Forensics

Front 1

Bit-for-bit copy

Back 1

An exact replica of the bits from either a logical volume or a physicaldrive. When the copy is made to a file it is called a forensic image file. When the copyis made to another disk it is called a clone.

Front 2

Bit-stream image

Back 2

Same as bit-for-bit copy.

Front 3

Bitlocker

Back 3

Full disk encryption solution from Microsoft. Encrypts Logical Volumes.

Front 4

Clone

Back 4

An exact replica or bit-for-bit copy of one disk on to another disk.

Front 5

Cryptographic hash

Back 5

MD5 or SHA-1

Front 6

Cyclic Redundancy Check (CRC) -

Back 6

CRC is an error checking mechanism often usedto compare two sets of data in order to detect errors during transmission. It is lesscompute intensive than MD5 or SHA-1 hash algorithms but still provides a statisticallysufficient validation

Front 7

Dead imaging

Back 7

When a disk is removed from a computer system and reattached via awrite-blocker to another system that can acquire the contents of the disk it is called deadimaging.

Front 8

Disk Image File

Back 8

A file containing an exact copy of a physical disk or logical volume.Tools like dd, dcfldd and FTK Imager can create disk image files. ISO images are diskimages of data CDs or DVDs.

Front 9

Embedded image

Back 9

disk images that contain metadata about the image such as atimestamp when the image was created and a cryptographic hash. E01 (Expert Witness)images are embedded images that contain an acquisition hash, CRC calculations aftereach data block and case information.

Front 10

Fingerprint

Back 10

An identifier for a particular forensic image. See cryptographic hash.

Front 11

Forensic duplicate -

Back 11

A copy of a logical volume or physical disk that has been copied bitfor-bit so that it includes all data and metadata

Front 12

Forensic image

Back 12

A copy of a logical volume or physical disk that has been copied bitfor-bit so that it includes all data and metadata

Front 13

ISO image

Back 13

ISO images are exact copies or images of data CDs or data DVDs.

Front 14

Live imaging

Back 14

When a disk cannot be removed from a running system and its contentsacquired during normal operation, the contents of the disk may change during or after thelive-imaging process because the disk will not likely be mounted read-only

Front 15

Logical volume

Back 15

A partition that has been formatted with a file system makes up alogical volume.

Front 16

MBR - Master Boot Record

Back 16

The first sector of a physical disk contains the MBR. TheMBR identifies up to four partitions on a disk by giving the starting location, length ofpartition and the file system type it contains.

Front 17

Memory Image File

Back 17

A file containing an exact copy of a computer’s physical memory.Since the contents of memory are volatile and not static, a memory image is like asnapshot from a specific point in time.

Front 18

Metadata-

Back 18

Metadata is data describing other data. For example, the metadata in aMicrosoft WORD document will contain the filename, the size of the file, permissionsassociated with the file etc. This is not data that is visible within the document. It is dataabout the document.

Front 19

What is the difference between an image and a clone?:

Back 19

An image is a duplicate of a physical drive that is written to a file. A clone is a bit for bit copy of a physical dirve directly on to another disk. (Think of E01 Files as images and Device(Clone) option in Paladin as Clone).