Chapter 18: Computer Forensics

hardware

the physical components of a computer: case, keyboard, monitor, motherboard, RAM, HDD, mouse, and so on; generally speaking, if it is a computer component you can touch, it is hardware

software

a set of instructions compiled into a program that performs a particular task; software consists of programs and applications that carry out a set of instructions on the hardware

motherboard

the main system board of a computer (and many other electronic devices), which delivers power, data, and instructions to the computer's components; every component in the computer connects to the mother board, either directly or indirectly

central processing unit (CPU)

the main chip within the computer, also referred to as the brain of the computer, which handles most of the operations (i.e., code and instructions) of the computer

random-access memory (RAM)

the volatile memory of a computer, where programs and instructions that are in use are stored; when power is turned off, its contents are lost

hard disk drive (HDD)

Typically the main storage locations within the computer, which consists of magnetic platters contained in a case and is usually where the operating system, application, and user data are stored

operating system (OS)

the software that provides the bridge between the system hardware and the user; lets the user interact with the hardware and manages the file system and applications

partition

a contiguous set of blocks that are defined and treated as an independent disk

sector

the smallest addressable unit of data by a hard disc drive; generally consists of 512 bytes

byte

a group of eight bits

bit

short for binary digit; taking the form of either a one or a zero, it is the smallest unit of information on a machine

cluster

a group of sectors in multiples of two; size varies from file system to file system and is typically the minimum space allocated to a file

Message Digest 5 (MD5)

a software algorithm used to "fingerprint" a file or contents of a disk; used to verify the integrity of data. In forensic analysis it is typically used to verify that an acquired image of suspect data was not altered during the process of imaging

Secure Hash Algorithm (SHA)

same as Message Digest 5 (MD5)

visible data

all data that the operating system is presently aware of and thus is readily accessible to the user

swap file

a file of defined space on the HDD used to conserve RAM; data is swapped, or paged, to this file or space to free RAM for applications that are in use

temporary files

files temporarily written by an application to perform a function or to provide a "backup" copy of a work product should the computer experience a catastrophic failure

latent data

areas of files and disks that are typically not apparent to the computer user (and often not to the operating system) but contain data nonetheless

file slack

the area that begins at the end of the last sector that contains logical data and terminates at the end of the cluster

unallocated space

the unused area of the HDD that the operating system file system table sees as empty (i.e., containing no logical files) but that my contain old data

Internet cache

portions of visited webpages on the local hard disk drive to facilitate quicker retrieval when the webpage is revisited

cookies

file placed on a computer from a visited website that are used to track visits to and usage of that site

Internet history

an accounting of websites visited; different browsers store this information in different ways

bookmark

a feature that enables the used to designate favourite sites for fast and easy access

hacking

frequently used as a slang term for performing an unauthorized computer or network intrusion

firewall

hardware or software designed to protect intrusions into an Internet network