About This Workshop
The SOLVE-IT knowledge base was introduced in DFRWS EU 2025 as a paper and presentation. This workshop builds on that original work and an additional year of development and will provide participants with the knowledge and skills to make use of the knowledge base. The workshop will cover how to use SOLVE-IT, with specific applications for practitioners, researchers, and educators.
For practitioners, this workshop will provide a (re)introduction to the SOLVE-IT knowledge base and it’s concepts and structure. It will also cover, with examples, how to use SOLVE-IT to review a Standard Operating Procedure or tool workflow, and then use the SOLVE-IT utilities to enumerate and compile any weaknesses and additional mitigations that could be added to the process.
For both researchers and practitioners, we will also cover contributing to the SOLVE-IT project. With case studies and worked examples we will show how to convert research into SOLVE-IT concepts (including mapping to the CASE ontology). We will also demonstrate the use of the TRWM methodology to systematically enumerate the weaknesses of a digital forensic technique, and to identify mitigations. It is hoped that by the end of the workshop a significant number of participants will have their name in the SOLVE-IT knowledge base as a result of making a contribution!
Also of interest to researchers, this workshop will introduce SOLVE-IT-X, the new extensions framework for SOLVE-IT that allows participants to build an extended knowledge base on top of SOLVE-IT data structures. This will again be demonstrated with worked examples.
For educators, the workshop will highlight content from the SOLVE-IT education repository, including freely available exercises that can be given to students, and examples of how SOLVE-IT has been integrated into teaching material.
Learning Objectives
At the end of this workshop you will be able to:
- Describe the applications and uses of SOLVE-IT
- Use SOLVE-IT to review an SOP or workflow, identify techniques and enumerate weaknesses and mitigations
- Contribute to the SOLVE-IT knowledge base
- Use the TRWM process to systematically enumerate weaknesses and mitigations for a technique
- Build your own knowledge base on top of SOLVE-IT using SOLVE-IT-X
- Navigate the teaching materials produced to incorporate SOLVE-IT when teaching digital forensics
Requirements
- Python installed
- GitHub account (for contributing to the knowledge base)
- Excel or similar spreadsheet application
- An application capable of viewing markdown files