Glossary
Resolve terms that sound interchangeable but support different evidentiary claims.
Terms that change the claim
These 76 working definitions identify distinctions that matter in an examination. Follow the fuller sources for producer-specific behavior. A concise definition is not a platform validation or a legal conclusion.
A
- Acquisition
Collection of data from a defined source using a recorded method and scope.
Distinction: Not automatically a complete physical image.
- Acquisition error
A documented failure, omission, or deviation encountered during collection.
Distinction: A later matching hash does not erase the omitted scope.
- Alternate data stream
A named data stream associated with an NTFS file or directory.
Distinction: Its existence alone does not establish concealment or malware.
- Anti-forensics
Interference with the availability, collection, or interpretation of digital evidence. A descriptive category does not establish intent in a particular case.
Distinction: Not the same as ordinary privacy protection.
- Artifact
A record or residual structure interpreted as evidence of system or application activity. Meaning depends on its producer and collection context.
Distinction: Not necessarily a complete event history.
B
- Backup manifest
A record describing items or relationships within a backup format.
Distinction: A listed item still requires interpretation and collection verification.
- Blinding
Limiting access to outcome cues or irrelevant context during a defined part of an examination or study.
Distinction: A blind requires a record of who knew what and when.
C
- Chain of custody
A documented handling and transfer history for an evidence item.
Distinction: A hash comparison does not record custody.
- Chain of transformations
A recorded sequence connecting an original object to later derivatives and representations.
Distinction: A plausible sequence is not necessarily complete.
- Change journal
A mechanism recording selected changes according to the producer’s semantics, configuration, and retention.
Distinction: Not a record of every read or a complete audit history.
- Change ledger
A record of response actions, expected effects, observed effects, and the basis for linking them.
Distinction: A planned side effect is not automatically an observed change.
- Clock uncertainty
The unresolved relationship between a source clock and a relevant reference time.
Distinction: UTC formatting does not remove clock error.
- Cloud export
A service-produced package of records or objects within stated export and access boundaries.
Distinction: Not necessarily a complete tenant history or original byte copy.
- Collection bias
A systematic influence introduced by which sources, time ranges, accounts, or records are available and selected.
Distinction: More records do not necessarily remove the bias.
- Collection scope
The sources, accounts, paths, event types, time ranges, and access conditions represented in an acquisition.
Distinction: A successful export does not establish complete source coverage.
- Corroboration
Support for an interpretation from additional observations, with attention to their independence.
Distinction: Two exports from one source are not two independent sources.
- Credential attribution
Association of recorded activity with an account, principal, or credential context.
Distinction: It does not independently establish which person controlled the credential.
- Cross-device synchronization
Propagation of selected application state between devices or services.
Distinction: A local record can reflect synchronized rather than locally initiated activity.
D
- Data remanence
Data remaining after an action intended or expected to remove or change its ordinary availability.
Distinction: Recoverability cannot be assumed across devices and methods.
- Denominator
The defined set of eligible units used as the divisor in a reported rate or proportion.
Distinction: Files, events, devices, and repeated runs are different units.
- Derivative
An object produced from another object by extraction, conversion, export, redaction, or other transformation.
Distinction: A different digest can be expected and needs a recorded parent relationship.
- Derivative evidence object
An extracted, transformed, or exported object whose relationship to a preserved input should be recorded.
Distinction: A different hash can be expected after a transformation.
E
- Event coverage
The operations and event categories a source was configured and able to record during a stated interval.
Distinction: Logging availability does not mean every relevant operation was selected.
- Event forwarding
Transport of selected events from their producer to another collection point.
Distinction: A central copy has its own filtering, delay, and retention context.
- Event identifier
A producer-assigned value that helps classify a record when combined with provider, version, and fields.
Distinction: The same number is not meaningful without its namespace.
- Evidence integrity
Preservation of an item and its traceable handling so changes and derivations can be explained.
Distinction: Integrity alone does not establish authenticity or relevance.
F
- False negative
A negative classification for an input that meets the defined target condition.
Distinction: No match alone does not identify a false negative.
- False positive
A positive classification for an input that does not meet the stated target condition under the chosen reference standard.
Distinction: A disagreement needs a defined reference before it can be counted.
- False-positive rate
For a specified binary task, false positives divided by all reference-negative units.
Distinction: Different from the fraction of positive outputs that are false.
- File carving
Recovery based on content structures or signatures rather than a complete surviving filesystem entry.
Distinction: A carved fragment may lack name, history, or complete context.
- File signature
A recognizable byte pattern associated with a format or structure.
Distinction: A matching signature is not a complete validation of a file.
- Fragmentation
Storage of an object across non-contiguous allocation locations.
Distinction: A contiguous fragment may not represent the whole object.
G
- Ground truth
A reference answer established independently enough to evaluate the method under test, with its own provenance and limits.
Distinction: The output of the tested method cannot automatically serve as its own answer key.
H
- Hash verification
Comparison of digests calculated with the same algorithm over explicitly defined bytes.
Distinction: Byte equality does not establish original truth or tool safety.
I
- Incident handoff
Transfer of sources, findings, limitations, and pending decisions to another responsible examiner or team.
Distinction: A report alone may omit the material needed to reproduce findings.
- Indicator of compromise
An observable associated with potentially malicious activity and used to guide examination.
Distinction: A match requires context and can become stale.
L
- Live response
Collection or observation performed on a running system, with resulting changes accounted for.
Distinction: Not a perfectly frozen view of the system.
