MSAB Digital Forensics Glossary
Key Terms and Definitions
Welcome to Our Digital Forensics Glossary — A resource for clear, concise definitions of key terms used in digital forensic investigations. This glossary includes terminology used in the field of smartphone investigations, mobile data extraction, and the analysis of digital evidence from mobile devices.
As mobile phones become central to cybercrime and digital investigations, it’s essential to understand critical concepts such as IMEI, mobile data acquisition, app artifacts, and SIM card analysis. You’ll also find definitions of broader digital forensics terms like hash values, metadata, and chain of custody — all explained in a straightforward, accessible format. Whether you’re a mobile forensics specialist, law enforcement officer, cybersecurity professional, or student, this glossary offers up-to-date explanations to help you navigate the rapidly evolving field of mobile forensics.
Gateway
A network device that connects different networks (e.g., a router), analyzed in forensics to trace data flow or identify points of intrusion in network-based investigations.
Read full termGDPR (General Data Protection Regulation)
The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union (EU) in May 2018. GDPR sets strict requirements for the collection, processing, and storage of personal data belonging to EU citizens. As mobile devices contain a wealth of personal information, GDPR has significant implications for mobile forensic investigations. […]
Read full termGeodistance – Digital Forensics
The calculated distance between two points defined by geographical coordinates (e.g., latitude and longitude), used in forensics to analyze location data from devices or networks.
Read full termGeofencing
A virtual perimeter based on geographic coordinates, relevant in forensics for analyzing location-based triggers or tracking device movements within defined areas.
Read full termGeolocation
The identification of a device’s physical location using data such as GPS, IP addresses, or Wi-Fi signals, a key forensic technique for tracking suspects or reconstructing events.
Read full termGeotagging
The process of embedding geographical metadata (e.g., coordinates) into digital files like photos or videos, examined in forensics to establish where evidence was created.
Read full termGibibyte (GiB)
A unit of digital storage equal to 2^30 bytes (approximately 1.07 billion bytes), used in forensics to quantify data sizes on modern storage devices.
Read full termGlobal Unique Identifier (GUID)
A unique 128-bit identifier used in software and systems, analyzed in forensics to link devices, files, or activities to specific users or events.
Read full termGPS – Mobile Device Forensics
The Global Positioning System, a satellite-based navigation system, providing location data on mobile devices, extracted in forensics to track movements or establish alibis.
Read full termGPU – Digital Forensics
The Graphics Processing Unit, a specialized processor that accelerates tasks like password cracking or data analysis in forensic investigations due to its parallel processing power.
Read full termGray Hat Hacker
An individual who hacks systems without clear malicious intent, sometimes crossing ethical lines, whose actions may be investigated in forensics to determine legality or impact.
Read full termGraymail
Legitimate but unwanted bulk email (e.g., marketing), distinguished from spam in forensics to avoid misidentifying communication intent during email analysis.
Read full termGreynet
Unauthorized applications or networks operating within a legitimate system (e.g., peer-to-peer tools), analyzed in forensics to detect security breaches or data leaks.
Read full termGrid Computing
A distributed computing approach using multiple systems to process large datasets, sometimes employed in forensics for tasks like hash cracking or data reconstruction.
Read full termGroup Policy
A feature in Windows environments for managing user and system settings, examined in forensics to uncover administrative actions, security configurations, or evidence of tampering.
Read full termGSM – Mobile Device Forensics
The Global System for Mobile Communications, a standard for cellular networks, analyzed in forensics to extract call logs, texts, or tower data from mobile devices.
Read full termGuest Account
A limited-access user account on a system, investigated in forensics to determine if it was used to obscure unauthorized activity or bypass primary user restrictions.
Read full termGUI (Graphical User Interface)
The visual interface of a system or forensic tool, facilitating user interaction during evidence analysis and reporting.
Read full termGunshot Residue (Digital Analogy)
A metaphorical term for subtle digital traces left by an event (e.g., metadata, log entries), sought in forensics to link actions to perpetrators, akin to physical forensic evidence.
Read full termGzip
A file compression format (.gz) encountered in forensics, requiring decompression to access and analyze archived data or logs stored on devices or servers.
Read full term