MSAB Digital Forensics Glossary
Key Terms and Definitions
Welcome to Our Digital Forensics Glossary — A resource for clear, concise definitions of key terms used in digital forensic investigations. This glossary includes terminology used in the field of smartphone investigations, mobile data extraction, and the analysis of digital evidence from mobile devices.
As mobile phones become central to cybercrime and digital investigations, it’s essential to understand critical concepts such as IMEI, mobile data acquisition, app artifacts, and SIM card analysis. You’ll also find definitions of broader digital forensics terms like hash values, metadata, and chain of custody — all explained in a straightforward, accessible format. Whether you’re a mobile forensics specialist, law enforcement officer, cybersecurity professional, or student, this glossary offers up-to-date explanations to help you navigate the rapidly evolving field of mobile forensics.
Namespace
A logical grouping of identifiers in a system (e.g., file names, registry keys), analyzed in forensics to resolve naming conflicts or trace data origins.
Read full termNative File
A file in its original format as created by an application, examined in forensics to ensure authenticity or recover embedded metadata without conversion artifacts.
Read full termNetBIOS
A legacy networking protocol providing name resolution, analyzed in forensics to investigate local network activity or identify devices in Windows environments.
Read full termNetwork Address Translation (NAT)
A technique mapping private IP addresses to public ones, complicating forensic tracing of network traffic but analyzed via router logs to identify endpoints.
Read full termNetwork Forensics
The investigation of network traffic and logs to uncover evidence of cybercrimes, intrusions, or data exfiltration, often using packet captures and protocol analysis.
Read full termNetwork Interface Card (NIC)
Hardware enabling network connectivity, identified in forensics via its MAC address to link a device to network activity or incidents.
Read full termNetwork Intrusion Detection System (NIDS)
A tool monitoring network traffic for suspicious activity, analyzed in forensics to validate alerts or reconstruct attack timelines from captured data.
Read full termNetwork Packet
A unit of data transmitted over a network, captured and dissected in forensics (e.g., via Wireshark) to reveal communication details or malicious payloads.
Read full termNetwork Protocol
A set of rules governing data communication (e.g., TCP/IP, HTTP), studied in forensics to interpret traffic patterns or detect protocol misuse in attacks.
Read full termNetwork Scanner
A tool identifying active devices or vulnerabilities on a network, used in forensics to recreate an attacker’s reconnaissance or assess system exposure.
Read full termNetwork Time Protocol (NTP)
A protocol synchronizing system clocks over a network, examined in forensics to verify timestamps on logs or evidence for accurate event sequencing.
Read full termNFC (Near Field Communication) Forensics
NFC (Near Field Communication) is a short-range wireless communication technology that allows data exchange between devices in close proximity, typically less than 10 centimeters. NFC is commonly used in mobile devices for contactless payments, data sharing, and access control. NFC forensics involves the acquisition and analysis of data related to NFC transactions and interactions. Applications […]
Read full termNode
A device or point in a network (e.g., computer, router), traced in forensics to map communication paths or identify sources of activity.
Read full termNon-Repudiation
The assurance that an action (e.g., sending a message) cannot be denied, supported in forensics through digital signatures or logs proving user activity.
Read full termNon-Volatile Memory
Storage retaining data without power (e.g., flash, hard drives), analyzed in forensics to recover persistent evidence like files or system configurations.
Read full termNormalization
The process of standardizing data formats in forensics (e.g., timestamps, encodings) to enable consistent analysis across diverse sources.
Read full termNTFS (New Technology File System)
A Windows file system with features like journaling and encryption, analyzed in forensics to recover files, metadata, or alternate data streams.
Read full termNull Byte
A zero-value byte (0x00) used in programming or file structures, inspected in forensics to detect hidden data or anomalies in file contents.
Read full term