- Logical acquisition
Collection of selected objects or records through a filesystem, application, service, or export interface.
Distinction: Not necessarily a complete physical image.
- Logical export
A collection produced through a defined application, service, or logical selection mechanism.
Distinction: Its scope differs from a physical storage image.
M
- Master File Table
An NTFS structure containing file records and attributes interpreted in filesystem context.
Distinction: A surviving record is not a full activity history.
- Metadata
Data describing an object or process within a producer-specific structure.
Distinction: Metadata can be incomplete, transformed, or misleading.
- Mobile backup
A collected representation of permitted device or application material under a backup mechanism.
Distinction: Not equivalent to every form of mobile acquisition.
N
- Negative evidence
An absence interpreted in relation to an explicit expectation that a detectable record would exist.
Distinction: An empty search alone does not establish that an event did not happen.
O
- OAuth grant
An authorization relationship allowing an application specified access in an account or tenant context.
Distinction: A grant does not prove every permitted action occurred.
P
- Parser
Software that interprets a structure or format and exposes fields or records for further use.
Distinction: A friendly output label may add interpretation beyond raw bytes.
- Physical image
An acquisition representing an addressable device or storage area according to the method and format used.
Distinction: Not proof that inaccessible hardware areas were captured.
- Precision
For a specified binary task, true positives divided by all positive outputs.
Distinction: Depends on the evaluated inputs and their class proportions.
- Provenance
Information about an object’s origin, handling, and transformations, supported to varying degrees by available records.
Distinction: Recorded assertions are not necessarily true statements about a scene.
Q
- Query result
The output produced by a defined query over an available source at an observation time.
Distinction: An empty result can reflect access, scope, or query assumptions.
R
- Recall
For a specified binary task, true positives divided by all reference-positive units.
Distinction: Does not describe how many positive outputs are false alarms.
- Recovery absence
A bounded finding that a specified item was not located using stated methods on a stated collection.
Distinction: It does not establish deliberate destruction or universal unrecoverability.
- Repeatability
Agreement when a method is repeated under specified conditions; the actual conditions should be recorded.
Distinction: Repeated identical error is still repeatable.
- Reproduction bundle
A versioned collection linking study inputs, environment, transformations, results, and limitations.
Distinction: A code repository or hash list alone may not permit reproduction.
- Retention
The conditions and period under which records remain available at a source.
Distinction: Missing records do not by themselves prove deliberate deletion.
- Rule coverage
The range of patterns a configured detection set can evaluate against available fields.
Distinction: Not the same as source or collection coverage.
S
- Session identity
A representation of an authenticated or delegated context within a system or service.
Distinction: A session can be automated, shared, delegated, or compromised.
- Sigma rule
A structured detection description intended for use with compatible log mappings and tooling.
Distinction: A rule match is not proof of compromise.
- Slack space
Residual space associated with allocation boundaries beyond a file’s logical content under the relevant storage model.
Distinction: Residual bytes require context before attribution.
- Snapshot
A representation of a system or storage state at a defined point or interval under a particular mechanism.
Distinction: A snapshot does not automatically include every related service.
- Source attribution
An inference associating an object or observation with a source under stated evidence and uncertainty.
Distinction: Not automatically attribution to a human actor.
- Synthetic evidence
Evidence involving generated or transformed content, or records of an AI-enabled process; the precise object must be stated.
Distinction: AI-generated content differs from evidence that AI was used.
- Synthetic imprinting
A proposed term for lasting changes associated with AI-generated or simulated experiences. The framework remains open to testing.
Distinction: Not an established diagnosis or proof of a memory effect.
T
- Time normalization
Conversion of recorded times into a common representation while preserving the original basis and uncertainty.
Distinction: Conversion does not correct an inaccurate clock.
- Time precision
The resolution at which a timestamp represents a value.
Distinction: Fine precision does not imply an accurate clock.
- Tool verification
A check that a selected tool or output satisfies a stated requirement in a defined context.
Distinction: Not a universal approval for all features.
- Triage
A scoped prioritization process used to identify relevant sources and decisions under constraints.
Distinction: A negative triage result is not a complete examination.
U
- Unallocated space
Storage units not currently allocated according to the examined filesystem state.
Distinction: Not a complete inventory of everything ever deleted.
- User attribution
Reasoning that connects activity to a person or account, with those identities kept distinct.
Distinction: An account identifier does not alone establish who controlled it.
- USN change journal
An NTFS per-volume record of filesystem changes with version-specific record structures.
Distinction: It is not a complete content history or a human identity record.
V
- Validation
A bounded test of a method against stated requirements and known conditions.
Distinction: Repository availability and successful execution are not validation.
- Verification scope
The specific objects, properties, interval, and conditions addressed by a verification operation.
Distinction: A successful check does not extend to untested coverage or authenticity claims.
- Volatile data
Information whose availability depends on changing live state or power and may disappear before later collection.
Distinction: Volatile does not mean inherently more reliable.
W
- Working copy
A documented copy used for examination so source handling and analysis changes can be explained.
Distinction: An untracked copy does not automatically preserve provenance.
- Write blocker
A hardware or software control intended to prevent defined writes through an acquisition path. Its scope and validated behavior must be stated.
Distinction: Not a guarantee against changes through every other path.
- Write-ahead log
A transaction file used by a database in WAL mode that can be needed to represent its committed state.
Distinction: A main SQLite database copied alone may omit relevant committed changes.
Y
- YARA rule
A pattern-based description used to identify matching content under the rule engine’s semantics.
Distinction: A content match does not establish actor identity.