern due to mismatch of search term used and pattern match engine. (W1187) ff523a52025-07-03 Added weakness: Missing files with file name/path-based pattern matching due to renaming (W1186) ff523a52025-07-03 Added technique: Locate relevant files by path (T1118) ff523a52025-07-03 Added technique: Time-based event reconstruction (T1117) 85e32b42025-07-03 Updated technique: Connection-based event reconstruction (T1088) 85e32b42025-07-03 Updated technique: Location-based event reconstruction (T1087) 85e32b42025-07-03 Updated technique: Timeline analysis (T1086) 85e32b42025-07-03 Added mitigation: Testing file name/path pattern matching engine (M1138) ff523a5
June 2025
2025-06-27 Added weakness: Failure to enumerate all files in a standard archive format (W1185) 95937592025-06-27 Updated technique: Decode standard archive format (T1045) 95937592025-06-27 Added mitigation: Review of logs for any file extraction errors (M1137) 95937592025-06-27 Added mitigation: Testing of archive format parsing (M1136) 95937592025-06-10 Updated technique: Deep fake detection (video) (T1106) 14b96522025-06-09 Added weakness: Presenting devices ‘seen’ as devices connected (W1184) 7d1e6312025-06-09 Added weakness: Failure to identify the existence of a connected device (W1183) 7d1e6312025-06-09 Updated weakness: Suggesting the existence of a device that does not exist (W1011) 7d1e6312025-06-09 Updated weakness: Missing the existence of a device by missing synchronisation artefacts (W1008) 7d1e6312025-06-09 Added technique: Determine connected devices (T1116) 7d1e6312025-06-09 Updated technique: Determine connected devices (T1116) 2feff562025-06-09 Added mitigation: Testing that correct metadata/status of connected devices is extracted (M1135) 7d1e6312025-06-09 Added mitigation: Testing that connected devices are detected. (M1134) 7d1e6312025-06-06 Updated technique: Identify partitions (T1059) 81ded41
May 2025
2025-05-21 Added technique: Visualisation of geolocation information (T1115) 5a157502025-05-21 Updated technique: Writing data in standard archive format (T1026) b319edb2025-05-18 Added weakness: Failing to decrypt internal disk using the bootable environment (W1180) 62de5272025-05-18 Added weakness: Failing to detect internal disk using bootable environment (W1179) dd339962025-05-18 Updated weakness: Failing to detect internal disk using bootable environment (W1179) d2c01c82025-05-18 Added weakness: Failing to permit the bootable environment (e.g., Secureboot is enabled) (W1178) 37d0db42025-05-18 Updated weakness: Failing to permit the bootable environment (e.g., Secureboot is enabled) (W1178) f9bf2362025-05-18 Added weakness: Failing to boot from the bootable environment, causing the normal system boot process to commence (W1177) a1a626e2025-05-18 Updated weakness: Failing to boot from the bootable environment, causing the normal system boot process to commence (W1177) f8568052025-05-18 Updated technique: Access internal storage via bootable environment (T1113) 002ff1b2025-05-18 Added mitigation: Acquire the encrypted contents of the internal disk and decrypt the copy within a virtualized environment (M1133) fbf22a92025-05-18 Added mitigation: Use a Trusted Bootable Environment that supports decryption of the internal disk (M1132) 01fb1bf2025-05-18 Added mitigation: Use a Trusted Bootable Environment that supports accessing the internal disk (M1131) 15270fa2025-05-18 Added mitigation: Disable Secureboot in BIOS to permit bootable environment to load (risks wiping FDE key, requiring ADK). (M1130) c8a6f442025-05-18 Added mitigation: Use USB flashdrive version if a CD version is not permitted to boot (M1129) bc125a12025-05-18 Added mitigation: Use a Trusted Bootable Environment that is permitted to boot (M1128) 021eb552025-05-18 Added mitigation: Use a similar system to test steps required to interrupt the normal boot process and boot from Trusted Bootable Environment (M1127) c64a4852025-05-18 Added mitigation: Use manufacturer documentation to determine the process for interrupting the normal boot process and boot from the Trusted Bootable Environment (M1126) 3344c5f2025-05-13 Updated technique: Timeline analysis (T1086) 49f8cc22025-05-08 Added weakness: Bootable environment overwrites relevant data on the target device (W1182) 13b0b002025-05-08 Added weakness: Failure to decrypt internal disk using a bootable environment (W1181) 13b0b002025-05-08 Added weakness: Failure to identify encryption on the internal drive from bootable environment (W1180) 13b0b002025-05-08 Added weakness: Failure to detect internal disk from bootable environment (W1179) 13b0b002025-05-08 Added weakness: Inability to load the forensic bootable environment due to system configuration (W1178) 13b0b002025-05-08 Added weakness: Failing to boot from intended forensic bootable environment, causing the normal system boot process to commence (W1177) 13b0b002025-05-08 Updated weakness: Unable to physically remove/detach internal storage media (W1176) b40e6b02025-05-08 Updated technique: Memory Acquisition via Cold Boot Attack (T1114) bb7261c2025-05-08 Updated technique: Access internal storage via bootable environment (T1113) 13b0b002025-05-08 Updated technique: Access internal storage via bootable environment (T1113) b40e6b02025-05-08 Added mitigation: Use forensic bootable environment to gain access to internal media (M1126) b40e6b02025-05-06 Updated technique: Memory Acquisition via Cold Boot Attack (T1114) c2b3af02025-05-01 Added technique: T1114 45b98d6
April 2025
