# SOLVE-IT

A knowledge base of digital forensics investigation techniques, modeled on MITRE ATT&CK, cataloging each technique's objective, ways it can go wrong and mitigations for those weaknesses.

SOLVE-IT structures digital forensics knowledge around four linked concepts: an objective, the goal an investigator wants to achieve such as acquiring data; a technique, a specific way to achieve that objective such as creating a disk image; a weakness, a potential problem that can arise from using a technique, classified using the ASTM E3016-18 error-mitigation standard; and a mitigation, something that can be done to avoid or reduce a weakness's impact.

Each technique, weakness and mitigation is stored as a directly viewable JSON file under the data directory, with Python utilities for working with the knowledge base programmatically and scripts for generating Markdown reports from it; a hosted explorer and a machine-readable data export are also provided for browsing without cloning the repository.

It is written in Python, community-maintained, and licensed under MIT.

Website: https://github.com/SOLVE-IT-DF/solve-it