Glossary of Digital Forensics Terms

Short, plain definitions of the words you will meet in forensic reports, lab manuals and court documents.

Forensic work has its own language. A report may say the drive was imaged through a write blocker, the hash verified and deleted files carved from unallocated space. If those words are new to you, start here.

Each term below has a one or two line definition with an example where it helps. The list covers storage, mobile, network, cloud, memory and malware work, along with the legal terms you need for Indian courts.

Terms from A to Z

Access Control: Rules that decide who can open, change or move evidence, case files or systems. In a lab it covers locked evidence rooms, user accounts on forensic workstations and logs of who accessed what.
Acquisition: Collecting digital evidence from a storage device, memory or a network in a forensically sound way. The aim is a copy that can be checked against the original, with nothing changed on the source.
Anti-Forensics: Steps a suspect takes to hide, destroy or falsify evidence, such as wiping tools, changed timestamps, encryption or cleared logs. Examiners look for the traces these steps leave behind.
Artefact: A trace left on a system by a user or a program, such as a log entry, browser history, a prefetch file or a cached thumbnail. Artefacts help rebuild what was done and when.

Bitstream Imaging: Making a bit-for-bit copy of storage media, including deleted files, slack space and unallocated areas. It is the standard way to preserve a drive before any analysis.
Blockchain Forensics: Tracing cryptocurrency transactions on a public ledger to follow the money, link wallet addresses and spot patterns used in fraud or laundering. Exchange records obtained through legal process often tie a wallet to a person.

Chain of Custody: A written record of every person who handled an item of evidence, with when, where and why, from seizure to court. A gap in this record gives the other side a reason to question the evidence.
Cloud Forensics: Collecting and examining evidence held on cloud platforms, such as account logs, stored files and virtual machine snapshots. Much of this data sits with the provider, so legal requests and provider logs play a big part.
Cryptographic Hash: A fixed-length value calculated from data, for example with MD5 or SHA-256, that changes completely if even one bit of the data changes. Examiners use it as a fingerprint to prove a copy matches the original.

Data Carving: Recovering files from raw data by searching for known file headers and footers instead of relying on file system records. It helps when files are deleted or the file system is damaged.
Disk Forensics: Examining hard drives, SSDs, RAID arrays and NAS storage to recover data, find user activity and spot tampering.

E01 (Expert Witness Format): A common forensic image format that stores disk data along with case notes, compression, checksums and a hash of the whole image. FTK Imager, EnCase, X-Ways Forensics and Autopsy all work with it.
Electronic Evidence Certificate (Section 63, BSA): The certificate needed under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 when a copy of an electronic record is produced in court. It replaced the certificate under Section 65B of the Indian Evidence Act, 1872 and asks for details of the device and the hash value of the record.
Encryption Analysis: Examining encrypted files, volumes or messages to find out what protects them and whether the data can be reached lawfully. A key found in a RAM capture or a password recovered during the case can open the data.
Evidence Preservation: The steps that keep evidence unchanged from seizure to court, such as write blocking, hashing, sealed packaging and safe storage. Keeping a seized phone in a Faraday bag so it cannot be wiped remotely is one example.

File System Forensics: Studying file system structures such as NTFS, FAT32, exFAT, ext4 and APFS to recover deleted files, timestamps and other metadata.
Forensic Imaging: Making an exact, verified copy of a storage device, usually through a write blocker, with both the source and the copy hashed. All analysis is then done on the copy.

GPS Forensics: Extracting and reading location data from phones, vehicles, drones and other devices. It helps build a timeline of where a device was and when.
GUI Analysis: Reviewing evidence through a program's own screens, for example running a seized app in an emulator or watching malware on a test desktop. It shows what the user or the program actually saw and did.

Hash Verification: Comparing the hash values of the source and the copy, or of the same file at two points in time. Matching values show the data has not changed.
HDD/SSD Forensics: Methods suited to each type of drive. Hard drives keep deleted data until it is overwritten, while SSDs move data around through wear levelling and may erase deleted blocks after TRIM, which changes what can be recovered.

