A structured review of AI applicability across SOLVE-IT digital forensic techniques, organised by investigative objective. Back to interactive viewer
Conduct activities in preparation of conducting a digital investigation
This technique has not yet been assessed for AI applicability.
Locate sources of digital evidence that may be relevant to the investigation.
The process of 'carefully documenting the conditions at a crime scene and identifying all relevant physical evidence.' (Birzer 2018).
@article{wickramasekara2024sok,
title={Sok: Exploring the potential of large language models for improving digital forensic investigation efficiency},
author={Wickramasekara, Akila and Breitinger, Frank and Scanlon, Mark},
journal={arXiv e-prints},
pages={arXiv--2402},
year={2024}
}The use of canines to locate obscured digital storage devices.
No AI applicability identified during review.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}@article{gratian2019identifying,
title={Identifying infected users via network traffic},
author={Gratian, Margaret and Bhansali, Darshan and Cukier, Michel and Dykstra, Josiah},
journal={Computers \& Security},
volume={80},
pages={306--316},
year={2019},
publisher={Elsevier}
}A technique developed in Hargreaves & Marshall (2018) whereby synchronization artifacts on a device are examined and used to identify the existence of a related device. Also sometimes used to infer activity that occurred on an inaccessible or unavailable device.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}Rank the evidence sources based on their relevance and potential value to the investigation.
Digital forensic triage is a partial forensic examination conducted under (significant) time and resource constraints [DFCite-1115].
@inproceedings{du2020sok,
title={SoK: Exploring the state of the art and the future potential of artificial intelligence in digital forensic investigation},
author={Du, Xiaoyu and Hargreaves, Chris and Sheppard, John and Anda, Felix and Sayakkara, Asanka and Le-Khac, Nhien-An and Scanlon, Mark},
booktitle={Proceedings of the 15th international conference on availability, reliability and security},
pages={1--10},
year={2020}
}Ensure the integrity and authenticity of digital evidence is maintained.
No AI applicability identified during review.
Place a device in an environment designed to shield a mobile phone or small digital device from radio waves entering the environment and reaching the device, and to stop radio waves escaping from the environment (adapted from Lennox-Steele & Nisbet (2016))
No AI applicability identified during review.
A hardware write blocking device [should] prevent any change to data in the user area of a hard drive while allowing access to all data on a hard drive. (Lyle 2006)
No AI applicability identified during review.
Use of a software-based tool that prevents a computer from writing to computer storage media connected to it (NIST 2006)
No AI applicability identified during review.
A precursor to extracting volatile memory (RAM) from a powered-off system by quickly rebooting or transferring the memory module to another system before residual data fades. Cooling the memory modules can significantly slow down data decay, preserving critical data such as encryption keys or passwords.
No AI applicability identified during review.
Connect to physical sources of digital evidence to facilitate data extraction
No AI applicability identified during review.
This involves accessing a live system and relying on the operating system's parsing of the file system to access files.
No AI applicability identified during review.
Booting the suspected computer device into an alternative operating system in order to image the attached disks.
No AI applicability identified during review.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}This technique describes the occasions where it is necessary to connect directly to a disk without a hardware write blocker. This would typically then involve a subseqeunt software write blocker, which then presents a write protected interface.
No AI applicability identified during review.
Locate physical storage media within devices and removing them
This technique has not yet been assessed for AI applicability.
Attempt to gain access to protected data sources or other restricted data.
Downgrading an app to a version in which data is available e.g. via a backup method
No AI applicability identified during review.
A brute force attack, or exhaustive search is a password cracking approach where every combination of characters is tested until the correct one is found. This method is "guaranteed to work" given infinite time and resources which in a real-life scenario is not feasible.
No AI applicability identified during review.
A dictionary attack is a password cracking technique where an attacker uses a list of passwords, called a dictionary, to attempt to guess a password.
