CDFE flashcards
CDFE · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Order of volatility
- RFC 3227 guidance to collect the most volatile evidence first: CPU registers and cache, then memory and network state, then disk, then remote logs, then archival media.
- Chain of custody
- A documented record of every transfer and storage event for evidence, including signatures, dates, purpose, and storage conditions, used to demonstrate integrity and admissibility.
- Forensic image hash
- A cryptographic digest (typically SHA-256) computed at acquisition and re-verified before analysis and after transfer to demonstrate that the image matches the source.
- Write blocker
- A hardware or software device that prevents write commands from reaching storage media during acquisition, preserving the original evidence from alteration.
- NTFS MACB timestamps
- Modified, Accessed, Changed (MFT entry change), and Born/Created times stored in $STANDARD_INFORMATION and $FILENAME attributes of the Master File Table.
- Timestomping
- An anti-forensic technique that alters file timestamps, often detectable when $STANDARD_INFORMATION times precede $FILENAME times or when timestamps are inconsistent with other artifacts.
- Unallocated space
- Disk clusters marked free by the file system that may still contain remnants of deleted files, recoverable through carving or file system metadata analysis.
- File carving
- Recovering files from unallocated space by locating known headers and footers, effective for contiguous files but limited when files are fragmented.
- Volatility plugin malfind
- A memory analysis plugin that detects injected code and suspicious memory regions by comparing memory pages to their corresponding on-disk files.
- Prefetch files
- Windows .pf files that record executable execution counts, loaded files, and timestamps, useful for establishing program execution.
- Amcache.hve
- A Windows registry hive that records installed and executed programs, including paths and timestamps, useful for execution and installation analysis.
- USN journal
- The NTFS change journal ($UsnJrnl:$J) that records file system changes, useful for timeline reconstruction and detecting deletions or renames.
- SRUM database
- The Windows System Resource Usage Monitor database (SRUDB.dat) that records per-application network and resource usage over time.
- Event ID 1102
- A Windows Security log event indicating the audit log was cleared, a common anti-forensic action that should be investigated.
- Daubert factors
- Legal criteria for expert testimony: testability, peer review, known error rate, and general acceptance, used to assess admissibility of forensic methods.
- ISO/IEC 27037
- An international standard providing guidelines for identification, collection, acquisition, and preservation of digital evidence.
- Live acquisition
- Capturing volatile data such as memory and network state from a running system before shutdown, used when powering down would cause data loss.
- Super-timeline
- A normalized chronology combining file system, registry, event log, browser, and other artifacts into a single UTC timeline for analysis.
- Plaso log2timeline
- An open-source tool that parses multiple artifact sources and produces a normalized super-timeline for forensic analysis.
- Autopsy
- An open-source digital forensics platform built on The Sleuth Kit that provides imaging, file system analysis, keyword search, and timeline features.
- EnCase E01 format
- A forensic image format that supports compression, per-block CRC checks, and case metadata, commonly used in commercial investigations.
- Raw dd image
- A bit-for-bit copy of storage media with no compression or metadata, requiring separate hash records for integrity verification.
- AFF4 format
- An open, extensible forensic image format using compression and XML-based metadata, designed for interoperability and long-term preservation.
- Faraday bag
- A shielded container that blocks wireless signals, used to preserve mobile device evidence and prevent remote wiping or alteration.
- MITRE ATT&CK
- A knowledge base of adversary tactics and techniques used to structure incident analysis and map forensic findings to attacker behavior.
- NIST SP 800-61
- A guideline defining incident response phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.
- BitLocker recovery key
- A key escrowed in Active Directory, Entra ID, or a Microsoft account that can unlock a BitLocker-encrypted volume during forensic analysis.
- LUKS header
- The Linux Unified Key Setup header at the start of an encrypted volume, identified by the magic bytes 'LUKS', containing key slots and metadata.
- Steganography detection
- Identifying hidden data by comparing file signatures to extensions, analyzing entropy, and using tools such as binwalk or stegdetect.
- YARA rules
- Pattern-matching rules used to identify malware families or suspicious files based on strings, byte sequences, and file characteristics.
- PCAP analysis
- Examining captured network packets with tools such as Wireshark or tshark to reconstruct sessions, identify protocols, and detect malicious traffic.
- Mobile logical extraction
- Recovering data through device APIs or backups without rooting or jailbreaking, capturing app data but not deleted or unallocated content.