DFIQ: Codifying Digital Forensic Intelligence

Thomas Chopitea introduces DFIQ, short for Digital Forensics Investigative Questions, an open catalog that pairs forensic questions with documented approaches for answering them. He frames forensics as answering a question by collecting digital traces and interpreting them in a repeatable way, and argues that newcomers and distributed teams struggle with knowing what to ask, where artifacts live, and how to read them consistently.

The catalog is built from YAML objects organized into scenarios, facets, questions and approaches. Each approach lists steps such as collecting artifacts, processing them with Plaso, and filtering results in Timesketch, and notes what the approach does and does not cover. The format is system agnostic, so the files can be published as a static wiki, while Yeti serves as the backend for an internal web editor, tree view and graph. He also demonstrates an automation prototype, DFTimewolf, that collects evidence and sends it to analysis, plus an experimental LLM step that summarizes query results from a crypto-miner case.

He closes with the schema and governance problems the team hit: a confusing early schema, ID collisions in public contributions, duplicate questions, and hard-to-capture ad hoc hunches. The main takeaway is that a shared, versioned catalog can improve consistency, onboarding and knowledge sharing, and he asks the audience for ideas on getting the wider community to contribute.