@inproceedings{hitaj2019passgan,
title={Passgan: A deep learning approach for password guessing},
author={Hitaj, Briland and Gasti, Paolo and Ateniese, Giuseppe and Perez-Cruz, Fernando},
booktitle={Applied Cryptography and Network Security: 17th International Conference, ACNS 2019, Bogota, Colombia, June 5--7, 2019, Proceedings 17},
pages={217--237},
year={2019},
organization={Springer}
}Accessing a device with limited or no security to obtain a credential (e.g. password, PIN, token) that can be used to access another device or service.
No AI applicability identified during review.
This describes the technique whereby an attempt is made to extract key material from memory, or a memory acquisition of a running system to fascinate the decryption of some data
No AI applicability identified during review.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}No AI applicability identified during review.
@article{le2021identifying,
title={Identifying Internet of Things software activities using deep learning-based electromagnetic side-channel analysis},
author={Le, Quan and Miralles-Pechu{\'a}n, Luis and Sayakkara, Asanka and Le-Khac, Nhien-An and Scanlon, Mark},
journal={Forensic Science International: Digital Investigation},
volume={39},
pages={301308},
year={2021},
publisher={Elsevier}
}@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}No AI applicability identified during review.
A process that typically exploits a security flaw in a specific device or operating system to enable users to perform higher privileged functions on a device (derived from Grover 2013)
No AI applicability identified during review.
Change a setting on a device such that a service needed for data extraction is enabled. This may require a user PIN that can be obtained using other techniques.
This technique has not yet been assessed for AI applicability.
Collect data from the identified evidence sources.
Programmatically controlling a mobile device while capturing screenshots of the display.
This technique has not yet been assessed for AI applicability.
No AI applicability identified during review.
No AI applicability identified during review.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}Restore a device's cloud backup to a donor device, then subsequently use a local acquisition approach on that donor device, e.g. T1019/T1020
This technique has not yet been assessed for AI applicability.
No AI applicability identified during review.
Copying of sectors from a storage media, typically LBA~0~ to LBA~max~ to a bitstream that can be stored in a image format (DFT-1025).
No AI applicability identified during review.
Use an exposed service on a device to extract data. This represents several of the mobile data extraction methods e.g. Query content providers (android), AFC (iOS).
No AI applicability identified during review.
Using the in-built backup capability of a device to extract a subset of its contents
No AI applicability identified during review.
Deploy software to a mobile device that can carry out some function, either collect data with available permissions or attempt further exploitation e.g. sandbox escape.
No AI applicability identified during review.
Running commands on a live system to collect specific pieces of information e.g. running processes or open ports
No AI applicability identified during review.
Involves creating a copy of the live memory data of a running system
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}An examiner directly manipulates the target mobile device using the device's input interface (i.e., keypads and buttons), and records the content shown on the display of the device. (Fukami et al 2021)
@misc{xways,
author = "X-Ways",
title = "X-Ways Forensics 20.3 Public Announcement",
year = "2021",
url = "https://www.x-ways.net/winhex/forum/messages/1/5308.html?1673371179"
}No AI applicability identified during review.
This technique has not yet been assessed for AI applicability.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}Recording a system clock compared with trusted time source
No AI applicability identified during review.
No AI applicability identified during review.
Views a set of files (typically via direct access from previewing) and acquires a subset of them.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}Previewing a data source and selecting a subset of the data for collection into a container such as a tar/zip file or a forensic image format for the purposes of protecting the privacy of the complainant or witness.
@inproceedings{webb2024responsible,
title={Responsible AI in policing},
author={Webb, Helena and Fitzroy-Dale, Nicholas and Aqeel, Saamiya and Piskopani, Anna Maria and Stafford-Fraser, Quentin and Nikolaou, Christos and Dowthwaite, Liz and Mcauley, Derek and Hargreaves, Christoper},
booktitle={Proceedings of the Second International Symposium on Trustworthy Autonomous Systems},
pages={1--5},
year={2024}
}Accessing the file system(s) of the device and extracting a set of files (full or partial depending on level of access)
No AI applicability identified during review.
Use of content queries on Android devices via adb to extract specific pieces of data exposed by content providers.
This technique has not yet been assessed for AI applicability.
