Mile2 CDFE flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Order of volatility

RFC 3227 ranking for collection priority: registers and cache first, then RAM, swap, network state, processes, disk, and archival media last.

Chain of custody

Chronological documented record of evidence seizure, transfer, storage, and access, showing who handled it, when, and for what purpose.

Write blocker

Hardware or software device that permits read access to evidence media while blocking all write commands, preserving original content integrity.

Locard's exchange principle

Every contact between a perpetrator and a scene results in transfer of material in both directions, forming the basis of trace evidence analysis.

Forensic soundness

Property of a process or tool producing repeatable and reproducible results: same input and method yield identical output across examiners and runs.

Live acquisition

Capture of volatile and disk data from a running system; preserves RAM and network state but alters the host and must be documented.

Forensic readiness

An organization's pre-incident capability to collect, preserve, and present evidence, determined by logging depth, retention policy, and response tooling.

Faraday bag

Radio-shielding container that blocks cellular, Wi-Fi, and Bluetooth signals, preventing remote wipe or alteration of seized mobile devices.

Legal hold

Directive suspending routine deletion and media rotation so relevant data, logs, and backups remain intact pending litigation or investigation.

Evidence spoliation

Destruction, alteration, or concealment of evidence; may lead to adverse inference, sanctions, or dismissal of a case.

Acquisition log

Record of device identifiers, write-blocker model and serial, connection type, tool version, timestamps, and errors captured during imaging.

Evidence labeling

Minimum fields on each item: case ID, item number, description, source, collector, date and time, and computed hash value.

MBR partition table

Legacy layout in sector zero: four 16-byte primary entries starting at offset 0x1BE, 512-byte sectors, boot signature 0x55AA.

$MFT

NTFS Master File Table storing one record per file and directory, including attributes, timestamps, data runs, and in-use flags.

$STANDARD_INFORMATION vs $FILENAME

Two NTFS timestamp sets; $SI is user-modifiable while $FILENAME is updated by the file system, so discrepancies suggest timestomping.

$Bitmap

NTFS metadata file tracking cluster allocation; cleared bits mark unallocated clusters where deleted file content may persist.

File carving

Recovery technique using file headers, footers, and structure to reconstruct files from unallocated space without file system metadata.

Slack space

Unused remainder of the last allocated cluster for a file; may retain fragments of previously stored data after file truncation or deletion.

ext4 superblock

Primary file system structure at byte offset 1024 holding block size, inode count, mount state, and journal information.

FAT deleted entry marker

Directory entry whose first filename byte is 0xE5 indicates deletion; cluster chain in the FAT is freed but content remains until overwritten.

TCP three-way handshake

SYN, SYN/ACK, ACK sequence establishing a connection; missing handshake in a capture suggests spoofed traffic or midstream collection.

NetFlow vs PCAP

NetFlow records flow metadata such as 5-tuple, byte counts, and timestamps; PCAP captures full packet payload for content analysis.

Windows Event ID 4625

Security log entry for a failed logon attempt; repeated occurrences indicate password guessing or credential stuffing activity.

Windows Event ID 1102

Security log entry recording that the audit log was cleared, a strong anti-forensic indicator requiring immediate investigation.

DNS tunneling indicators

High volumes of TXT or NULL queries, long random subdomain labels, and unusual query rates to one authoritative server.

Syslog severity levels

Numeric scale 0 emergency, 1 alert, 2 critical, 3 error, 4 warning, 5 notice, 6 informational, 7 debug; lower numbers are more severe.

Log integrity controls

Centralized collection, NTP clock synchronization, and append-only or WORM storage that resist tampering and preserve event ordering.

Daubert factors

US admissibility test for expert testimony: testability, peer review, known error rate, standards, and general scientific acceptance.

Federal Rule 702

Permits expert testimony when specialized knowledge helps the trier of fact and rests on sufficient facts and reliable methods.

Best evidence rule

Requires the original writing, recording, or photograph to prove its content, unless a reliable duplicate is shown to be authentic.

Business records exception

FRE 803(6) admits records kept in the regular course of business, made contemporaneously by someone with knowledge.

Forensic report structure

Scope and authority, methodology, evidence inventory, findings, conclusions, limitations, and appendices with hashes and tool versions.