Incident Response (IR): The process of detecting, containing and recovering from a security incident such as a breach or a ransomware attack. Forensics gives the IR team its evidence and the root cause.
Indicator of Compromise (IOC): A sign that a system has been attacked, such as a known malicious file hash, IP address, domain or registry key. Teams share IOCs so others can search their own systems for the same attack.
IoT Forensics: Investigating data from connected devices such as smart speakers, cameras, wearables, drones and industrial sensors. Evidence may sit on the device, in the phone app that controls it or in the vendor's cloud.

Logical Extraction: Copying the files and data a phone's operating system makes available, such as contacts, messages and photos, often through a backup. It is quick but usually misses deleted data and protected app files.

Memory Forensics: Analysing a capture of RAM to find running processes, network connections, encryption keys and malware that may never touch the disk. Volatility 3 is a widely used tool for this work.
Metadata Analysis: Examining data about data, such as a file's created and modified times, author fields or the EXIF details in a photo. It helps show where a file came from, how it was edited and who used it.

Network Forensics: Capturing and analysing network traffic and logs to find intrusions, data theft and other malicious activity. Common tools include Wireshark, Zeek and NetworkMiner.

Order of Volatility: The rule of collecting the most short-lived evidence first, such as RAM and live network connections, before disks and backups. RFC 3227 sets out this order.
OSINT (Open Source Intelligence): Gathering information from public sources such as social media, websites, forums, public records and domain registrations. Investigators record the date, time and URL of each find so it can be relied on later.

PCAP: A file format for saved network traffic, made by tools such as Wireshark and tcpdump. A PCAP holds whole packets, so the traffic can be examined again later.
Physical Extraction: A bit-for-bit copy of a phone's flash memory, which can include deleted data. On most modern encrypted phones it is rarely possible, so examiners use full file system extractions instead.

RAID Forensics: Rebuilding a RAID array from its member disks by working out the RAID level, disk order, stripe size and parity, then examining the rebuilt volume.
Ransomware Analysis: Examining a ransomware attack to find how it got in, what it encrypted, whether data was stolen and whether files can be recovered. For some strains a public decryptor exists.

Slack Space: The unused space between the end of a file and the end of the last cluster it occupies. It can hold fragments of older, deleted data.
Steganography: Hiding data inside another file, such as an image, audio or video file, so its presence is not obvious. Examiners look for statistical changes, odd file sizes or stego tools on the suspect's system.

Timeline Analysis: Putting events from file timestamps, logs, browser history and other sources in time order to see what happened and when. Tools such as Plaso (log2timeline) help build these timelines.
Tool Validation: Testing a forensic tool on known data to confirm it gives accurate and repeatable results before relying on it in a case. Courts can ask how a tool was tested.
TRIM: A command the operating system sends to an SSD to say which blocks no longer hold data. The SSD may then erase those blocks, so deleted files on an SSD are often gone for good.

Unallocated Space: Areas of a disk the file system marks as free. They often still hold deleted files or fragments, which examiners recover through carving.

Virtual Machine Forensics: Examining virtual disks, snapshots and hypervisor logs, such as VMDK or VHDX files. Investigators can often copy a virtual machine's files without disturbing the host system.

Windows Registry: A database where Windows stores settings and records of user activity, such as recently opened files, USB devices connected and programs run. It is one of the richest sources of artefacts on a Windows PC.
Wireshark Analysis: Using Wireshark to open live or saved traffic, filter it by protocol, address or port and follow a conversation. It is often the first tool an examiner opens on a PCAP file.
Write Blocker: A hardware device or software setting that lets an examiner read a drive while blocking any write to it. It keeps the original evidence unchanged during acquisition.

YARA Rule: A rule that describes text or byte patterns found in a malware family. Analysts run YARA rules across files, disk images or memory captures to find matches.

Learn the terms in practice

Definitions help. The words make full sense only when you use them on real evidence. DFRTI courses in storage, mobile, network, cloud and malware forensics put each of these ideas to work in hands-on labs.

We add new terms to this glossary as tools and techniques change.