CFCE key terms

An organization's planned ability to collect and preserve reliable digital evidence before an incident occurs, through logging, retention policies, trained staff, and documented procedures.

A prioritization rule that says the most perishable evidence, such as CPU registers and network connections, must be captured before durable evidence like disk contents or archived backups.

Information held only in memory or temporary system structures, such as running processes, open sockets, and cached credentials, which disappears when the device loses power.

Capturing evidence from a system while it is still running, typically memory and disk images, trading some alteration of state for access to perishable data.

A hardware or software device that allows read access to storage while preventing any write operation, protecting the original evidence from modification during imaging or examination.

A bit-for-bit duplicate of a storage device or logical volume, stored in a container format, that preserves unallocated space and file system metadata for later analysis.

A fixed-length cryptographic digest computed over data, used to prove that an image or file is identical to the source and has not changed since acquisition.

The property that evidence has not been altered, degraded, or substituted, demonstrated through hashes, controlled storage, and complete documentation of every access.

A chronological record showing who handled each item of evidence, when, where, and for what purpose, from seizure through final disposition, so its authenticity can be defended.

A unique label attached to a physical item or its container, recording an identifier, collector, date, and case number so the item can be matched to its documentation.

Records written at the time of an action, describing what was done, by whom, with which tools and versions, forming the factual basis for later reports and testimony.

A legal principle generally requiring the original of a document or recording to prove its content, with digital copies often admitted when authenticity and accuracy are adequately shown.

The legal process of proving that a piece of evidence is what its proponent claims it to be, often through testimony about collection, hashing, and custody.

An out-of-court statement offered to prove the truth of the matter asserted, generally inadmissible unless an exception applies; machine-generated records are often treated differently.

The boundaries of permission a person gives for a search or device access; examiners must not exceed what was authorized, since evidence outside the scope may be challenged.

A court order authorizing a search and seizure, typically specifying the place, items, and time limits, which governs how far an examiner may analyze seized devices.

The first sector of a traditionally partitioned disk, holding boot code and a partition table that describes where each partition starts and ends.

A modern partitioning scheme that stores partition entries with globally unique identifiers, supports very large disks, and keeps a backup copy for redundancy.

A contiguous logical region of a storage device formatted with a file system, described by partition table entries in the master boot record or GUID partition table.

A file system structure, used in FAT variants, that links clusters into chains so the operating system can locate the contents of each file.

The central NTFS metadata file whose records describe every file and directory, including names, timestamps, data locations, and attributes.

An additional named data channel attached to an NTFS file, invisible to many tools, sometimes used to hide content or mark files as downloaded from the internet.

Unused bytes at the end of the last allocated cluster of a file, which may still contain remnants of previously stored data.

Storage clusters not currently assigned to any file, which frequently retain deleted content and are a primary target for recovery and carving.

Recovering files from raw data using recognizable headers, footers, and structural patterns rather than file system metadata, useful when metadata is missing or damaged.

A distinctive byte pattern at the start of a file type, such as a header magic number, used by tools to identify formats during carving or content triage.

Restoring access to files whose directory entries or metadata remain but whose data clusters were released, often by reconnecting metadata or extracting intact content.

The four standard file time values: modification, access, creation or change, and entry modification, whose interpretation differs by file system and must be correlated carefully.

A file containing a portion of the Windows configuration database, such as SYSTEM or SOFTWARE, parsed to reveal installed software, services, and system settings.

A Windows file recording execution details for an application, including run count and referenced file paths, useful for showing that a program ran on the system.

A Windows log file recording system, security, or application events with timestamps and identifiers, used to reconstruct logons, service changes, and device connections.

The structured metadata at the top of a message, listing sender, recipients, relays, and timestamps, used to trace the path and origin of an email.

A supposedly unique identifier assigned to an email message by the originating system, useful for correlating copies of the same message across mailboxes and logs.

Examining email or network protocol headers to determine routing, originating address, client software, and inconsistencies that suggest forgery or spoofing.

Summarized network connection records capturing source, destination, ports, timing, and byte counts, used to show communication patterns without full packet content.

A recorded stream of network packets, often stored in pcap format, allowing reconstruction of sessions, protocols, and transferred content.

Extracting data from a mobile device through its supported interface, such as a backup or sync protocol, yielding selected user data rather than a full physical image.

Obtaining a full bit-level copy of a mobile device's storage, including deleted and system areas, typically requiring specialized tools or privileged access.

Independent examination of another examiner's work, methods, and conclusions before release, intended to catch errors and strengthen the reliability of findings.

A written account of the examination describing scope, methods, tools, findings, and limitations in language suitable for a non-technical legal audience.

Demonstrating that a tool or process produces accurate, repeatable results for its intended purpose, often through known-answer tests and documented limits.

Structured evaluation of forensic software or hardware against known inputs to establish its behavior, error rates, and suitability before casework use.