CF-L3 / CCFT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Locard's exchange principle

Every contact between two objects leaves a trace; in digital forensics, actions on a system may create or alter artifacts, so investigators must document and minimize contamination.

Order of volatility

A prioritization for collecting the most perishable evidence first: CPU registers and cache, RAM, network state, temporary files, then disk and archival media.

Forensic soundness

The property that evidence handling is repeatable, reproducible, and defensible, typically achieved with write blockers, verified hashes, documented procedures, and an unbroken chain of custody.

Daubert admissibility factors

A U.S. judicial test considering whether a technique is testable, peer reviewed, has a known error rate, follows standards, and is generally accepted in the relevant field.

Fourth Amendment

U.S. constitutional protection against unreasonable searches and seizures; digital evidence collection generally requires a warrant, valid consent, or a recognized exception such as exigency.

Third-party doctrine

The principle that information voluntarily given to a third party may lack Fourth Amendment protection; Carpenter v. United States narrowed it for cell-site location records.

Hearsay business records exception

A legal rule allowing routine records made in the regular course of business, including many computer logs, to be admitted without the author testifying, if foundational requirements are met.

File signature analysis

Identifying a file's true type from its header bytes, or magic number, rather than trusting the extension; mismatches can indicate concealment or corruption.

NTFS $MFT

The Master File Table is NTFS's core metadata database; each file or directory has at least one record containing attributes, timestamps, and data run information.

Email header Received chain

The sequence of Received lines records mail servers that handled a message; read bottom-up, it can reveal origin, relays, and delays, though headers can be forged.

SPF DKIM DMARC

Email authentication mechanisms: SPF authorizes sending IPs, DKIM cryptographically signs messages, and DMARC tells receivers how to handle failures.

Write blocker

A hardware or software device that permits read-only access to storage media, preventing accidental modification during acquisition and preserving evidentiary integrity.

Hash verification

Computing a cryptographic digest such as SHA-256 before and after acquisition; matching values demonstrate that the image is a bit-for-bit copy of the source.

Live acquisition

Collecting data from a running system, including volatile memory and network state; it captures perishable evidence but may alter the system and must be carefully documented.

Faraday bag

A shielded container that blocks radio signals, used to isolate mobile devices and prevent remote wiping, incoming calls, or network connections during transport and examination.

NTFS timestomping

Manipulation of file timestamps, often by changing $STANDARD_INFORMATION while $FILE_NAME retains older values; discrepancies between the two can reveal anti-forensic activity.

File slack space

The unused remainder of the last allocated cluster after a file's logical end; it can contain residual data from prior files and is a target for forensic examination.

MBR versus GPT

MBR uses a 512-byte partition table with four primary entries and a 2 TB limit; GPT supports 128 entries, larger disks, and backup headers.

Deleted FAT file recovery

In FAT file systems, deleting a file typically replaces the first character of its directory entry with 0xE5 while cluster chains may remain until overwritten.

Windows Prefetch

Files under C:\Windows\Prefetch record application execution counts and referenced files, helping analysts establish program execution, though the feature can be disabled.

Windows Security event 4624

A Windows Security log event indicating a successful logon; fields include logon type, account, source network address, and authentication package.

USBSTOR registry key

A Windows registry key under SYSTEM that records USB mass storage devices by vendor, product, and serial number, supporting device connection history.

Linux wtmp and btmp

Binary log files recording successful logins (wtmp) and failed login attempts (btmp); they are read with last and lastb and support authentication timeline analysis.

NetFlow versus PCAP

NetFlow records metadata about connections, such as addresses, ports, and byte counts, while PCAP stores full packet contents; each answers different investigative questions.

DNS tunneling indicators

Suspicious patterns include long, high-entropy subdomains, frequent TXT or NULL queries, and unusual query volume to a single domain, suggesting data exfiltration over DNS.

NTP in log analysis

Network Time Protocol synchronizes system clocks; analysts must confirm time sources and normalize time zones because unsynchronized clocks can misorder events.

iOS backup types

iTunes or Finder backups are logical copies of selected data, while full file-system extractions require specialized tools and, on newer devices, additional access or credentials.

Cloud shared responsibility

A model where the provider secures the infrastructure and the customer secures data, identities, and configurations; forensic scope depends on which layer holds the evidence.

M365 Unified Audit Log

A Microsoft 365 log that records user and admin activities across services, searchable in the compliance portal and useful for cloud account and file access investigations.

Expert witness qualification

A court determines whether a witness has sufficient knowledge, skill, experience, training, or education to offer opinion testimony relevant to the case.

Forensic report structure

A typical report includes an executive summary, scope and authority, methodology, findings, conclusions, limitations, and appendices with exhibits and hash values.

Contemporaneous notes

Notes made at or near the time of an action; they support accuracy, refresh memory, and may be discoverable, so they must be complete and factual.