Rather than imaging a block device, this involves accessing it directly without the expectation of saving block data to a forensic image format.
This technique has not yet been assessed for AI applicability.
Store acquired data in one or more formats for subsequent examination and analysis
Storage of bitstream data recovered from a digital device
No AI applicability identified during review.
Storing acquired data in a standard archive format such as rar, tar or zip
No AI applicability identified during review.
Access data within digital evidence containers such as disk images, memory dumps, or archive formats.
Extract files from a common archive format e.g. TAR, RAR, ZIP
No AI applicability identified during review.
No AI applicability identified during review.
The decoding of a forensic format such as EWF such that the raw sectors can be accessed by a forensic tool (typically performed on-the-fly internally in a tool.)
No AI applicability identified during review.
Processing an extracted mobile device backup to access the files contained within.
No AI applicability identified during review.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}Decodes logical image formats such as L01, AD1, CTR, or AFF4-L. The output here is not an image file but rather a set of files and their metadata.
No AI applicability identified during review.
This technique reads data from a raw image e.g. a dd image.
No AI applicability identified during review.
Processing a screenshot captured from a device to extract data for further processing.
This technique has not yet been assessed for AI applicability.
Represents reading files that have been acquired or extracted directly to the local file system.
No AI applicability identified during review.
Filter the data to be considered in the investigation for practical, legal, or privacy protection reasons.
After hashing a set of files, compare the hashes against a known hashset to identify and remove known files from further examination.
No AI applicability identified during review.
Limiting the scope of file processing based on type, date or other criteria to protect privacy.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}Process core data storage structures such as partitions, volumes, and file systems, recovering content and metadata.
The process of decrypting an encrypted file system/volume to make its contents accessible for analysis.
No AI applicability identified during review.
The recovery of files from non-allocated space
No AI applicability identified during review.
Use metadata that remains in the file system to recover non-allocated files
This technique has not yet been assessed for AI applicability.
The process of recovering files from non-allocated space using only the structural properties of files.
@article{alam2024sift,
title={SIFT: Sifting file types—application of explainable artificial intelligence in cyber forensics},
author={Alam, Shahid and Demir, Alper Kamil},
journal={Cybersecurity},
volume={7},
number={1},
pages={52},
year={2024},
publisher={Springer}
}Applying a process that identifies the types of files.
No AI applicability identified during review.
Partitions are defined as ‘allocated contiguous sets of sectors from storage media’. This involves recovering the list of partitions that exist on a storage media.
No AI applicability identified during review.
This involves parsing the allocated file system data structures and reconstructing the file system of the target media or device.
No AI applicability identified during review.
From a partition or data from a full disk, identify volumes.
This technique has not yet been assessed for AI applicability.
Process data stored by the operating system to extract digital forensic artifacts.
Focuses on operating system level cloud syncronization features, such as iCloud Drive and OneDrive, which may be used to synchronize files between a local system and a cloud service.
No AI applicability identified during review.
Examine information from operating system artifacts relating to content indexing and search capabilities e.g. Windows Desktop Search
No AI applicability identified during review.
Extraction and analysis of information that allows programs installed on an OS to be identified.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}@article{scanlon2023chatgpt,
title={ChatGPT for digital forensic investigation: The good, the bad, and the unknown},
author={Scanlon, Mark and Breitinger, Frank and Hargreaves, Christopher and Hilgert, Jan-Niclas and Sheppard, John},
journal={Forensic Science International: Digital Investigation},
volume={46},
pages={301609},
year={2023},
publisher={Elsevier}
}The process of examining operating system files to extract artifacts that may indicate file accesses.
No AI applicability identified during review.
The process of examining operating system files to extract artifacts that may indicate a program has been run.
No AI applicability identified during review.
Examination of operating system artifacts to determine user accounts
No AI applicability identified during review.
Examination of the operating system structures that allows individual processes to be listed and pages used by specific processes to be enumerated.
