Glossary - MSAB

MSAB Digital Forensics Glossary

Key Terms and Definitions

Welcome to Our Digital Forensics Glossary — A resource for clear, concise definitions of key terms used in digital forensic investigations. This glossary includes terminology used in the field of smartphone investigations, mobile data extraction, and the analysis of digital evidence from mobile devices.

As mobile phones become central to cybercrime and digital investigations, it’s essential to understand critical concepts such as IMEI, mobile data acquisition, app artifacts, and SIM card analysis. You’ll also find definitions of broader digital forensics terms like hash values, metadata, and chain of custody — all explained in a straightforward, accessible format. Whether you’re a mobile forensics specialist, law enforcement officer, cybersecurity professional, or student, this glossary offers up-to-date explanations to help you navigate the rapidly evolving field of mobile forensics.

A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z

Access Service

MSAB digital forensic experts use advanced forensically sound techniques to recover and decrypt the data from […]

ACPO (Association of Chief of Police)

ACPO Guidelines for computer-based evidence, these are a set of guidelines followed by forensic examiners acro […]

Acquisition

The process of collecting digital evidence from devices, often by creating a forensically sound copy or image.

Active Data

Information on a storage device that is readily accessible to the operating system (as opposed to deleted or h […]

ADS (Alternate Data Streams)

ADS – A feature of the NTFS file system that allows a single file to contain multiple data streams. These seco […]

Adware

Malicious or unwanted software that automatically displays advertisements and is often bundled with free progr […]

AES (Advanced Encryption Standard)

A widely used symmetric encryption algorithm that encrypts data in fixed block sizes with a secret key.

After First Unlock (AFU)

AFU: after first unlock, means the device is locked, but it has been unlocked since it booted up at least once […]

Allocated Space

Allocated Space is the area on a device’s memory that stores data in an organized manner and contains its oper […]

Android Backup

An Android backup refers to the copy of data from a mobile Android device that investigators can use to analyz […]

Android Forensics

Android applications store data in various formats, such as SQLite databases, XML files, and SharedPreferences […]

Anti-Forensics

Techniques used by perpetrators to obstruct forensic analysis (e.g., data wiping, encryption, or altering meta […]

APFS (Apple File System)

APFS, or Apple File System, is a proprietary file system developed by Apple Inc. for macOS, iOS, iPadOS, watch […]

API (Application Programming Interface)

In the context of mobile forensics, an API (Application Programming Interface) refers to a set of protocols, r […]

APK (Android Package Kit)

The Android package with the file extension apk is the file format used by the Android Operating System and se […]

Apple Account

User accounts are used to access all Apple services and devices, including the App Store, iCloud, iMessage, Fa […]

APT (Advanced Persistent Threat)

A stealthy, sophisticated cyber-attack where an unauthorized user gains prolonged access to a network, often s […]

Artifact (Digital Artifact)

Any file, metadata, or residue that is evidence of digital activity (e.g., logs, registry keys, link files).

Asymmetric Encryption

An encryption method using a pair of keys – a public key for encryption and a private key for decryption (also […]

Attribution

In a forensic context, attribution is the process of linking digital evidence or actions to a specific individ […]

Audio File Forensics

Audio file forensics is a specialized branch of digital forensics that deals with the analysis, authentication […]

Audit Trail

A chronological record of system or user activities. Audit trails log events like logins, file access, changes […]

Autopsy

An open-source digital forensics platform (graphical interface for The Sleuth Kit) used to analyze disks, smar […]

This website uses cookies

Cookies ("cookies") consist of small text files. The text files contain data which is stored on your device. To be able to place some type of cookies we need your consent. We at MSAB, corporate identity number 556244-3050 use these types of cookies. To read more about which cookies we use and storage duration, click here to get to our cookiepolicy.

Manage your cookie-settings

Necessary cookies

Necessary cookies are cookies that need to be placed for fundamental functions on the website to work. Fundamental functions are for instance cookies that are needed for you to use menus and navigate the website.

Functional cookies

Functional cookies need to be placed for the website to perform in the way that you expect. For instance to remember which language you prefer, to know if you are logged in, to keep the website secure, remember login credentials or to enable sorting of products on the website in the way that you prefer.

Statistical cookies

To know how you interact with the website we place cookies to collect statistics. These cookies anonymize personal data.

Personalization cookies

In order to provide a better experiance we place cookies for your preferances

Ad measurement cookies

To be able to provide a better service and experience we place cookies to tailor marketing for you. Another purpose for this placement is to market products or services to you, give tailored offers or market and give recommendations on new concepts based on what you have bought from us previously.

Ad measurement user cookies

In order to show relevant ads we place cookies to tailor ads for you

Personalized ads cookies

To show relevant and personal ads we place cookies to provide unique offers that are tailored to your user data