CF-L3 / CCFT key terms

The principle that contact between two objects transfers material between them; digitally, an offender's actions leave traces in logs, memory, and storage that an examiner can find and link to the activity.

A ranking of evidence sources from most to least perishable, such as processor registers and memory ahead of disk and offsite backups, used to decide what to capture first so nothing volatile is lost.

A documented, unbroken record of who handled an item, when, where, and for what purpose, used to show that evidence presented in court is the same one collected and was not altered.

The assurance that collected data has not changed since acquisition, demonstrated by matching pre- and post-collection hashes and by documenting handling so any challenge to authenticity can be answered.

A fixed-length numeric fingerprint computed from data; identical content produces the same value and any change produces a different one, so it verifies copies and identifies known files.

A bit-for-bit duplicate of a device or volume, including unallocated and slack areas, made through a write blocker so that all analysis is performed on the copy rather than the original.

A hardware or software tool that allows read access to a drive while preventing write commands from reaching it, protecting the original evidence from accidental modification during acquisition.

Collecting data from a system that is still running, such as a memory dump or remote disk copy, used when shutdown would destroy volatile evidence or disrupt a critical server.

A formal notice requiring an organization to preserve records that may be relevant once litigation or an investigation is reasonably anticipated; ignoring it can lead to sanctions for spoliation.

The intentional or negligent destruction, alteration, or concealment of evidence relevant to a case, which a court may punish with adverse inferences, fines, or dismissal of claims.

A doctrine under which evidence obtained through an unlawful search or seizure may be kept out of trial, making valid authorization and a clearly defined collection scope essential.

A legal test asking whether an expert's method can be tested, has been peer reviewed, has a known error rate, and is generally accepted, used to judge admissibility of opinion evidence.

Deliberate steps such as wiping, timestomping, encryption, or clearing logs taken to frustrate an investigation; examiners must recognize these and report the attempt itself as a finding.

Placing file system, application, and log timestamps on one chronological axis to reconstruct the order of events and connect activity across several evidence sources.

Any information stored or transmitted in binary form that may be relied on in a legal proceeding, including disks, memory, logs, network traffic, phone data, and cloud records.

Bytes at the beginning of a file that identify its actual format regardless of the extension, used to spot mislabeled, disguised, or renamed files during examination.

A rapid, prioritized screening of systems or data to decide which sources justify full collection, commonly used when the scope is large or time is short.

Clusters on a volume that are not assigned to any live file; they can still hold remnants of deleted or overwritten content and are a primary target for recovery.

The unused remainder of the last cluster assigned to a file, which can retain content from files stored there earlier and reveal fragments an offender believed were gone.

The NTFS index holding one record per file and folder on a volume, with names, sizes, timestamps, and pointers to where the data clusters are stored.

Recovering files by scanning raw data for known headers and footers instead of trusting file system structures, which works when metadata is damaged or an entry was deleted.

Descriptive data about a file or object, such as timestamps, size, owner, and location, that gives context on how, when, and by whom the content was created or changed.

A Windows feature that periodically snapshots volume contents for restore, giving examiners access to earlier versions of files, including material deleted after the snapshot was taken.

A hierarchical database of system and user settings, holding installed software, autorun entries, device history, and recent activity that supports attribution and timeline building.

Records stored in the registry and as files that list programs which ran or were installed, often persisting after removal, used to show execution on a Windows host.

Windows files that record the path, run count, and last execution times of recently launched programs, used to demonstrate that an application ran and roughly when.

A Windows shortcut that stores its target path, volume serial number, and timestamps, showing files a user opened, including items accessed from removable media.

A structured record of system, security, and application events with timestamps and numeric identifiers, used to detect logons, service changes, policy edits, and clearing of logs.

Examining a captured RAM image to recover running processes, network connections, loaded drivers, encryption keys, and injected code that never touches the disk.

Summary records of network conversations, reporting source and destination addresses, ports, byte counts, and times without payload, useful for mapping traffic across large networks.

A file holding captured packets with headers and payload, allowing protocol reconstruction, extraction of transferred files, and confirmation of exactly what crossed the wire.

A logging protocol and message format used by Unix-like hosts and network devices to send event records to a local file or to a central collector.

A platform that centralizes logs from many sources, correlates them against rules, and raises alerts, giving investigators a searchable cross-enterprise timeline during incident response.

A classification of how much data is pulled from a handset, from manual review and logical backups up to file system and full physical images, each giving different completeness.

Investigating data held by a third-party provider, complicated by shared responsibility, jurisdiction, no direct access to hardware, and evidence reachable mainly through APIs and provider logs.

Opinion evidence given by a witness qualified through knowledge or experience, subject to reliability standards and to cross-examination on methods, data, and conclusions.

A written account of scope, methods, findings, limitations, and conclusions, structured so a non-technical reader can follow it and another examiner could repeat the work.