CCFH flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Daubert standard

Federal admissibility test under FRE 702 weighing testability, peer review, error rate, standards and controls, and general acceptance; the judge acts as gatekeeper for expert testimony.

Frye general acceptance

Admissibility rule requiring the scientific technique to be generally accepted in its relevant field; still used in some state courts and narrower than the Daubert factors.

Locard's exchange principle

Every contact between two objects leaves a trace of one on the other; it justifies searching for transfer evidence but does not guarantee a recoverable trace exists.

FRE 901 authentication

Requires the proponent to produce evidence sufficient for a finding that an item is what it is claimed to be; chain-of-custody records are the usual means for digital items.

Order of volatility

RFC 3227 collection priority: registers and cache, RAM and swap, network state, processes, disk, remote logs, archival media, then printed output.

Write blocker function

Hardware or software control that prevents a host from writing to evidence media; hardware blocks at the bus, software filters at the OS driver level.

Faraday isolation tradeoff

Shielding blocks remote wipe and network sync but also blocks wireless acquisition and can drain the battery; the choice and its effects must be documented.

Chain of custody record

Chronological documentation of who handled an item, what was done, when, where, and why; gaps create authentication challenges under evidence rules.

Bit-stream versus logical image

A bit-stream image copies every addressable sector including slack and unallocated space; a logical image copies only files and file system metadata.

Hash verification purpose

Comparing source and image hashes confirms integrity at acquisition time; it does not prove the source was unaltered before acquisition.

EWF (E01) format

Compressed, chunked forensic image format carrying case metadata and per-chunk CRC values; widely used with FTK Imager and EnCase-style workflows.

Sparse forensic image

An image that stores only non-zero or non-duplicate sectors; smaller than a full bit-stream copy and must be documented as not complete.

NTFS $FILE_NAME timestamps

Timestamps in the 0x30 attribute that ordinary user-mode writes do not update; divergence from the 0x10 $STANDARD_INFORMATION times can indicate timestomping.

NTFS $UsnJrnl:$J

Change journal stream recording metadata changes; can recover file creation and deletion history when MFT entries have been overwritten.

File carving

Recovery of file content by header/footer signatures without file system metadata; cannot reliably recover names, timestamps, or fragmented files.

ext4 inode ctime

Inode-change time that records metadata modification and cannot be set by ordinary user tools; useful for detecting timestamp manipulation.

Shimcache (AppCompatCache)

Registry artifact recording executed-file paths and, on Windows 10+, last-modified time; helps establish program presence and execution.

Windows Prefetch files

.pf files recording run count, last run times, and referenced files and volumes; present only when prefetching is enabled and capped by default.

Windows Security event 4624

Successful logon event whose logon type distinguishes interactive (2), network (3), and Remote Desktop (10) sessions; used for access timelines.

Linux auth.log

Log recording authentication events such as sudo use, SSH logins, and failed password attempts; a primary source for account access timelines.

PCAP stream reconstruction

Reassembling TCP sessions from captured packets to recover application data such as HTTP requests, file transfers, and chat content.

NetFlow versus PCAP

NetFlow records flow metadata (5-tuple, bytes, timestamps) without payload; PCAP contains full packet content. Use flow for scope, PCAP for content.

NAT and DHCP log pairing

DHCP maps IP to MAC and hostname for a lease window; NAT maps internal IP:port to external IP:port. Both are needed to attribute an external address.

Syslog severity encoding

PRI value equals facility times eight plus severity, where severity 0 is emergency and 7 is debug; used to filter and prioritize log events.

Mobile logical extraction

Acquisition through backup or device API that yields user data such as messages, contacts, and call logs, but not deleted or system-level artifacts.

Mobile physical extraction

Full memory image of the device storage obtained via chip-off or advanced extraction; yields deleted and system artifacts but is device-specific and riskier.

Cloud preservation limits

Cloud evidence is held by a third party; preservation depends on legal process and provider retention windows rather than examiner control of the media.

Container layer persistence

Container images are layered; deleted files may remain in lower read-only layers, and the writable layer holds runtime changes made during execution.

IR lifecycle phases

Preparation, identification, containment, eradication, recovery, and lessons learned; containment must preserve evidence before remediation begins.

Section entropy analysis

Entropy near 7.0-8.0 bits per byte in a PE section suggests packing or encryption; low entropy suggests plain code or data.

MITRE ATT&CK mapping

Framework of tactics and techniques used to structure observed adversary behavior; supports reporting but does not replace underlying evidence.

Report traceability

Each factual assertion links to an exhibit, artifact path, or hash, with tool version and steps needed to reproduce the result.