CFCE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Order of volatility

A collection priority that ranks evidence by how quickly it disappears: CPU registers and cache first, then RAM, network state, running processes, disk, and finally archival media and backups.

Forensic readiness

An organization's pre-incident ability to collect, preserve, and use digital evidence, covering trained staff, documented procedures, validated tools, adequate logging, and legal authority.

Proportionality principle

A privacy principle limiting collection to data reasonably related to the investigation's purpose; broader collection requires stronger justification and must be documented.

Best evidence doctrine

The legal preference for original documents; digital copies are admissible when authenticated and shown to accurately reproduce the original content.

Write blocker

A hardware or software device that permits read operations to storage media while blocking all writes, preserving source integrity; its function should be verified before each acquisition.

Faraday isolation

Placing a wireless device in a shielded bag to block network signals, preventing remote wipe or sync; the radio-state change must be documented in the case notes.

Chain of custody

A chronological record of who handled evidence, when, where, and for what purpose, with signatures at each transfer; gaps weaken authentication of the evidence.

Contemporaneous notes

Records written at the time an action occurs, capturing observations and decisions; they carry more weight than later reconstructions and support testimony credibility.

TRIM effect on evidence

The ATA command letting an OS tell an SSD which blocks are free; the drive may erase them during garbage collection, permanently destroying deleted-file content.

Self-encrypting drive

Storage hardware that encrypts data internally using a drive-resident key; imaging yields ciphertext unless the drive is unlocked or the key is recovered.

NTFS $MFT

The Master File Table, a database holding one record per file and directory with attributes, timestamps, and cluster runlists; the primary source for NTFS metadata analysis.

Timestomping indicators

Suspicious timestamp manipulation shown by $STANDARD_INFORMATION and $FILE_NAME timestamp mismatches, sub-second zeroing, or times earlier than the file system creation date.

File slack space

The unused remainder of the last allocated cluster after a file's logical end; it can retain residual content from previously deleted files.

Expert Witness Format

The E01 image format storing compressed data with per-block hashes and case metadata, allowing block-level corruption detection and integrity verification.

Sparse imaging

An acquisition mode that skips blocks matching a known pattern, usually zeros, to reduce image size; the sparse map must be retained to reconstruct the exact image.

Logical vs physical acquisition

Logical captures files and folders through the operating system; physical captures every addressable sector, including unallocated and slack space needed for deleted-data recovery.

Prefetch files

Windows .pf files recording program execution count, last-run times, and loaded files; useful to show that an application ran on a system.

Amcache hive

A Windows registry hive recording program installation and execution metadata, including file paths, SHA-1 hashes, and first-seen times for executables.

USN journal

The NTFS $UsnJrnl:$J change journal recording file create, delete, rename, and modification events with update sequence numbers, supporting activity timelines.

File carving

Recovering file content from unallocated space using header and footer signatures without file-system metadata; recovered files lack original names and timestamps.

Metadata-based recovery

Restoring deleted files from residual file-system records such as MFT entries, inodes, or FAT directory entries; preferred over carving because names and times survive.

Email header Received chain

The sequence of mail-server hops recorded in Received headers, read bottom-up; inconsistencies or missing hops suggest forgery or relay manipulation.

DHCP lease logs

Records mapping IP addresses to MAC addresses over time; essential for attributing network activity to a specific device during a time window.

Mobile physical extraction

A full image of a mobile device's flash storage, including deleted and unallocated data; requires exploits, root, or supported bootloader access and is the deepest acquisition level.

SIM card evidence

Data stored on the subscriber identity module, including ICCID, IMSI, SMS records, and last-dialed numbers; SMS may persist after deletion from the handset.

EXIF metadata

Metadata embedded in image and video files recording camera model, settings, timestamps, and sometimes GPS coordinates; it can be edited and must be corroborated.

Daubert factors

Criteria for admitting expert testimony: testability, known error rate, peer review and publication, general acceptance, and existence of controlling standards.

Peer review of report

Independent technical review of methods and findings by a qualified examiner before issuance; the reviewer, date, and issues raised are documented.

Volatility framework

An open-source memory forensics tool that parses RAM images to list processes, network connections, and injected code; requires the correct OS profile.

dc3dd and dcfldd

Enhanced dd variants for forensic imaging that add on-the-fly hashing, progress reporting, and error logging while preserving the raw image output.

NIST CFTT

The Computer Forensics Tool Testing program, publishing independent test reports for imaging tools, write blockers, and mobile acquisition tools against defined specifications.

Known-answer testing

Validating a tool by processing test data with known content and expected output, then comparing results; pass or fail is recorded with the tool version.