MSAB Digital Forensics Glossary
Key Terms and Definitions
Welcome to Our Digital Forensics Glossary — A resource for clear, concise definitions of key terms used in digital forensic investigations. This glossary includes terminology used in the field of smartphone investigations, mobile data extraction, and the analysis of digital evidence from mobile devices.
As mobile phones become central to cybercrime and digital investigations, it’s essential to understand critical concepts such as IMEI, mobile data acquisition, app artifacts, and SIM card analysis. You’ll also find definitions of broader digital forensics terms like hash values, metadata, and chain of custody — all explained in a straightforward, accessible format. Whether you’re a mobile forensics specialist, law enforcement officer, cybersecurity professional, or student, this glossary offers up-to-date explanations to help you navigate the rapidly evolving field of mobile forensics.
P2P Exchange – Crypto Forensics
Peer-to-peer online platforms facilitating direct buying, selling, and trading of cryptocurrencies, analyzed in forensics to trace transactions without intermediaries.
Read full termPacket Capture (PCAP)
The process of recording network traffic (e.g., using Wireshark), examined in forensics to analyze communications, detect malware, or reconstruct cyber incidents.
Read full termPacket Sniffing
The interception of network packets, used in forensics to monitor live traffic or analyze captured data for evidence of unauthorized activity or data exfiltration.
Read full termPagefile
A virtual memory file on a hard drive (e.g., pagefile.sys in Windows), analyzed in forensics to recover swapped-out data from RAM, such as passwords or process artifacts.
Read full termParsing – Mobile Device Forensics
The process of interpreting readable data (after decoding) from a mobile device into structured formats, enabling forensic tools to extract meaningful evidence like messages or logs.
Read full termPartial File-System Extraction – Mobile Device Forensics, Phone Forensics Software
A forensic method using phone software to recover a subset of a mobile device’s file system, targeting specific data (e.g., photos, contacts) rather than a full image.
Read full termPartition
A logical division of a storage device, analyzed in forensics to locate data, recover lost partitions, or identify hidden or encrypted sections.
Read full termPassword Cracking
The process of recovering passwords from encrypted data (e.g., via brute force or dictionary attacks), a common forensic technique to access locked evidence.
Read full termPayload
The core data within a network packet or malware, dissected in forensics to reveal malicious code, stolen information, or communication content.
Read full termPeer-to-Peer (P2P) Network
A decentralized network where devices communicate directly, investigated in forensics to trace file sharing (e.g., torrents) or cryptocurrency transactions.
Read full termPenetration Testing
A simulated attack to identify vulnerabilities, sometimes reviewed in forensics to contextualize breaches or validate evidence of exploitation.
Read full termPersistent Storage
Non-volatile memory (e.g., hard drives, flash) retaining data after power loss, a primary target in forensics for recovering files and system artifacts.
Read full termPersonally Identifiable Information (PII)
Data that can identify an individual (e.g., name, SSN), sought in forensics during data breach investigations or identity theft cases.
Read full termPersons
A function in MSAB XAMN Pro to identify and filter person identities allowing you to filter on a subject easily.
Read full termPhishing
A fraudulent attempt to steal credentials or data via deceptive messages, analyzed in forensics to trace origins, methods, or victim interactions.
Read full termPhoto DNA
A Microsoft-developed technology using hash-based image matching to detect and prevent the spread of illegal content (e.g., child exploitation images) in forensic investigations.
Read full termPhysical Extraction – Mobile Device Forensics
A low-level, bit-by-bit copy of a mobile device’s storage (e.g., flash memory), capturing all data, including deleted files, for comprehensive forensic analysis. Physical extraction is a mobile forensic technique that involves acquiring a bit-for-bit copy of a device’s entire storage media, including allocated and unallocated space. This low-level extraction method allows forensic examiners to recover […]
Read full termPlausible Deniability
The ability to deny involvement in an action due to lack of direct evidence, a challenge in forensics countered by correlating indirect digital traces.
Read full termPlist (Property List)
A file format used by Apple devices (e.g., .plist), parsed in forensics to extract configuration data, app settings, or user preferences from iOS/macOS systems.
Read full termPort Scanning
A technique to identify open ports on a system, analyzed in forensics to detect reconnaissance attempts or map attack surfaces in network incidents.
Read full termPost-Mortem Analysis
The forensic examination of a system after an incident (e.g., breach, crash) to determine causes, impacts, and evidence, typically using disk images or logs.
Read full termPrefetch Files
Windows files (e.g., .pf) storing data about executed programs, analyzed in forensics to establish application usage timelines or detect malicious activity.
Read full termPrivate Key
A cryptographic key kept secret, used in forensics to decrypt data or verify digital signatures when recovered from a device or suspect.
Read full termProcess Explorer
A tool (e.g., Sysinternals) for viewing active processes, used in live forensics to identify running malware or suspicious activity on a system.
Read full termProject VIC
Project VIC is an international initiative designed to help identify and rescue victims of child sexual abuse by enabling the efficient categorization and sharing of known CSAM (Child Sexual Abuse Material). Created in collaboration with law enforcement agencies and NGOs, Project VIC uses standardized hash sets and metadata to support victim identification and reduce investigator […]
Read full termProtocol Analysis
The examination of network protocol behavior (e.g., TCP, HTTP), conducted in forensics to interpret traffic, detect anomalies, or extract communication evidence.
Read full termProxy Server
An intermediary server masking a user’s IP, investigated in forensics to trace true origins of traffic or bypass anonymity attempts in cybercrimes.
Read full termPython
A programming language used in forensics for scripting custom tools, automating analysis (e.g., parsing logs), or integrating with tools like MSAB XRY.
Read full term