Notice: Cache failed on disk write, class stdClass, path C:\Inetpub\vhosts\pcrforensics.com\httpdocs\cache/cmsapi/html/cmsapiDatabase/ddac8c367472d955e41dcc4e01839f2a in C:\Inetpub\vhosts\pcrforensics.com\httpdocs\plugins\cmsapi\cmsapi\cmsapi.cache.php on line 55
Notice: Cache failed on disk write, class glossaryGlossaryManager, path C:\Inetpub\vhosts\pcrforensics.com\httpdocs\cache/cmsapi/singleton/glossaryGlossaryManager in C:\Inetpub\vhosts\pcrforensics.com\httpdocs\plugins\cmsapi\cmsapi\cmsapi.cache.php on line 55
Notice: Cache failed on disk write, class glossaryEntryManager, path C:\Inetpub\vhosts\pcrforensics.com\httpdocs\cache/cmsapi/singleton/glossaryEntryManager in C:\Inetpub\vhosts\pcrforensics.com\httpdocs\plugins\cmsapi\cmsapi\cmsapi.cache.php on line 55
Glossary of Computer Forensics Terms
Media Access Control address. A unique identifying number built (or ‘burned’) into a network interface card by the manufacturer. MAC addresses can be faked (spoofed) using software.
A disk, tape, cartridge, diskette, or cassette that is used to store data magnetically.
Programming code designed to damage a computer system or data contained on a system. It is traditionally classified into three categories viruses, worms, and Trojan horses, based upon the behaviour of the code.
Stores the node descriptor and a map record in the Macintosh file system.
|Master Boot Record||
The very first sector of a physical disk (absolute sector 0) is called the master boot record. It contains machine code to enable the computer to find the partition table and the operating system. One of the first things a computer does when it starts up is to load this code into memory and execute it. This ‘boot code’ has a very simple task. Its job is to read the partition table at the end of sector 0 and decide how the disk is laid out, and which partition contains the bootable operating system.
|Master Directory Block||
On older Macintosh systems, the location where all information about a volume is stored. A copy of the MDB is kept in the next to the last block on the volume.
|Master File Table||
Used by NTFS to track files. It contains information about the effective use of computer stamps, system attributes, and parts of the file.
1 Megabyte = 1024 Kilobytes.
An algorithm created in 1991 by Professor Ronald Rivest that is used to create digital signatures (i.e. fingerprints) of storage media such as a computer hard drive.
Often used as a shorter synonym for random access memory (RAM). Memory is the electronic holding place for instructions and data that a computer’s microprocessor can reach quickly. Often used as a shorter synonym for random access memory (RAM). Memory is the electronic holding place for instructions and data that a computer’s microprocessor can reach quickly.
Electronic information about a file that travels with the electronic file. Otherwise called ‘data about data’
|Mirror image backup||
Mirror image backups (also referred to as bit-stream backups) involve the backup of all areas of a computer hard disk drive or another type of storage media. Mirror image backups exactly replicate all sectors on a given storage device. Accuracy is essential and to guarantee accuracy, mirror image backup programs typically rely on mathematical hashing computations in the validation process.
|Misnamed files (also called files with a||
One simple way to disguise a file’s contents is to change the file’s name to something innocuous. For example, if an investigator was looking for images by searching or filtering for a particular file extension (i.e. .gif), any file whose extension had been changed by the user to ‘rtf’ would not appear as a result of the search. Forensic examiners use special techniques (signature analysis) to determine if this has occurred, which the casual user would not normally be aware of.
A device that converts digital signals to analog signals for transmission over the telephone system.
The ‘heart’ of the computer. It handles system resources (IRQ lines, DMA channels, I/O locations), as well as core components such as the CPU, and all system memory. It accepts expansion devices such as sound and network cards, and modems.
MicroSoft Disk Operating System. Operating system marketed by Microsoft. This was the most common operating system in use on desktop PCs, which automatically loads into the computers memory in the act of switching the computer on.