MSAB Digital Forensics Glossary
Key Terms and Definitions
Welcome to Our Digital Forensics Glossary — A resource for clear, concise definitions of key terms used in digital forensic investigations. This glossary includes terminology used in the field of smartphone investigations, mobile data extraction, and the analysis of digital evidence from mobile devices.
As mobile phones become central to cybercrime and digital investigations, it’s essential to understand critical concepts such as IMEI, mobile data acquisition, app artifacts, and SIM card analysis. You’ll also find definitions of broader digital forensics terms like hash values, metadata, and chain of custody — all explained in a straightforward, accessible format. Whether you’re a mobile forensics specialist, law enforcement officer, cybersecurity professional, or student, this glossary offers up-to-date explanations to help you navigate the rapidly evolving field of mobile forensics.
WAN (Wide Area Network)
A geographically dispersed network (e.g., the internet), analyzed in forensics to trace data across regions or investigate remote attacks.
Read full termWannaCry
A infamous ransomware strain exploiting Windows vulnerabilities, studied in forensics to trace its spread, decrypt files, or track cryptocurrency payments.
Read full termWar Driving
The act of scanning for unsecured Wi-Fi networks while mobile, investigated in forensics to detect unauthorized access points or network intrusions.
Read full termWatch Lists
Databases of known entities (e.g., suspects, malware hashes) used in forensics to flag matches in evidence, enhancing identification of threats or persons of interest.
Read full termWearable Device Forensics
Wearable device forensics is an emerging subdiscipline of digital forensics that focuses on the acquisition, analysis, and preservation of data from wearable devices, such as smartwatches, fitness trackers, and smart glasses. As wearable devices become increasingly popular and sophisticated, they can hold valuable data that may be relevant to criminal investigations, civil cases, and corporate […]
Read full termWeb Bookmarks
User-saved links to websites stored in browsers, extracted in forensics to reveal interests, frequented sites, or evidence of illicit online activity.
Read full termWeb Cache
Temporary storage of web content (e.g., images, pages), recovered in forensics to reconstruct browsing activity or retrieve deleted online evidence.
Read full termWeb Forensics
The investigation of web-based activity (e.g., browsing, server logs), focusing on recovering evidence from browsers, cloud services, or online interactions.
Read full termWeb History
A record of visited websites stored in a browser, analyzed in forensics to establish timelines, uncover user behavior, or link to criminal online actions.
Read full termWeb Proxy
An intermediary server rerouting web traffic, examined in forensics to trace true IP origins or bypass anonymity attempts in cyber investigations.
Read full termWhitelist
A list of approved entities (e.g., apps, IPs), reviewed in forensics to detect deviations or unauthorized activity outside permitted parameters.
Read full termWi-Fi Forensics
The analysis of wireless network data (e.g., SSIDs, connection logs), used to track device locations, identify networks used, or detect unauthorized access.
Read full termWindows Event Logs
System-generated records of activities (e.g., logins, errors), parsed in forensics to reconstruct events, detect intrusions, or verify user actions.
Read full termWindows Registry
A hierarchical database of Windows settings and configurations, mined in forensics for evidence of software use, system changes, or hidden data.
Read full termWipe
The intentional erasure of data from a device, investigated in forensics to determine intent, recover remnants, or assess anti-forensic techniques.
Read full termWireframe
A basic design structure (e.g., of an app or website), occasionally analyzed in forensics to understand user interfaces or reconstruct digital environments.
Read full termWireless Access Point (WAP)
A device enabling Wi-Fi connectivity, examined in forensics to map network usage, identify connected devices, or trace local communications.
Read full termWireshark
A popular network protocol analyzer, used in forensics to capture and dissect packet data, revealing communication details or malicious traffic.
Read full termWorkflow
The MSAB Workflow, designed for frontline so the MSAB Kiosk, MSAB Tablet and XRY Express can be used whilst aligning to your standard operating procedures.
Read full termWorm
Self-replicating malware spreading across networks, analyzed in forensics to trace its propagation, payload, or infection source.
Read full termWrite Blocker
A hardware or software tool preventing modifications to a storage device during forensic imaging, ensuring evidence integrity by blocking write operations.
Read full term