MSAB Digital Forensics Glossary
Key Terms and Definitions
Welcome to Our Digital Forensics Glossary — A resource for clear, concise definitions of key terms used in digital forensic investigations. This glossary includes terminology used in the field of smartphone investigations, mobile data extraction, and the analysis of digital evidence from mobile devices.
As mobile phones become central to cybercrime and digital investigations, it’s essential to understand critical concepts such as IMEI, mobile data acquisition, app artifacts, and SIM card analysis. You’ll also find definitions of broader digital forensics terms like hash values, metadata, and chain of custody — all explained in a straightforward, accessible format. Whether you’re a mobile forensics specialist, law enforcement officer, cybersecurity professional, or student, this glossary offers up-to-date explanations to help you navigate the rapidly evolving field of mobile forensics.
Rainbow Table
A precomputed table of hash values used to crack passwords quickly, employed in forensics to recover encrypted credentials or test password strength.
Read full termRAM (Random Access Memory)
Volatile memory storing active data and processes, captured in forensics to extract ephemeral evidence like encryption keys or running applications.
Read full termRAM (Random Access Memory) Acquisition in Mobile Forensics
RAM acquisition is a crucial technique in mobile forensics that involves capturing the volatile memory contents of a device. RAM contains valuable information about the device’s running processes, open files, network connections, and user activity that may not be available through traditional storage media extraction methods. Importance of RAM Acquisition Volatile Data Capture: RAM holds […]
Read full termRansomware
Malicious software that encrypts data and demands payment for decryption, analyzed in forensics to identify the strain, trace payments (e.g., via cryptocurrency), or recover files.
Read full termRaw Data
Unprocessed, unfiltered data extracted from a device (e.g., binary dumps), analyzed in forensics to uncover hidden or low-level evidence before interpretation.
Read full termRead-Only Mode
A forensic setting preventing write operations to a device or image, ensuring evidence integrity during analysis (e.g., using write blockers).
Read full termReal-Time Analysis
The examination of a system or network as events occur, used in forensics to monitor live incidents or capture volatile data before it’s lost.
Read full termRecovery Partition
A dedicated storage section on a device for system restoration, analyzed in forensics to extract data or firmware that may contain evidence.
Read full termRedaction
The process of obscuring sensitive or irrelevant information (e.g., PII) in forensic reports or evidence, ensuring privacy compliance before sharing findings. XAMN Pro supports redaction.
Read full termRegistry
A database in Windows storing system and application settings, parsed in forensics to recover user activity, installed software, or evidence of tampering.
Read full termRemote Access Trojan (RAT)
Malware enabling unauthorized remote control of a system, investigated in forensics to trace its deployment, commands, or data exfiltration paths.
Read full termRemote Data Collection
Refers to the decentralized process of extracting digital evidence from mobile devices at a location separate from a central forensic laboratory—such as a crime scene, patrol vehicle, or satellite office—while maintaining centralized management and oversight to ensure forensic integrity. The Shift to Frontline Forensics Traditionally, digital forensics involved a linear bottleneck: a device was seized, […]
Read full termRemote Forensics
The analysis of devices or data over a network without physical access, used when evidence is geographically distant or in cloud environments.
Read full termReport
A detailed document summarizing forensic findings, methods, and evidence, prepared for legal proceedings, case reviews, or investigative updates.
Read full termReport Builder (Function in XAMN Pro)
A feature in MSAB’s XAMN Pro allowing examiners to customize and generate forensic reports via a simple drag and drop template.
Read full termRepository
A storage location for forensic data (e.g., evidence databases), used to organize, manage, and retrieve case-related information efficiently.
Read full termReverse Engineering
The process of deconstructing software or hardware to understand its function, applied in forensics to analyze malware, firmware, or proprietary systems.
Read full termRoot
The highest privilege level on a system (e.g., superuser in Unix, administrator in Windows), exploited in forensics via rooting techniques to access restricted mobile device data.
Read full termRootkit
Stealthy malware hiding its presence on a system, detected and analyzed in forensics to uncover deep system compromises or persistent threats.
Read full termRouting Table
A network device’s record of data paths, examined in forensics to trace communication flows or identify points of interception in network attacks.
Read full term