Mile2 CDFE key terms

A chronological written record tracking who collected, handled, transferred, and stored evidence, when and why, so its integrity can be proven in court.

The rule that the most perishable data, such as CPU registers, memory, and network connections, must be captured before slower, persistent storage.

Creating a bit-for-bit duplicate of a storage device or partition, including slack and unallocated space, so analysis can proceed without touching the original.

A hardware or software device that permits read access to evidence media while preventing any write operation, protecting the source from alteration.

A fixed-length cryptographic digest, such as SHA-256, computed over data to verify that an image or file is identical to the original.

The property that evidence has not been altered, corrupted, or substituted from collection through presentation, demonstrated through hashes, logs, and documented handling.

An organization's advance capability to collect and preserve admissible evidence, built through logging, monitoring, trained staff, and documented procedures before an incident occurs.

Capturing volatile data such as RAM, running processes, or network state from a system that is still powered on, typically using a trusted toolkit on removable media.

A duplicate of a logical volume or selected files rather than the entire physical device, acceptable when full physical imaging is impractical or unnecessary.

Collecting only the data relevant to an investigation, such as a user profile or specific folders, instead of imaging the whole disk.

The idea that every contact leaves a trace, so an offender both brings something to and takes something from a scene, including in digital environments.

The quality of an investigative process that is documented, repeatable, defensible, and free from actions that could alter or destroy evidence.

Disk clusters not currently assigned to any file, which may still contain remnants of deleted files and other recoverable data.

The unused remainder of the last allocated cluster of a file, which can retain data from previously stored content.

Recovering files by scanning raw data for known headers, footers, and structural patterns rather than relying on file system metadata.

Reconstructing a file whose directory entry was removed but whose data clusters remain intact and not yet overwritten.

The NTFS metadata structure holding one record per file and directory, including attributes, timestamps, and cluster run locations.

The modified, accessed, and changed timestamps recorded for a file, used to build timelines, with creation time often added as a fourth value.

Ordering events by timestamp from multiple sources to reconstruct the sequence of activity on a system or network.

A structure such as MBR or GPT that records where partitions begin and end on a disk, guiding where file systems must be examined.

The method an operating system uses to organize, name, store, and retrieve files on a volume, for example NTFS, FAT, ext4, or APFS.

Analysis of a captured RAM image to recover running processes, network connections, encryption keys, and injected code not present on disk.

Concealing data inside another file, such as an image or audio file, so that the existence of the hidden content is not apparent.

Recording network traffic at a interface, producing a file of frames that can be filtered and reassembled to reconstruct sessions.

Summary metadata about network conversations, including source and destination addresses, ports, protocol, byte counts, and timestamps, without payload content.

Combining and comparing records from multiple devices and applications to identify related events and reconstruct an attack path.

A standard protocol and message format for sending event records from network devices and servers to a central logging host.

The policy defining how long log data is kept and protected, balancing investigative need against storage cost and privacy obligations.

Observable artifacts such as malicious file hashes, domains, IP addresses, or registry keys that suggest a system has been breached.

A documented set of roles, phases, and communication steps guiding an organization from detection through containment, eradication, and recovery.

A person permitted to offer opinion testimony based on specialized knowledge, subject to qualification by the court and challenges to reliability.

A witness who testifies only to facts personally observed, without offering specialized opinions about the meaning of technical evidence.

A U.S. legal test for admitting expert testimony that considers testability, error rate, peer review, and general acceptance of the method.

A written account of the investigation covering scope, methods, findings, limitations, and conclusions, written for a non-technical decision maker while remaining technically accurate.

The requirement that the original writing, recording, or image be produced to prove its content, with limited exceptions such as reliable duplicates.

The loss, alteration, or destruction of evidence, whether negligent or intentional, which can lead to sanctions or adverse inferences.

A directive requiring an organization to preserve potentially relevant data once litigation or investigation is reasonably anticipated.