Friday, Aug 23rd

Last update06:08:55 PM GMT

You are here: Glossary

Glossary of Computer Forensics Terms

Search for glossary terms (regular expression allowed)
Begins with Contains Exact term
All A B C D E F G H I J K L M N O P Q R S T U V W
Term Definition

Local Area Network


An operating system popular with enthusiasts and used by some businesses.

Little endian

In a little-endian system, the least significant value in the sequence is stored first. Many mainframe computers, particularly IBM mainframes, use a big-endian architecture. Most modern computers, including PCs, use the little-endian system. The terms big endian and little endian are derived from the Lilliputians of Gulliver's Travels, whose major political issue was whether soft-boiled eggs should be opened on the big side or the little side.

Locard’s exchange principle

The theory that anyone, or anything, entering a crime scene both takes something of the scene with them, and leaves something of themselves behind when they leave. In the digital world, this translates into that when two computers come in "contact" with each other over a network, they exchange something with each other. This "something" may show up in log files, the registry, in memory or other places on the systems.


The process of storing information about events that occurred on the firewall or network.

Logical address

When files are saved, they are assigned to clusters. The clusters are assigned numbers by the operating system, and the cluster number defines the logical address.

Logical Cluster Number

Used by the MFT in NTFS. The LCN describes the offset of a cluster from some arbitrary point within the volume

Logical file size

All file systems keep track of the exact size of a file in bytes. This is the logical size of the file and is the number that you see in the properties for a file. This number is different from the physical file size.

Lossless compression

A compression method in which no data is lost. With this type of compression, a large file can be compressed to take up less space, and then decompressed without any loss of information.

Lossy compression

A compression technique that can lose data but not perceptible quality when a file is restored. Files that use lossy compression include JPEG and MPEG.

All A B C D E F G H I J K L M N O P Q R S T U V W