CCFH key terms

The forensic idea that every contact between two objects leaves a trace of one on the other. In digital cases, it means an examiner's tools and actions can alter a system and must be documented.

A US legal test for admitting expert testimony that weighs whether the method is testable, peer reviewed, has a known error rate, and is generally accepted. Judges act as gatekeepers.

An older US admissibility rule asking whether a scientific technique is generally accepted in its relevant field. Some jurisdictions still apply it instead of or alongside Daubert.

A person a court allows to give opinion testimony based on specialized knowledge, training, or experience beyond that of an ordinary witness. Their duty is to assist the court impartially.

The chronological record of who handled evidence, when, where, and for what purpose. Gaps or unexplained transfers weaken authentication and can make evidence inadmissible.

Packaging that protects digital media from tampering, static, and moisture, closed with a uniquely numbered tamper-evident seal. Seal numbers are recorded at every transfer.

A prioritization for collection that starts with the most perishable data, such as RAM, network connections, and running processes, before persistent storage and archival backups.

A hardware or software control that prevents write commands from reaching a storage device during acquisition, protecting the source from alteration while allowing reads.

A bit-for-bit copy of a storage device or volume, including slack space and deleted data, stored in a container format such as raw, E01, or AFF4 for later analysis.

A fixed-length digest computed from data, such as SHA-256, used to prove an image matches its source and has not changed. Matching hashes support integrity and authenticity.

Collecting volatile and stored data from a running system, often with a response tool, when shutdown would lose evidence or disrupt a business. It alters state and must be justified.

Imaging only allocated or relevant portions of a drive rather than every sector, which is faster and smaller but omits unallocated areas where deleted evidence may remain.

Recovering files by scanning raw data for known headers, footers, and structures instead of relying on file system metadata. It works on unallocated space and damaged volumes.

A characteristic byte pattern at the start of a file that identifies its type, often called a magic number. It supports carving and detection of extension mismatches.

Clusters or blocks the file system does not currently assign to any file. It can hold remnants of deleted content and is a primary target for recovery.

The unused remainder of the last allocated cluster or block of a file, which may retain data from previously stored files. It is captured in a full forensic image.

The core NTFS metadata structure holding a record for every file and folder, including timestamps, size, and data run locations. Records for deleted files can be reused or recovered.

The four standard NTFS times ($STANDARD_INFORMATION) plus $FILE_NAME times stored separately in each record. Discrepancies between them can indicate timestamp manipulation.

A file system that logs metadata changes to a journal before committing them, enabling crash recovery. The journal can also reconstruct file activity for investigators.

A file such as SYSTEM, SOFTWARE, SAM, or NTUSER.DAT that stores configuration and user activity. Hives record installed software, USB devices, and autorun entries.

A Windows file recording programs that ran, with reference timestamps and loaded modules, used to show execution. Its presence and timestamps support or refute claims of use.

Structured logs such as Security, System, and Application that record logons, service changes, and errors. Event IDs give specific evidence of account and system activity.

Deliberately altering file timestamps to make content appear older or newer than it is. Analysts detect it through inconsistencies between metadata sources and file system records.

Analysis of a RAM capture to find running processes, network connections, injected code, encryption keys, and credentials that vanish when a machine powers off.

Combining records from multiple sources, such as firewalls, servers, and endpoints, on a shared timeline to reconstruct an event and reduce reliance on any single log.

Summarized network connection records showing source, destination, ports, bytes, and timing without payload content. They reveal traffic patterns and data movement.

A recording of raw network traffic, usually in pcap format, that preserves payloads and protocol details. It supports protocol analysis and content reconstruction.

A standard protocol and message format for sending log events from network devices and servers to a central collector, where timestamps and severity support correlation.

Extracting data from a phone or tablet at a defined level, from manual review through logical, file system, and full physical extraction, limited by lockscreen and encryption state.

Hardware methods for extracting memory from a mobile device by accessing test points or removing the memory chip. They are invasive, risky, and used when software extraction fails.

Difficulties collecting cloud evidence caused by distributed storage, limited subscriber access, short log retention, and provider-controlled infrastructure, often requiring legal process to the provider.

The staged process of preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Forensic preservation must be planned into each stage.

An isolated environment that executes suspicious code while recording file, registry, process, and network behavior. Results are indicators, not proof of all capabilities.

An observable artifact such as a file hash, domain, IP address, or registry key that suggests malicious activity. Indicators support detection and scoping but can be fragile.

A written account of the examination covering scope, methods, findings, limitations, and conclusions, written so a nontechnical reader can follow the reasoning and verify the work.

Independent scrutiny of an examiner's methods and conclusions by another qualified person before release. It catches errors and strengthens the reliability of testimony.