Chapter 1Vocabulary terms - Computer Forensics
• Chain-of-custody – The route the evidence takes from initial possession until final disposition. It is also called the chain-of-evidence.
• Circumstantial evidence – Indirect evidence, usually a theory, that is supported by a significant quantity of corroborating evidence.
• Computer forensic science – The science of acquiring, preserving, retrieving, and presenting data that has been processed electronically and stored on computer media.
• Computer forensics – Those activities associated with the identification and preservation of computer or electronic evidence in support of some official or legal action.
• Data – Raw facts that can be processed by some computing device into accurate and relevant information.
• Disaster recovery plan – Outlines the procedures for an organization to return to normal operations following a disaster or incident.
• Electronic evidence – Data and information of some investigative value that is stored on or transmitted by an electronic device.
• Forensics – Formally defined as a study or practice relating to legal proceedings or augmentation.
• Hardware – Described as the physical equipment, media, and attached devices used in a computer system. This includes the computer, printers, and communication devices.
• Hearsay evidence – Consists of statements made out of court by someone who is not present to testify under oath at a trial.
• Latent – Is present or has potential, but is not evident or active.
• Information – Processed data that enhance the recipient’s knowledge. Raw facts, called data, are transformed into something meaningful and useful.
• Physical evidence – Evidence that does not forget and is not confused by the excitement of the moment.
• Policies – Plans or courses of actions designed by organizations, both governmental and private, to influence and determine decisions and actions for a particular situation.
• Proactive policies – Established expected behavior in anticipation of an incident.
• Reactive policies – Response after an incident occurs, and is therefore too late to impact a situation.
• Repeatability – Under repeatability conditions, independent test results are obtained with the same method, on identical test items, in the same laboratory, by the same operator, using the same equipment, within short intervals of time.
• Reproducibility – Under reproducibility conditions. Test results are obtained with the same method, on identical test items, in different laboratories, with different operators, using different equipment.
• Software – Instructional coding that manipulates the hardware in a computer system.