Computer Forensics For Dummies®

Glossary

.e01

A proprietary file format that stores the physical bitstream of an acquired hard drive. When evidence is acquired, the MD5 hash value, or MD5, is calculated on the acquired bitstream image and not on the .e01 file; the bitstream image and MD5 are stored in the .e01 file with the MD5 at the end of the file.

802.11

A set of standards for wireless networks.

acquisition

The creation of an exact physical duplicate of the original. The creation is the forensic copy.

active file

A file that's accessible from normal use of the operating system.

Adam Walsh Child Protection and Safety Act

Legislation that states that in any criminal proceeding, any property or material that constitutes child pornography shall remain in the care, custody, and control of the government or court.

admissible evidence

Relevant evidence presented at trial and allowed by the judge. It's your goal!

alternate data streams (ADS)

An uncommon data storage concept that was developed to fix problems with operating system incompatibilities. A clever user can hide nefarious files in ADS because the files don't show up using a DIR (directory) command, nor do they appear in Windows Explorer. An ADS scanner is needed to find them.

authenticate

To provide sufficient proof that something is what it claims to be.

authentication

Ensures that the forensic image and the original computer media are identical.

Best Evidence rule

A rule specifying that a party seeking to admit a writing or recording or other content type must submit the ...