DFIR glossary

Acquisition is collecting evidence from a device or service in a form that can be examined and checked later. Record what was collected, how the tool accessed it, and what was excluded. An acquisition may be a complete disk image, selected files, memory, or a service export; these are not interchangeable.

See also: forensic image.

Taught in: Windows Forensic Examiner, module 01: Acquire without changing anything.

Amcache is a Windows application compatibility data store that can preserve information about programs and files. Examiners use it to identify software and investigate paths, metadata and related activity. Its records vary by Windows version and collection context. An Amcache entry alone should not be treated as proof that a particular user executed a program.

See also: execution evidence.

Taught in: Windows Forensic Examiner, module 03: What did they run, and when.

Anti-forensics describes actions intended to obstruct evidence collection or interpretation, such as deleting logs, changing timestamps or hiding files. Similar traces can also result from ordinary maintenance. Explain the observable behavior before assigning intent, and seek independent records that survive the attempted removal or alteration.

See also: log clearing.

Taught in: Incident Response and Threat Hunting, module 10: Anti-forensics and what survives.

An artifact is a trace left by a system, application or user activity that may help answer an investigative question. Examples include a database row, event record, shortcut or file-system entry. Its meaning depends on how it was created, retained and collected, not simply on which tool displayed it.

See also: user activity artifacts.

Taught in: Windows Forensic Examiner, module 02: Who is this user, on this machine.

Attribution connects an observed action to an account, process, device or person. Those are different levels of claim: identifying an account does not establish who controlled it at the time. State which level the evidence supports, consider shared access or stolen credentials, and explain plausible alternatives.

See also: user activity artifacts.

Taught in: Windows Forensic Examiner, module 09: The contested logon.

Browser history records browsing-related activity retained by a browser, often in databases alongside downloads and visit metadata. It can help reconstruct access to pages, but background requests, synchronization and shared profiles complicate interpretation. A recorded visit does not by itself prove that a particular person read or understood the page.

See also: cloud sync artifacts.

Taught in: Windows Forensic Examiner, module 07: The browser tells it.

Carving recovers possible file content by recognizing signatures or internal structure rather than relying on intact directory records. It can find data after deletion, but fragmentation may prevent complete reconstruction. A carved result may lack its original filename, location or reliable timestamps, so distinguish recovered content from reconstructed context.

See also: master file table.

Taught in: Windows Forensic Examiner, module 10: Deleted, recovered, proven.

Chain of custody is the documented history of evidence possession and handling. It records who collected, transferred, stored or accessed an item, when that happened and why. It complements technical integrity checks but is not replaced by them: a matching hash cannot explain an undocumented transfer or establish collection authority.

See also: evidence integrity.

Taught in: Windows Forensic Examiner, module 01: Acquire without changing anything.

Cloud sync artifacts are local databases, configuration files, logs and cached content created by software that synchronizes data with a remote service. They can show account relationships and transfer-related events. Local records do not necessarily establish the current cloud state or prove that a transfer finished successfully.

See also: browser history.

Taught in: Windows Forensic Examiner, module 06: Sync, share, delete.

Containment limits an incident's continuing impact, for example by isolating systems or restricting compromised accounts. It is an operational decision as well as a technical action. Balance the need to stop harm against evidence preservation and business dependencies, and record what changed so later analysis does not mistake response activity for attacker behavior.

See also: scoping.

Taught in: Incident Response and Threat Hunting, module 12: Tell the intrusion story.

Data staging is gathering or packaging information in preparation for movement or use. An attacker might collect documents into an archive or shared directory before sending them elsewhere. The presence of a staged archive supports a claim about preparation, not necessarily completed exfiltration; corroborate transfer with network or destination evidence.

See also: exfiltration.

Taught in: Incident Response and Threat Hunting, module 08: NTFS under the hood.

A dead-box examination works from a powered-off device or an acquired storage image rather than the running operating system. It can reduce changes caused by live interaction, but it does not preserve memory and may encounter encrypted storage. Document the original power state and the reasoning behind the collection approach.

See also: live response.

Taught in: Windows Forensic Examiner, module 01: Acquire without changing anything.

DFIR means digital forensics and incident response: related work that preserves and interprets digital evidence while helping an organization understand and respond to incidents. Forensics emphasizes defensible findings; response also addresses ongoing harm and recovery. Rob T. Lee coined the term DFIR. The scope of any particular engagement still needs to be defined.

See also: artifact.

Taught in: Windows Forensic Examiner, module 00: The first hour of a case.

An event log is a structured record of events reported by a system or application. Windows event records can describe logons, services and other activity, depending on configuration and retention. Interpret the provider, event version and fields together; a familiar event number without its context can lead to an incorrect conclusion.

See also: log clearing.

Taught in: Windows Forensic Examiner, module 09: The contested logon.

