Guide to Computer Forensics and Investigations

Flashcards covering key concepts, vocabulary, and principles related to computer forensics and digital evidence processing.

Digital Evidence

Any information stored or transmitted in digital form that U.S. courts accept as physical evidence.

Evidence Collection

Systematically collecting, preserving, and documenting evidence at private-sector or crime scenes.

Best Evidence Rule

To prove the content of a document, the original document is ordinarily required.

Plain View Doctrine

Allows for the seizure of objects falling in plain view by an officer with legal right to be in that position.

Probable Cause

Standard needed for law enforcement to obtain a search warrant.

Business-Record Exception

Permits the introduction of records of regularly conducted activity as evidence in court.

Cyclic Redundancy Check (CRC)

A mathematical algorithm to determine if a file's contents have changed.

Message Digest 5 (MD5)

A hashing algorithm that generates a unique hexadecimal code value for files.

Hearsay

Secondhand or indirect evidence that is generally inadmissible in court.

Evidence Retention

Procedures to maintain and secure evidence for varying durations as required by law.

Digital Hash

A unique number generated to verify the integrity of a digital file or drive.

Data Acquisition

The process of collecting digital evidence from computer systems during an investigation.

Forensic Examination

A systematic process to uncover digital evidence and understand the context of the crime.

Chain of Custody

The process of maintaining and documenting evidence authenticity from collection to presentation in court.

Fourth Amendment

Part of the U.S. Constitution that protects against unreasonable searches and seizures.

RAID Systems

Redundant Array of Independent Disks, a data storage technology for data redundancy.

Covert Surveillance

Monitoring activities without knowledge of the subject, typically under strict corporate policy.