Tech Terms Flashcards
Active File v. File Fragment
Definition: An active file is a complete, unaltered file that can be accessed normally by a user. A file fragment is an incomplete part of a file, often due to deletion or corruption.
Forensic Importance: Active files are easier to analyze, whereas file fragments can be key in reconstructing deleted or corrupted evidence.
Lay Audience: Think of an active file as a complete puzzle, while a file fragment is like a few scattered pieces of that puzzle.
App v. Program
Definition: An “app” typically refers to lightweight software, often designed for mobile devices, while a “program” is broader and can include complex software for desktops and servers.
Forensic Importance: Apps often store user data in cloud services or mobile storage, while programs may keep logs and files on hard drives.
Lay Audience: An app is like the tool you download on your phone (e.g., Instagram), while a program is more like what runs on your computer (e.g., Microsoft Word).
American Standard Code for Information Interchange v. Unicode
Definition: ASCII is a character encoding standard that uses 7 bits to represent characters. Unicode is a more comprehensive encoding system that supports many more characters across multiple languages.
Forensic Importance: Unicode allows for a wider analysis of data, especially in international investigations where multiple languages are involved.
Lay Audience: ASCII is like a simple codebook for English, while Unicode is a universal translator for most languages.
Backup Software v. Volume Shadow Copy
Definition: Backup software creates copies of files to restore in case of data loss. Volume Shadow Copy is a Windows feature that periodically saves system snapshots for data recovery.
Forensic Importance: Backup files and shadow copies can be crucial for recovering deleted or overwritten data.
Lay Audience: Backup software is like making photocopies of documents, while Volume Shadow Copy is like having an automatic “undo” button for your files.
Carved File v. Recovered Deleted File
Definition: Carved files are recovered from unallocated space without relying on file system metadata. Recovered deleted files are found by referencing metadata.
Forensic Importance: Carving is essential when file metadata is missing or corrupted, allowing recovery from fragmented files.
Lay Audience: Carving is like finding bits of a document in a shredder, while recovering deleted files is like retrieving them from the recycling bin.
Cloud Storage v. Network Drive
Definition: Cloud storage involves storing data on remote servers accessed via the internet, while a network drive is a physical drive on a local network.
Forensic Importance: Cloud data can be hard to access due to encryption and legal hurdles, while network drives are more locally accessible.
Lay Audience: Cloud storage is like renting storage space on the internet, while a network drive is like sharing a hard drive within your office.
Cluster v. Sector
Definition: A cluster is a group of sectors, the smallest units of data storage on a disk.
Forensic Importance: Clusters and sectors are key to understanding file systems and where data is physically stored on a disk.
Lay Audience: A sector is like a single page in a book, while a cluster is a group of pages.
Container Email v. Web Email
Definition: Container email is stored on a local client (e.g., Outlook PST files), while web email is stored on a server accessed via a browser (e.g., Gmail).
Forensic Importance: Container emails provide easier access to local data, while web email requires network access or subpoenas to retrieve.
Lay Audience: Container email is like keeping your letters in a personal filing cabinet, while web email is like letters stored in a cloud-based mailbox.
Device Configuration Overlay v. Host Protected Area
Definition: Device Configuration Overlay (DCO) and Host Protected Area (HPA) are reserved areas on a hard drive. DCO limits the accessible storage, while HPA stores system files.
Forensic Importance: These areas may contain hidden or overlooked data, crucial for investigations.
Lay Audience: DCO and HPA are like hidden drawers in a filing cabinet where secret or system files might be stored.
DD v. E01 Image
Definition: DD (Disk Dump) creates a raw disk image, while E01 (EnCase) is a forensic image format that includes metadata and compression.
Forensic Importance: E01 allows for more efficient storage and verification of forensic integrity through hash values.
Lay Audience: DD is like making a raw photocopy of a hard drive, while E01 is a specialized, compressed photocopy with added notes and authenticity checks.
Deleted Files v. Recycle Bin Files
Definition: Deleted files are no longer visible in the file system but may still exist on disk. Recycle Bin files are “soft-deleted” files that can be easily restored until the bin is emptied.
Forensic Importance: Recycle Bin files are easier to recover, while deleted files may require specialized tools for data recovery.
Lay Audience: Deleted files are like throwing something away, but it’s still in the trash. Recycle Bin files are like items you’ve put in a trash can but haven’t taken out to the curb yet.
DHCP v. Static IP Address
Definition: DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to devices, while static IP addresses are manually set and don’t change.
Forensic Importance: Tracking a device’s network activity is easier with a static IP, while DHCP can make it harder to trace which device had which IP at a given time.
Lay Audience: DHCP is like automatically getting a parking space, while static IP is like always parking in the same reserved spot.
Digital Forensics v. General Forensics
Definition: Digital forensics focuses on recovering and investigating data from digital devices, while general forensics includes physical evidence like fingerprints, DNA, and more.
Forensic Importance: Digital forensics is critical in cybercrime, fraud, and many modern investigations.
Lay Audience: Digital forensics is like being a detective for computers and phones, while general forensics is solving crimes with fingerprints and DNA.
Encryption v. Password Protection
Definition: Encryption transforms data into unreadable code that can only be unlocked with a key. Password protection restricts access to a file or system but doesn’t necessarily encrypt the data.
Forensic Importance: Encrypted data is much harder to recover without the key, while password protection can sometimes be bypassed with cracking techniques.
Lay Audience: Encryption is like putting your data in a locked vault that only a specific key can open, while password protection is like putting a lock on the front door.
ESE v. SQLite Database
Definition: Extensible Storage Engine (ESE) is a database format used by Microsoft systems (e.g., Windows Mail), while SQLite is a lightweight, self-contained database format used in many applications.
Forensic Importance: Both database formats store valuable user data that can be crucial for investigations.
Lay Audience: ESE is like Microsoft’s specialized database format, while SQLite is a smaller, portable type of database used in many apps.
Event Log v. USN Journal ($J)
Definition: Event logs record system activities like login attempts and errors, while the USN Journal tracks changes to files and directories on NTFS drives.
Forensic Importance: Event logs are useful for tracking system activity, while the USN Journal can provide insights into file changes.
Lay Audience: Event logs are like a diary of what’s happened on your computer, while the USN Journal is a list of changes to files and folders.
FAT v. MFT
Definition: FAT (File Allocation Table) and MFT (Master File Table) are file system structures. FAT is used in simpler systems, while MFT is used in the more advanced NTFS.
Forensic Importance: MFT is more robust and contains more metadata about files, making it a richer source of information for investigations.
Lay Audience: FAT is like a basic map of where files are, while MFT is a more detailed map with extra information about each file.
File Date v. Metadata Date (such as EXIF)
Definition: File dates (creation, access, modification) are recorded by the file system, while metadata dates (e.g., EXIF for photos) are embedded within the file itself.
Forensic Importance: Both types of dates can help establish timelines, but metadata can sometimes be more reliable if the file system has been tampered with.
Lay Audience: File dates are like the timestamps on a letter’s envelope, while metadata dates are like details on the letter itself.
File Extension v. File Signature
Definition: A file extension (e.g., .jpg, .pdf) is the part of the filename that tells the operating system what type of file it is. A file signature is a unique sequence of bytes identifying the file type.
Forensic Importance: File signatures can reveal the true type of a file even if the extension has been changed to disguise it.
Lay Audience: File extensions are like labels on boxes, while file signatures are like the contents of the box that can tell you what’s really inside.