@article{oh2024volgpt,
title={volGPT: Evaluation on triaging ransomware process in memory forensics with Large Language Model},
author={Oh, Dong Bin and Kim, Donghyun and Kim, Huy Kang},
journal={Forensic Science International: Digital Investigation},
volume={49},
pages={301756},
year={2024},
publisher={Elsevier}
}Examine artifacts and extract indicators of devices that have been connected to the target device.
This technique has not yet been assessed for AI applicability.
Extraction of data from the versioning system used by an operating system to store older versions of files.
This technique has not yet been assessed for AI applicability.
Process data stored by the applications to extract digital forensic artifacts.
Recovery of information left from web browsing activity (derived from Oh et al (2011))
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}The examination of the history component of a web browser.
This technique has not yet been assessed for AI applicability.
The examination of the content saved locally by browsers to improve performance
This technique has not yet been assessed for AI applicability.
The examination of sessions and open tabs and their individual histories
This technique has not yet been assessed for AI applicability.
The examination of data that is stored to autocomplete entries in forms
This technique has not yet been assessed for AI applicability.
The examination of the links saved within a browser to facilitate quick access
This technique has not yet been assessed for AI applicability.
The examination of records of files downloaded with a browser
This technique has not yet been assessed for AI applicability.
The examination of a browsers configuration
This technique has not yet been assessed for AI applicability.
The enumeration of the separate user profiles set up within a browser
This technique has not yet been assessed for AI applicability.
The examination of the extensions installed within a browser
This technique has not yet been assessed for AI applicability.
The examination of the settings and artifacts resulting from a browser synchronization feature
This technique has not yet been assessed for AI applicability.
The examination of stored browser cookies
This technique has not yet been assessed for AI applicability.
The examination of
This technique has not yet been assessed for AI applicability.
Analysis of the files that provide the backing store for a chat or messenger application
@conference{mobint-named,
title="Mobint – an advanced platform supporting integration and analysis of mobile data coming from various sources",
author="Piętak, Kamil and Dajda, Jacek and Kisiel-Dorohinicki, Marek",
booktitle = "DFRWS EU 2025",
year="2025"
}Involves examination of cloud synchronization artifacts from apps rather than those built into the operating system.
No AI applicability identified during review.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}No AI applicability identified during review.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}Examination of the specific structures from the memory of a specific application
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}This technique has not yet been assessed for AI applicability.
This technique has not yet been assessed for AI applicability.
This technique has not yet been assessed for AI applicability.
The forensic examination of the artifacts describing the configuration or the interaction with an AI companion app or service.
This technique has not yet been assessed for AI applicability.
Process data to extract artifacts from specific data formats.
The extraction of metadata from within images (pictures). e.g. EXIF, XMP. IPTC, iTXt etc.
No AI applicability identified during review.
Parsing a URL and extracting search terms from the parameters.
This technique has not yet been assessed for AI applicability.
Repair file by grafting different reference data onto fragment(s)
No AI applicability identified during review.
Examination of a SQLite database file(s) to extract information from within.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}Process data to extract specific types of artifact
The extraction and normalisation of timestamps from a data source into a set of timeline entries
@inproceedings{du2020sok,
title={SoK: Exploring the state of the art and the future potential of artificial intelligence in digital forensic investigation},
author={Du, Xiaoyu and Hargreaves, Chris and Sheppard, John and Anda, Felix and Sayakkara, Asanka and Le-Khac, Nhien-An and Scanlon, Mark},
booktitle={Proceedings of the 15th international conference on availability, reliability and security},
pages={1--10},
year={2020}
}Application of a time offset to a timestamp
This technique has not yet been assessed for AI applicability.
Extracting strings from a data source and adding them to an index for subsequent searching.
This technique has not yet been assessed for AI applicability.
This technique takes a set of files and determines which are related to a specified application.
This technique has not yet been assessed for AI applicability.
Extracting common types of entity in a data source e.g. email addresses, IP addresses, domain names, URLs, credit card numbers, etc.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}Finds references between artifacts, such as operating system artifacts that refer to a specific file
No AI applicability identified during review.