2025-04-27 Added weakness: Unable to remove/detach internal storage media (W1176) 3939a292025-04-27 Added weakness: Failure to find internal unattached storage media (W1175) 3939a292025-04-27 Added weakness: Failure to find internal attached storage media (W1174) 3939a292025-04-27 Added weakness: Trusted time source is incorrect (W1173) 38a499d2025-04-27 Added technique: Access internal storage via bootable environment (T1113) 3939a292025-04-27 Added technique: Physical disk identification and removal (T1112) 3939a292025-04-27 Added technique: Recording system clock offset (T1111) 38a499d2025-04-25 Added weakness: Relevant reference data missed as its necessity was not known at time of preservation (W1172) c4517622025-04-25 Added technique: Preserving reference data (T1110) c451762
March 2025
2025-03-26 Updated weakness: Failure to validate hash properly allowing an incomplete disk image to present as validated (W1126) b1a47002025-03-26 Updated weakness: Data is written to forensic format that does not preserve the original raw data (W1043) 5a6e310
February 2025
2025-02-21 Updated technique: Software write blockers (T1013) 2f3f6bf2025-02-20 Updated weakness: Data copied from sectors on source are stored incorrectly (W1016) a01baeb2025-02-20 Updated weakness: Acquisition does not include all sectors from LBA0 to LBA max (W1004) a01baeb2025-02-20 Deleted mitigation: Apply additional resources to brute force attack (M1101) a01baeb2025-02-18 Added weakness: Failure to recover data stored in database journal files (W1171) 9fab6132025-02-18 Added weakness: Failure to recover data stored in Write Ahead Log (WAL) files (W1170) 9fab6132025-02-18 Added weakness: Reliance on a field for historical reconstruction that is subject to updates and preserves only a single value (W1169) 9fab6132025-02-18 Added weakness: Data extracted from a table is assigned an incorrect interpretation (W1168) 9fab6132025-02-18 Added weakness: Combining data from multiple tables that should not be joined (W1167) 9fab6132025-02-18 Added weakness: Consideration of live database content only (W1166) 9fab6132025-02-18 Updated technique: Database examination (T1071) 9fab6132025-02-18 Added mitigation: Examine database journal files (M1125) 9fab6132025-02-18 Added mitigation: Examine database contents with and without Write Ahead Log (WAL) files applied (M1124) 9fab6132025-02-18 Added mitigation: Apply system-wide record recovery for non-allocated database record data structures (M1123) 9fab6132025-02-18 Added mitigation: Apply non-allocated record recovery to database file(s) (M1122) 9fab6132025-02-18 Added mitigation: Infer appropriate table joins from extensive experimentation with known ground-truth data (M1121) 9fab6132025-02-18 Added mitigation: Recover appropriate database table joins from source application developer documentation (M1120) 9fab6132025-02-18 Added mitigation: Recover appropriate database table joins from source application reverse engineering (M1119) 9fab6132025-02-18 Added mitigation: Recover appropriate database table joins from source application source code (M1118) 9fab6132025-02-07 Added weakness: Failure to preserve original timestamps from the data source in an archive (W1165) 542c2a12025-02-07 Updated technique: App downgrade (T1039) 981fcdb2025-02-07 Updated technique: Writing data in standard archive format (T1026) 542c2a12025-02-07 Deleted technique: Mobile storage imaging (T1021) c884d962025-02-05 Added weakness: Files are still encrypted using file-based encryption so inaccessible (W1164) f253f1c2025-02-05 Updated technique: Mobile file system extraction (T1020) f253f1c2025-02-05 Added mitigation: Attempt to obtain user PIN from user (M1117) f253f1c2025-02-05 Added mitigation: Attempt to dictionary attack user PIN (potentially on device) (M1116) f253f1c2025-02-05 Added mitigation: Attempt to brute force user PIN (potentially on device) (M1115) f253f1c2025-02-01 Updated technique: Mobile file system extraction (T1020) e7e1c222025-02-01 Updated technique: Mobile file system extraction (T1020) 2c0ff28
January 2025
2025-01-28 Added weakness: Changing relevant file metadata during file system acquisition (W1163) deda9712025-01-28 Added weakness: Changing relevant files during file system acquisition (W1162) deda9712025-01-28 Added weakness: Lack of privileges for file system acquisition (W1161) deda9712025-01-28 Added weakness: Failure to copy relevant files from the mobile device (W1160) deda9712025-01-28 Added weakness: Presenting a mobile file system acquisition as a bitwise copy of the device (W1159) deda9712025-01-28 Updated technique: Mobile device screenshot based capture (T1022) deda9712025-01-28 Updated technique: Mobile file system extraction (T1020) deda9712025-01-28 Added mitigation: Clear use of language around mobile file system extractions, making the limitations clear and differentiating from a full disk image (M1114) deda9712025-01-28 Added mitigation: Use mobile exploit to gain privileged access (M1113) deda9712025-01-24 Added weakness: Use of mobile exploit renders device unusable or ‘bricked’ (W1158) a423a0d2025-01-24 Added weakness: Use of mobile exploit changes/overwrites data that was relevant to the investigation (W1157) a423a0d2025-01-24 Updated technique: Use mobile device exploit (T1040) a423a0d2025-01-24 Updated technique: Use mobile device exploit (T1040) 1df7cd32025-01-22 Updated technique: SyncTriage-based approach (T1007) ea199f22025-01-21 Updated weakness: Presenting data as complete, that is in reality a partial set (W1037) 7a6c0a42025-01-09 Bulk change: 377 added items c033735