CDFE key terms

A documented, chronological record of who handled a piece of evidence, when, where, and for what purpose, used to prove the evidence was not altered or contaminated between seizure and presentation.

The priority sequence for collecting data based on how quickly it disappears, starting with CPU registers and cache, then RAM, then network state, then disk, then backups and archival media.

A hardware device or software driver that intercepts write commands to a storage device, allowing read-only access so the original evidence is not modified during imaging or examination.

A bit-for-bit duplicate of a storage device or volume, including unallocated space and slack, stored in a container format such as raw, E01, or AFF4 for later analysis and verification.

A fixed-length cryptographic digest computed over data, used to verify that a forensic copy matches its source and to prove that evidence has not changed since acquisition.

The property that collected data remains complete and unaltered from the moment of seizure, demonstrated through hashing, write blocking, documented handling, and reproducible examination steps.

Collecting volatile and stored data from a running system, such as memory and network connections, before powering it down, accepting some risk of altering state in exchange for capturing otherwise lost evidence.

A capture of the contents of physical RAM from a running or hibernated system, used to recover encryption keys, running processes, network connections, and injected code that never touch disk.

The unused remainder of the last allocated cluster in a file and the unused space within a cluster, which can retain fragments of previously deleted content not visible through normal file access.

Storage clusters not currently assigned to any file or directory, which often still contain remnants of deleted files and are a primary target for recovery and keyword searching.

Recovering files from raw data by locating known header and footer signatures and reconstructing content without relying on file system metadata, useful when the file system is damaged or entries are overwritten.

Reconstructing files whose directory entries were removed but whose data clusters have not yet been reused, typically by parsing file system metadata or carving from unallocated space.

The NTFS structure that stores metadata records for every file and directory on a volume, including timestamps, permissions, data run locations, and attributes used heavily in timeline analysis.

An NTFS feature allowing additional named data streams to be attached to a file, sometimes used to hide content because many tools and directory listings show only the default stream.

Building a chronological view of file system, registry, log, and application timestamps to reconstruct the sequence of user and system activity on a host.

The modified, accessed, and changed timestamps recorded in file system metadata, whose interpretation varies by file system and which can be affected by updates, mounts, or deliberate tampering.

Comparing the leading bytes of a file, which identify its true format, against its extension to detect mismatches that suggest renaming, concealment, or malicious content.

Any residual trace left by system or user activity, such as registry keys, log entries, prefetch files, browser history, or shellbags, that supports inferences about what occurred on a device.

A file containing a portion of the Windows registry database, such as SYSTEM, SOFTWARE, or NTUSER.DAT, which preserves configuration, installed software, and user activity evidence.

A Windows performance feature that records the files and paths loaded when an application starts, providing evidence that a program executed and roughly when and how often.

A Windows application compatibility cache that stores path and timestamp information about executables, used to infer that a program existed and may have run even when other execution artifacts are absent.

A Windows registry-based artifact that records metadata about applications and executables observed on a system, including paths, hashes, and installation-related timestamps useful for program provenance.

Any record indicating that a program ran, such as prefetch entries, shimcache, amcache, event logs, jump lists, or recent-file references, each with different reliability and retention.

Registry and log records that preserve identifiers, serial numbers, and connection times of removable devices, used to establish that a device was attached and when.

An open-source memory forensics framework used to analyze RAM captures for processes, network connections, injected code, and cached credentials, typically through profile-specific plugins.

Malicious software designed to conceal its presence and that of other payloads by subverting operating system structures, often detectable through memory analysis, cross-view comparison, or integrity checks.

Techniques intended to obstruct investigation, such as timestomping, secure deletion, encryption, log tampering, and data hiding, which examiners must recognize and account for in their findings.

Deliberately altering file timestamps to make content appear older or newer than it is, often detected by comparing timestamps across metadata structures or against independent log sources.

Hiding data within another file or medium, such as embedding a message in image pixels or audio samples, so that the carrier appears ordinary and the hidden content is not obvious.

Capturing and analyzing network traffic and logs, such as packet captures, flow records, and firewall events, to reconstruct intrusions, data movement, and command-and-control activity.

A recorded stream of network frames with headers and payloads, stored in formats such as pcap or pcapng, used to inspect protocols, extract transferred files, and reconstruct sessions.

Summarized metadata about network conversations, including source and destination addresses, ports, byte counts, and timestamps, offering a lightweight record of connections without full payload content.

Combining events from multiple sources, such as host, application, and network logs, on a common timeline to identify related activity and reduce false conclusions drawn from a single source.

A rapid, prioritized examination that identifies high-value systems, accounts, or evidence first, so limited time and resources are directed where they most affect the investigation.

A reference set of hashes for known-good or known-bad files, used to quickly exclude operating system files from review or to flag known malicious content during examination.

A written account of the examination that states scope, methods, tools and versions, findings with supporting evidence, limitations, and conclusions, written so a non-technical reader can follow the reasoning.

The defined boundary of an investigation, specifying which systems, accounts, time period, and questions are covered, which guides collection, limits analysis, and frames report conclusions.