MSAB Digital Forensics Glossary
Key Terms and Definitions
Welcome to Our Digital Forensics Glossary — A resource for clear, concise definitions of key terms used in digital forensic investigations. This glossary includes terminology used in the field of smartphone investigations, mobile data extraction, and the analysis of digital evidence from mobile devices.
As mobile phones become central to cybercrime and digital investigations, it’s essential to understand critical concepts such as IMEI, mobile data acquisition, app artifacts, and SIM card analysis. You’ll also find definitions of broader digital forensics terms like hash values, metadata, and chain of custody — all explained in a straightforward, accessible format. Whether you’re a mobile forensics specialist, law enforcement officer, cybersecurity professional, or student, this glossary offers up-to-date explanations to help you navigate the rapidly evolving field of mobile forensics.
WAN (Wide Area Network)
A geographically dispersed network (e.g., the internet), analyzed in forensics to trace data across regions or investigate remote attacks.
Read full termWannaCry
A infamous ransomware strain exploiting Windows vulnerabilities, studied in forensics to trace its spread, decrypt files, or track cryptocurrency payments.
Read full termWar Driving
The act of scanning for unsecured Wi-Fi networks while mobile, investigated in forensics to detect unauthorized access points or network intrusions.
Read full termWeb History
A record of visited websites stored in a browser, analyzed in forensics to establish timelines, uncover user behavior, or link to criminal online actions.
Read full termWeb Proxy
An intermediary server rerouting web traffic, examined in forensics to trace true IP origins or bypass anonymity attempts in cyber investigations.
Read full termWhitelist
Eine Liste genehmigter Entitäten (z. B. Apps, IPs), die in der forensischen Analyse überprüft wurden, um Abweichungen oder unautorisierte Aktivitäten außerhalb der erlaubten Parameter zu erkennen.
Read full termWi-Fi Forensics
Die Analyse von Daten aus drahtlosen Netzwerken (z. B. SSIDs, Verbindungsprotokolle), die verwendet wird, um Geräte-Standorte zu verfolgen, genutzte Netzwerke zu identifizieren oder unbefugten Zugriff zu erkennen.
Read full termWindows Event Logs
System-generated records of activities (e.g., logins, errors), parsed in forensics to reconstruct events, detect intrusions, or verify user actions.
Read full termWindows Registry
Un database gerarchico delle impostazioni e configurazioni di Windows, estratto nelle indagini forensi per evidenze di utilizzo di software, modifiche di sistema o dati nascosti.
Read full termWipe
The intentional erasure of data from a device, investigated in forensics to determine intent, recover remnants, or assess anti-forensic techniques.
Read full termWireframe
A basic design structure (e.g., of an app or website), occasionally analyzed in forensics to understand user interfaces or reconstruct digital environments.
Read full termWireless Access Point (WAP)
A device enabling Wi-Fi connectivity, examined in forensics to map network usage, identify connected devices, or trace local communications.
Read full termWireshark
A popular network protocol analyzer, used in forensics to capture and dissect packet data, revealing communication details or malicious traffic.
Read full termWorkflow
The MSAB Workflow, designed for frontline so the MSAB Kiosk, MSAB Tablet and XRY Express can be used whilst aligning to your standard operating procedures.
Read full termWorm
Self-replicating malware spreading across networks, analyzed in forensics to trace its propagation, payload, or infection source.
Read full termWrite Blocker
A hardware or software tool preventing modifications to a storage device during forensic imaging, ensuring evidence integrity by blocking write operations.
Read full term