Forensics Glossary

Browse 37 forensics terms defined in plain English, from the cultural dictionary of computing.

37 Forensics Terms

Access Log
A log recording attempts to access a system, service, application, or resource, typically including metadata such as user, time, source, and result. Access...
Anti-Forensics
Anti-Forensics is a defensive measure intended to resist or complicate forensics techniques used by attackers or analysts. Security teams use it to enforce...
Audit Trail
Audit Trail is a chronological record of administrative and system actions that supports accountability, investigation, and compliance review. Security teams...
Blockchain Forensics
The analysis of blockchain transaction history, wallet relationships, and on-chain behavior to investigate theft, laundering, fraud, or attribution. It often...
Chain of Custody
Chain of Custody is the documented handling history that shows who collected, transferred, stored, and analyzed digital evidence. Security teams use it to...
Cloud Forensics
Digital forensics applied to cloud-hosted systems, identities, logs, storage, and control-plane activity. Cloud forensics differs from traditional host-centric...
Compromise Assessment
An investigation aimed at determining whether an environment has already been breached, often by hunting for indicators, suspicious behaviors, and evidence of...
Computer Forensics
Computer Forensics is the preservation and examination of computer systems and storage to recover evidence relevant to an investigation. Security teams use it...
Data Recovery
The process of restoring lost, deleted, damaged, or inaccessible data from backups, replicas, or underlying media. In security incidents, recovery quality...
Digital Chain of Custody
The documented record of how digital evidence was collected, transferred, stored, accessed, and preserved over time so its integrity and handling can be...
Digital Forensics
Digital Forensics is the collection and analysis of digital evidence from devices, logs, and media using defensible procedures. Security teams use it to...
Disk Forensics
The forensic examination of storage media and file systems to recover artifacts, timelines, deleted files, and evidence of system activity. Disk forensics...
Email Header Analysis
The examination of routing metadata, authentication results, timestamps, sender fields, and relay paths in an email header to understand origin and detect...
File Analysis
The examination of a file's structure, metadata, contents, and behavior to determine whether it is malicious, sensitive, or otherwise noteworthy. File analysis...
File Carving
A forensic technique for recovering files or file fragments from raw storage by recognizing known headers, footers, and structural patterns even when...
Forensic Analysis
The structured examination of digital evidence to determine what happened, how it happened, and what systems or data were affected. Forensic analysis combines...
Forensic Artifact
A piece of digital evidence left by system or user activity, such as logs, registry keys, browser history, prefetch data, or memory remnants. Investigators use...
Forensic Image
A bit-for-bit copy of a storage device created in a way that preserves evidence and supports later verification, usually with hashing and careful...
Forensic Investigation
An inquiry that uses preserved digital evidence to determine the scope, timeline, cause, and impact of suspicious or malicious activity. A forensic...
Forensic Toolkit
A collection of software and utilities used to acquire, parse, search, and analyze digital evidence from disks, memory, mobile devices, or cloud sources....
Forensic Workstation
A computer configured specifically for digital forensic work, often with write blockers, high-capacity storage, trusted tooling, and controlled evidence...
Header Analysis
The inspection of protocol or file headers to understand origin, routing, structure, or manipulation. In practice it often refers to reviewing email headers,...
Image Forensics
The analysis of digital images to determine origin, edits, metadata history, steganography, or evidentiary value. Image forensics may involve examining EXIF...
Incident Forensics
Incident Forensics is forensic analysis performed during or after an incident to reconstruct attacker behavior and scope. Security teams use it to enforce...
Incident Investigation
The evidence-driven effort to determine what happened during a security incident, how the attacker or failure path worked, and what data or systems were...
Incident Timeline
A chronological reconstruction of key events in an incident, such as initial access, lateral movement, containment, and recovery actions. Timelines help...
Intrusion Analysis
The investigation of malicious activity inside an environment to determine how attackers entered, what they did, what they touched, and whether they still have...
Live Forensics
Forensic collection and analysis performed on a running system before it is powered down or reimaged, often to capture volatile evidence such as memory, active...
Log Forging
Log Forging is an attack technique in which an adversary creates misleading log entries that obscure what really happened. Defenders analyze it to understand...
Log Injection
Log Injection is an attack technique in which an adversary injects untrusted data into logs to corrupt analysis or trigger downstream issues. Defenders analyze...
Log Tampering
Log Tampering is an attack technique in which an adversary deletes, edits, or disables logging to hide attacker actions. Defenders analyze it to understand...
Memory Forensics
Memory Forensics is forensic analysis of volatile memory to recover processes, keys, connections, or malware artifacts. Security teams use it to enforce trust,...
Network Forensics
Network Forensics is the reconstruction and analysis of network communications for investigation, scoping, and evidence collection. Security teams use it to...
Network Traffic Analysis
The study of packets, flows, timing, volumes, and communication patterns to understand normal behavior, detect anomalies, and investigate attacks. Network...
Packet Analysis
The examination of captured network packets to understand protocol behavior, diagnose problems, or detect malicious activity. Packet analysis provides more...
Payload Analysis
The examination of malicious code or content delivered during an attack to understand its capabilities, intent, indicators, and dependencies. Payload analysis...
Protocol Analysis
The examination of how a communication protocol behaves in practice, including message structure, state transitions, authentication, and error handling....

Related Topics