Chapter17: Computer Forensics

Bit

Short for binary digit; Taking the form of either a one or a zero, it is the smallest unit of information on a machine.

Byte

A group of eight bits.

Central Processing Unit (CPU)

The main chip within the computer; also referred to as the brain of the computer. This microprocessor chip handles most of the operations (code and instructions) of the computer.

Cluster

A group of sectors in multiples of two. Cluster size varies from file system to file system and is typically the minimum space allocated to a file.

File Slack

The area that begins at the end of the last sector that contains logical data and terminates at the end of the cluster.

Hard Disk Drive (HDD)

Typically the main storage location within the computer. It consists of magnetic platters contained in a case (usually 3.5" in a desktop computer and 2.5" in a laptop). The HDD is usually where the operating system, applications, and user data are stored.

Hardware

The physical components of a computer: case, keyboard, monitor, motherboard, RAM, HDD, mouse, and so on. Generally speaking, if it is a computer component you can touch, it is hardware.

Latent Data

Areas of files and disks that are typically not apparent to the computer user (and often not to the operating system), but contain data nonetheless.

Message Digest 5 (MD5)/ Secure Hash Algorithm (SHA)

A software algorithm used to "fingerprint" a file or contents of a disk; used to verify the integrity of data. In forensic analysis it is typically used to verify that an acquired image of suspect data was not altered during the process of imaging.

Motherboard

The main system board of a computer (and many other electronic devices). It delivers power, data, and instructions to the computer's components. Every component in the computer connects to the motherboard, either directly or indirectly.

Operating System (OS)

The software that provides the bridge between the system hardware and the user. The OS lets the user interact with the harware and manages the file system and applications. Some examples are windows (XP, 2000), Linux, and Mac OS.

Partition

A contiguous set of blocks that are defined and treated as an independent disk.

RAM Slack

The area beginning at the end of the logial file and terminating at the end of that sector. In some older operating systems this area is padded with information in RAM.

Random-Access Memory (RAM)

The volatile memory of the computer, when power is turned off, its contents are lost. Programs and instructions are loaded into RAM while they are in use.

Sector

The smallest addressable unit of data by a hard disk drive; generally consists of 512 bytes.

Software

A set of instructions complied into a program that performs a particular task. Software consists of programs and applications that carry out a set of instructions on the hardware.

Swap File

A file or defined space on the HDD used to converse RAM. Data is swapped (paged) to this file/space to free RAM for applications that are in use.

Temporary Files

Files temporarily written by an application to perform a function. For applications, such as Microsoft word and Excel, temporary files are created to provide a "backup" copy of the work product should the computer experience a catastrophic failure.

Unallocated Space

The area of the HDD that the operating system (file system table) sees as empty (containing no logical files) and ready for data. Simply started, it is the unused portion of the HDD, but is not necessarily empty.

Visible Data

All data that the operating system is presently aware of, and thus is readily accessible to the user.