Terms
Digital forensics glossary
Forty terms that decide what a piece of digital evidence is worth
These terms turn up in expert reports, in seizure protocols and in defence questions in the courtroom. We explain them concisely and without jargon — the way we explain them to the parties to a case.
The glossary comes from our free educational game, where these terms have to be applied in practice rather than merely memorised. Play EVIDENCE.EXE
- $MFT and NTFS timestamps
- The NTFS file table. Every file has two sets of dates: $STANDARD_INFORMATION (easy to change) and $FILE_NAME (hard to change). A difference between them reveals date tampering.
- ACPO principles
- 1: do not change the evidence data. 2: if you must work on the original, be competent and able to explain what you did. 3: record everything so another specialist can repeat the examination. 4: the person in charge is responsible for following the principles.
- AFU and BFU
- After the first unlock (AFU) a phone has part of its data decrypted. After a restart or a flat battery it returns to the BFU state and the data is encrypted.
- Alternative hypothesis
- Another possible explanation of the traces found. ISO/IEC 27042 requires considering them before you draw a conclusion.
- Binary image
- A bit-by-bit copy of a storage medium: every sector, including deleted files and free space. The opposite of a logical copy, which covers only visible files.
- Carving
- Recovering files from raw data by their signatures, without help from the file system.
- Chain of custody
- The documented history of a piece of evidence: who had it, when and where. A break in the chain allows the evidence to be challenged.
- Confirmation bias
- The tendency to look for and notice only what confirms a thesis adopted in advance.
- Cross-contamination
- Data carried over from one case to another, e.g. via a target drive that was not properly wiped.
- Disk encryption (BitLocker)
- Without the key, the data on the disk is unreadable. On a running computer the key may sit in memory; after shutdown it is gone.
- E01 and RAW formats
- E01 stores the image with case metadata and internal checksums. RAW (dd) is a raw copy whose hash is stored separately.
- Expert opinion (art. 200 of the Polish CCP)
- It must include, among other things, the expert’s details, other persons taking part in the examination, the time of the examination and the date of the opinion, a report of the actions and observations, the conclusions and a signature.
- Faraday bag
- A shielded bag that blocks mobile, Wi-Fi and Bluetooth signals. A phone inside keeps searching for a network and drains its battery faster.
- File signature
- The first bytes of a file reveal its true type, e.g. 25 50 44 46 is PDF, 50 4B 03 04 is ZIP.
- HPA and DCO
- Hidden areas of a disk, invisible to the operating system. Before acquisition you check that the image will cover the whole medium.
- Interference
- Any change to the state of the evidence by the person in charge, even an acceptable one such as moving the mouse. It must go into the record.
- ISO/IEC 27037
- The standard on identifying, collecting, acquiring and preserving digital evidence. Key principles: auditability, repeatability, reproducibility and justifiability.
- LNK files
- Shortcuts Windows creates when files are opened. They remember the path, volume and time, even after the file is gone.
- Logical, FFS and physical extraction
- Logical: a copy via the phone’s interface, fast, but without most app data and deleted records. FFS: the full file system, usually the widest scope on a modern phone in the AFU state. Physical: a dump of the whole memory; with file-based encryption it yields mostly encrypted blocks. The rule: the widest scope available in the device’s current state, plus a description of what the method does not cover.
- Master image and working copy
- The master is kept read-only and used for verification. Analysis is done on the working copy.
- Network isolation
- Cutting a device off the internet so nobody can change or delete data remotely.
- Order of volatility
- The principle of securing data from the most volatile (RAM, connections) to the most persistent (disk, printouts).
- Prefetch
- Windows files that record when and how many times a program was run.
- RAM dump
- A copy of the RAM contents saved with a dedicated tool onto an external medium.
- Record
- A record of the procedure: time, place, legal basis, persons present, course, list of items, statements and signatures. Facts only, no opinions.
- Recovery key
- A long code that unlocks an encrypted disk without the user’s password.
- Remote wipe
- A command sent over the network that wipes a device, e.g. resets it to factory settings.
- Report checksum
- It only proves that nobody changed the report file. It does not prove that the report faithfully and completely reflects the device. Like a seal: it only works together with the bag.
- Report versus source evidence
- A report from an analysis program describes selected data, prepared by one person with one program. The source evidence is the full copy of the data. Without it, nobody can check whether the report is true and complete.
- Scene as found
- How the scene and devices looked on arrival, before any change. It is documented with photos and a description.
- Seal
- A numbered seal on the packaging. An intact seal shows nobody has opened the evidence.
- SHA-256 checksum
- A file’s “fingerprint”. Changing even one bit gives a completely different result, so the hash shows the copy is intact.
- Shielded enclosure
- A box or room that blocks radio signals, in which you can safely work on a phone.
- Timestomping
- Deliberately changing a file’s dates to make it look older or newer. A typical anti-forensics technique.
- Tool validation
- Testing on test data that a tool does exactly what it claims. Only validated versions are used.
- USBSTOR
- A registry branch with the history of connected USB devices, including serial numbers.
- USN journal
- The file system change journal: creation, renaming and deletion of files.
- UTC and clock drift
- Windows stores most times in UTC. To get local time you add the time zone (UTC+1 in winter) and check whether the computer’s clock was accurate.
- Volatile data
- Information that disappears when power is cut: RAM contents, running processes, active network connections.
- Write blocker
- A device that lets you read a disk without being able to write anything to it. A basic laboratory tool.