Glossary

Plain-language definitions of SEO terms used across the blog.

AD1 (AccessData logical image)

FTK Imager's logical evidence container: a file-and-folder tree stored as zlib-compressed items, not a bit-for-bit copy of a disk.

Alternate Data Stream (ADS)

A second named $DATA stream attached to an NTFS file. Invisible in a normal directory listing, which is exactly why it gets abused and overlooked.

Data carving

Recovering files from raw bytes by their signatures, with no filesystem metadata to rely on. The fallback when the directory entry is gone.

E01 / EWF (Expert Witness Format)

The segmented, compressed forensic image format produced by EnCase and FTK Imager, with per-chunk compression and acquisition hashes embedded in the file.

File slack

The gap between a file's logical end and the end of its last allocated cluster. It often retains fragments of whatever occupied that cluster before.

Hash verification

Recomputing an image's MD5/SHA-1 and comparing it to the hash recorded at acquisition, to prove the evidence has not changed since it was captured.

$MFT (Master File Table)

The NTFS index where every file and directory has a record. Read it and you have the volume's entire structure, including entries marked deleted.

Raw (dd) image

A bit-for-bit copy of a disk with no header and no metadata, just the sectors in order. The lowest common denominator of disk imaging.

Unallocated space

Clusters or blocks a filesystem is not currently using. Often still holds the contents of deleted files, which makes it the primary surface for carving.

Write blocker

Hardware or software that lets you read evidence media without writing to it, so acquisition does not alter the original and break the hash.