Examination of a file that was designed for storing configuration information for a piece of software (e.g. an application or operating system feature)
No AI applicability identified during review.
The use of automation to extract pieces of data that are potentially useful for a digital forensic investigation from app data.
This technique has not yet been assessed for AI applicability.
Examination of a file that was designed for incremental logging from a piece of software (e.g. an application or operating system feature)
No AI applicability identified during review.
Attempt to find digital artifacts relevant to the investigation.
No AI applicability identified during review.
No AI applicability identified during review.
This technique involves searching data in the case for specific strings
@article{scanlon2023chatgpt,
title={ChatGPT for digital forensic investigation: The good, the bad, and the unknown},
author={Scanlon, Mark and Breitinger, Frank and Hargreaves, Christopher and Hilgert, Jan-Niclas and Sheppard, John},
journal={Forensic Science International: Digital Investigation},
volume={46},
pages={301609},
year={2023},
publisher={Elsevier}
}Searching for keywords over the raw data in a case without using an index of text content
This technique has not yet been assessed for AI applicability.
Searching for keywords over the raw data on a sector by sector basis
This technique has not yet been assessed for AI applicability.
Searching for keywords over the raw data, without an index of text content, but on a file by file basis
This technique has not yet been assessed for AI applicability.
Searching for keywords within a generated index of data in a case
This technique has not yet been assessed for AI applicability.
Searching for case-type specific keywords
This technique has not yet been assessed for AI applicability.
Searching for case-specific keywords, e.g. people's names, places etc.
This technique has not yet been assessed for AI applicability.
Keyword searching only applied over extracted artifacts
This technique has not yet been assessed for AI applicability.
Use the path of file name to determine potential relevance of the file.
No AI applicability identified during review.
The process of searching, filtering, sorting, highlighting, or aggregating timeline entries to determine which are relevant for event reconstruction, or to identify times of interest (adapted from Breitinger et al. 2025)
@article{studiawan2021anomaly,
title={Anomaly detection in a forensic timeline with deep autoencoders},
author={Studiawan, Hudan and Sohel, Ferdous},
journal={Journal of Information Security and Applications},
volume={63},
pages={103002},
year={2021},
publisher={Elsevier}
}Correlate timestamps from the system clock and an external trusted time source (Time Anchoring)
This technique has not yet been assessed for AI applicability.
Review potentially relevant content to determine its significance or meaning.
Manual examination of files or artifacts to determine their relevance to the investigation.
@article{scanlon2023chatgpt,
title={ChatGPT for digital forensic investigation: The good, the bad, and the unknown},
author={Scanlon, Mark and Breitinger, Frank and Hargreaves, Christopher and Hilgert, Jan-Niclas and Sheppard, John},
journal={Forensic Science International: Digital Investigation},
volume={46},
pages={301609},
year={2023},
publisher={Elsevier}
}The process of examining the directory hierarchy, file and folder names (rather than file contents) to identify potentially relevant material.
@article{scanlon2023chatgpt,
title={ChatGPT for digital forensic investigation: The good, the bad, and the unknown},
author={Scanlon, Mark and Breitinger, Frank and Hargreaves, Christopher and Hilgert, Jan-Niclas and Sheppard, John},
journal={Forensic Science International: Digital Investigation},
volume={46},
pages={301609},
year={2023},
publisher={Elsevier}
}@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}This technique has not yet been assessed for AI applicability.
Classification of images with respect to their origin, i.e., whether they are synthetically generated or naturally captured by a camera.
@misc{amped_authenticate,
author = {{Amped Software}},
title = {Amped Authenticate: Photo, Video, and Deepfake Forensics},
year = {2026},
url = {https://ampedsoftware.com/authenticate},
note = {Accessed: 2026-03-27},
howpublished = {\url{https://ampedsoftware.com/authenticate}}
}@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}Search for indicators of anti-forensic techniques or other anomalies such as malware, which could affect interpretation.
Searching for the presence of current or historical steganography software on a system
No AI applicability identified during review.
Checking the content of a file against its file extension to identify mismatches.
