Forensic Examination of Digital Evidence

Appendix B. Glossary
The following terms are included to assist
the reader in understanding this guide.
Acquisition: A process by which digital
evidence is duplicated, copied, or imaged.
Analysis: To look at the results of an
examination for its significance and probative
value to the case.
BIOS: Basic Input Output System. The set
of routines stored in read-only memory
that enables a computer to start the operating
system and to communicate with
the various devices in the system such as
disk drives, keyboard, monitor, printer, and
communication ports.
CD-RW: Compact disk-rewritable. A disk
to which data can be written and erased.
CMOS: Complementary metal oxide semiconductor.
A type of chip used to store
BIOS configuration information.
Compressed file: A file that has been
reduced in size through a compression
algorithm to save disk space. The act of
compressing a file will make it unreadable
to most programs until the file is uncompressed.
Most common compression utilities
are PKZIP with an extension of .zip.
Copy: An accurate reproduction of information
contained on an original physical
item, independent of the electronic storage
device (e.g., logical file copy).
Maintains contents, but attributes may
change during the reproduction.
Deleted files: If a subject knows there are
incriminating files on the computer, he or
she may delete them in an effort to eliminate
the evidence. Many computer users
think that this actually eliminates the information.
However, depending on how the
files are deleted, in many instances a
forensic examiner is able to recover all or
part of the original data.
Digital evidence: Information stored or
transmitted in binary form that may be
relied on in court.
Duplicate: An accurate digital reproduction
of all data contained on a digital storage
device (e.g., hard drive, CD-ROM,
flash memory, floppy disk, Zip ® , Jaz ® ).
Maintains contents and attributes (e.g.,
bit stream, bit copy, and sector dump).
Electromagnetic interference: An electromagnetic
disturbance that interrupts,
obstructs, or otherwise degrades or limits
the effective performance of electronics/electrical
equipment.
Encryption: Any procedure used in cryptography
to convert plain text into cipher
text in order to prevent anyone but the
intended recipient from reading that data.
Examination: Technical review that makes
the evidence visible and suitable for analysis;
tests performed on the evidence to
determine the presence or absence of
specific data.
File name anomaly: Header/extension
mismatch; file name inconsistent with the
content of the file.
39