CNFE key terms

A chronological record documenting who handled a piece of evidence, when, and for what purpose, from seizure through presentation, used to prove the evidence was not altered or substituted.

The principle that the most perishable evidence, such as RAM and network connections, must be collected before durable evidence like disk contents, because it disappears quickly when systems shut down or connections close.

Information held in memory or transient system state, including running processes, ARP caches, routing tables, and open sockets, that is lost on reboot and must be captured while the system runs.

The assurance that collected data is an exact, unaltered copy of the original, demonstrated through cryptographic hashes, write blockers, and documented handling so findings remain defensible in legal proceedings.

A fixed-length cryptographic digest, such as SHA-256, computed over data so that any later modification changes the result, letting investigators verify that a copy matches the source bit for bit.

A hardware or software device placed between a storage medium and the analysis host that permits read operations while preventing any write, protecting the original evidence from accidental modification.

A bit-for-bit duplicate of a storage device or partition, including deleted and slack space, created for analysis so the original media can remain sealed and preserved.

Collection of evidence from a running system, capturing memory, network state, and logs before shutdown, typically because encryption or volatile data would otherwise be lost.

The process of recording network traffic passing a monitoring point into a file for later analysis, usually with timestamps and full or truncated frame contents depending on configuration.

A standard binary container format storing captured frames with per-packet timestamps, lengths, and link-layer headers, widely readable by tools such as tcpdump and Wireshark.

A network interface setting that accepts all frames reaching the interface, not only those addressed to its own MAC address, enabling monitoring of traffic on a shared segment.

A switch feature that mirrors traffic from selected ports or VLANs to a designated monitoring port, providing capture visibility without inserting an inline device into the traffic path.

A passive hardware device inserted inline on a link that copies all passing traffic to monitoring ports, preserving full-duplex visibility that a mirrored switch port may drop under load.

A rule applied during collection that decides which packets are written to the capture file, reducing storage needs but permanently discarding unmatched traffic.

A query applied to an already recorded capture to hide non-matching packets from view, leaving the underlying file unchanged and allowing repeated analysis of the same data.

The process by which an analyzer decodes raw bytes according to protocol specifications, exposing field values at each layer so analysts can interpret headers and payloads meaningfully.

The TCP connection setup sequence of SYN, SYN-ACK, and ACK that synchronizes sequence numbers, whose presence, absence, or anomalies helps identify scans and spoofed traffic.

Control bits in the TCP header, including SYN, ACK, FIN, RST, PSH, and URG, whose combinations reveal connection state and are manipulated by port scanners and evasion tools.

A TCP header field identifying the byte position of transmitted data, used to order segments and reassemble streams, and examined for anomalies indicating spoofing or injection.

Reconstructing the ordered application data of a TCP conversation from individual segments, letting analysts read full requests and responses rather than isolated packets.

Encoding data inside DNS queries and responses, often in long or high-entropy subdomain labels, to move information past controls or maintain command-and-control over port 53.

Regular, periodic outbound connections from an infected host to attacker infrastructure, whose consistent intervals and sizes are a strong network sign of implanted malware.

The channel through which compromised hosts receive instructions and return results, which may use HTTP, DNS, or custom protocols and is a focus of traffic analysis.

An observable artifact such as an IP address, domain, file hash, or URL pattern suggesting intrusion, used to detect and scope incidents though often short-lived.

A behavioral or contextual sign that an adversary is actively operating, such as unusual credential use or lateral movement patterns, focused on intent rather than static artifacts.

A monitoring system that inspects network or host activity against signatures or behavioral models and raises alerts when patterns matching known attacks or anomalies appear.

Detection that compares activity against stored patterns of known malicious traffic, giving precise alerts for familiar threats but missing novel or heavily modified attacks.

Detection that models normal behavior and alerts on significant deviations, potentially catching unknown attacks but generating noise when legitimate activity changes.

An alert raised for activity that is actually benign, consuming analyst time and eroding trust in detection systems when rates are high.

Malicious activity that occurs without generating an alert, leaving the organization unaware and making detection coverage gaps the most dangerous failure mode.

Combining records from firewalls, servers, authentication systems, and other sources by time and identifiers to reconstruct a sequence of events that no single log reveals.

A standard protocol and message format for sending event records from devices to a central collector, carrying facility, severity, timestamp, and host information.

A summary record format describing network conversations by source, destination, ports, byte counts, and timestamps, useful for traffic profiling without full packet contents.

Recording complete frame contents including payloads, enabling deep inspection and content reconstruction but demanding substantial storage and bandwidth planning.

Arranging events from multiple evidence sources in chronological order to establish sequence, duration, and causal relationships during an investigation.

The structured phases of preparation, detection and analysis, containment, eradication, recovery, and lessons learned that organize handling of a security incident.

Actions taken to limit the spread and impact of an incident, such as isolating hosts or blocking addresses, while preserving evidence needed for later analysis.

Removing the cause of an incident, including malware, attacker accounts, and persistence mechanisms, after containment so systems can be safely restored.

An attacker's progression from an initially compromised host to other systems using stolen credentials or remote services, visible in authentication and connection logs.

Oral evidence given by a qualified witness about technical findings, admissible where the method is reliable and the witness's specialized knowledge assists the court.

A written account of the investigation stating scope, methods, findings, and conclusions, written so that both technical and non-technical readers can follow the reasoning.

A legal principle generally requiring the original document or a verified duplicate to prove its contents, which is why hashed forensic copies are made and documented.

The requirement that investigations follow lawful, fair procedures, including proper authorization for searches and preservation of evidence, so results withstand legal challenge.

An isolated environment where suspicious files are executed while system calls and network traffic are recorded, revealing behavior without endangering production systems.