No AI applicability identified during review.
Searching for the presence of current or historical malware on a system
This technique has not yet been assessed for AI applicability.
Searching for indicators that the system clock has been tampered with
This technique has not yet been assessed for AI applicability.
Searching for the presence of current or historical encrypted data on a system
This technique has not yet been assessed for AI applicability.
Searching for the presence of current or historical trail obfuscation on a system
This technique has not yet been assessed for AI applicability.
Searching for the presence of current or historical artifact wiping
This technique has not yet been assessed for AI applicability.
Attempt to link data or devices to individuals.
Analysis of user account information to extract content that may help identify the person associated with an account, such as usernames, real names, password hints, security questions, recovery email addresses, and profile details.
No AI applicability identified during review.
No AI applicability identified during review.
Display information using visual representations to assist with analysis.
A suspect disk image can be configured to boot as a virtual machine, which allows screenshots to be taken showing how the user's desktop looked for example.
No AI applicability identified during review.
Presenting points or paths visually using extracted data, typically on a map
This technique has not yet been assessed for AI applicability.
Conduct research to gain additional knowledge to support the acquisition, extraction, or interpretation of digital evidence.
The process of running software in a controlled environment to observe its behavior and identify potential forensic artifacts.
This can be done during experiments to help ascertain functionality, or potential forensic artifacts
No AI applicability identified during review.
Typically to understand it's capabilities, the artifacts it produces, or what user actions could be potentially reconstructed
@inproceedings{chen2023gptutor,
title={GPTutor: a ChatGPT-powered programming tool for code explanation},
author={Chen, Eason and Huang, Ray and Chen, Han-Shin and Tseng, Yuen-Hsien and Li, Liang-Yi},
booktitle={International Conference on Artificial Intelligence in Education},
pages={321--327},
year={2023},
organization={Springer}
}Taking measurements to assess which cells actually provide service at a specific location (adapted from Tart et al 2012).
No AI applicability identified during review.
Monitor every version change of an application to determine if there are changes to the way the app stores data
This technique has not yet been assessed for AI applicability.
Use available digital evidence to formulate and test hypotheses about events.
The process of assigning location properties to a reconstructed event
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}The process of determining the existence and nature of relationships between entities during event reconstruction
@inproceedings{henseler2019technology,
title={Technology Assisted Analysis of Timeline and Connections in Digital Forensic Investigations.},
author={Henseler, Hans and Hyde, Jessica},
booktitle={LegalAIIA@ ICAIL},
pages={32--37},
year={2019}
}The process of assigning a time component to a reconstructed event
This technique has not yet been assessed for AI applicability.
The process of attempting to link an identity (account, person etc.) to a reconstructed event
This technique has not yet been assessed for AI applicability.
The process of reconstructing that an operation occurred on a digital system
This technique has not yet been assessed for AI applicability.
Reconstructing the configuration or capabilities of a system at the time of an event
This technique has not yet been assessed for AI applicability.
Evaluate evidence
Create documentation about techniques used and findings.
Make a record of selected files or pieces of data so they can be accessed easily, or used for generating automated reports.
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}No AI applicability identified during review.
Generate a report in PDF, HTML or other format that compiles tagged (or bookmarked) items from a case into a package that can be reviewed.
No AI applicability identified during review.
@article{michelet2024chatgpt,
title={ChatGPT, Llama, can you write my report? An experiment on assisted digital forensics reports written using (local) large language models},
author={Michelet, Ga{\"e}tan and Breitinger, Frank},
journal={Forensic Science International: Digital Investigation},
volume={48},
pages={301683},
year={2024},
publisher={Elsevier}
}A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer [DFCite-1147].
@article{hargreaves2025solve,
title={SOLVE-IT: A proposed digital forensic knowledge base inspired by MITRE ATT\&CK},
author={Hargreaves, Christopher and van Beek, Harm and Casey, Eoghan},
journal={Forensic Science International: Digital Investigation},
volume={52},
pages={301864},
year={2025},
publisher={Elsevier}
}No techniques match the selected categories.