Evidence integrity is confidence that material remains consistent with what was collected and that relevant changes are understood and documented. Hashes, controlled storage, access records and repeatable acquisition help establish it. Integrity does not establish that the original information was truthful, complete or created by the person under investigation.

See also: hash verification.

Taught in: Windows Forensic Examiner, module 01: Acquire without changing anything.

Execution evidence consists of traces supporting the conclusion that code ran, rather than merely existed on a disk. Different artifacts may describe launch, loading, compatibility processing or user interaction. Correlate them and state their limitations. A filename in a cache is not automatically proof of execution or of the responsible person.

See also: prefetch.

Taught in: Windows Forensic Examiner, module 03: What did they run, and when.

Exfiltration is unauthorized movement of information outside its intended control boundary. Establish what data moved, from where, to where and with what evidence. A large outbound connection or an archive on disk may justify investigation but does not alone prove which contents left, whether the transfer completed or who received them.

See also: data staging.

Taught in: Incident Response and Threat Hunting, module 12: Tell the intrusion story.

A file system timeline arranges file-system metadata events by time to help examine creation, modification, access and related changes. It is a useful starting point for locating an activity window. Timestamp meanings vary, and metadata can be copied or manipulated; the timeline alone cannot explain every action or identify its actor.

See also: super timeline.

Taught in: Incident Response and Threat Hunting, module 06: Build the first timeline.

A forensic image is a captured representation of storage evidence intended for examination and verification. Depending on the acquisition, it may represent an entire device or a narrower logical selection. Record the format and scope, preserve acquisition metadata, and verify integrity rather than assuming that every file called an image contains all original data.

See also: acquisition.

Taught in: Windows Forensic Examiner, module 01: Acquire without changing anything.

Hash verification compares cryptographic digests to check whether the same bytes are present at different times or locations. A matching digest can support integrity of a copy. Specify the algorithm and what was hashed: an evidence-container file and the underlying source media may require different verification procedures and are not automatically comparable.

See also: evidence integrity.

Taught in: Windows Forensic Examiner, module 01: Acquire without changing anything.

An indicator of compromise is an observable value or pattern associated with suspicious or malicious activity, such as a file hash, domain or process behavior. Its usefulness depends on context, specificity and age. An indicator match is a lead to investigate, while a non-match does not prove a system is unaffected.

See also: scoping.

Taught in: Incident Response and Threat Hunting, module 04: Read the memory image: what is hiding.

A jump list is Windows data supporting an application's recent or frequent destinations and tasks. Examiners may find references to files, paths and volumes that help reconstruct interaction. Interpret the application and entry type carefully: a retained destination does not necessarily establish the last time a person opened the referenced file.

See also: link file.

Taught in: Windows Forensic Examiner, module 04: What did they open, and where did it go.

Lateral movement is an intruder's progression between systems or accounts within an environment. It may use legitimate remote administration tools and valid credentials. Reconstruct the source, destination, account and mechanism from multiple records, and distinguish attacker activity from routine administration rather than treating every remote logon as malicious.

See also: remote access artifacts.

Taught in: Incident Response and Threat Hunting, module 05: Scope the enterprise fast.

A Windows link file is a shortcut that can retain a target path and metadata about a referenced file or location. It may survive after the target is moved or deleted. Its embedded timestamps and identifiers describe particular objects and events, not one universal last-opened time; examine those meanings before drawing conclusions.

See also: jump list.

Taught in: Windows Forensic Examiner, module 04: What did they open, and where did it go.

Live response collects information or performs investigative actions on a running system. It can preserve memory, connections and other data unavailable after shutdown, but the response tools also change system state. Record commands, tool versions, timing and likely effects so the investigation can distinguish collection activity from earlier evidence.

See also: order of volatility.

Taught in: Incident Response and Threat Hunting, module 02: Capture memory before it is gone.

Log clearing removes retained event records from a logging system. It can be malicious, administrative or part of maintenance, so the action alone does not establish intent. Look for clearing notifications, forwarding destinations, retention settings and independent artifacts that can explain the gap and preserve parts of the missing sequence.

See also: anti-forensics.

Taught in: Incident Response and Threat Hunting, module 10: Anti-forensics and what survives.

The master file table is the central NTFS structure that stores records describing files and directories. Its attributes can include names, timestamps and references to file content. Deleted or reused records require careful interpretation. An MFT record is metadata about an object, not a complete history of everything done to it.

See also: NTFS.

Taught in: Incident Response and Threat Hunting, module 08: NTFS under the hood.

Memory acquisition captures data from a running system's RAM for later analysis. The system continues changing during collection, so the result may not be a perfectly consistent instant. Record the acquisition tool and time, verify the captured file, and consider collection failures and changes caused by the tool itself.

See also: volatile data.

Taught in: Incident Response and Threat Hunting, module 02: Capture memory before it is gone.

Memory forensics examines captured RAM to reconstruct processes, connections, loaded code and other runtime state. It can reveal evidence absent from disk, but interpretation depends on the operating-system version, capture quality and available symbols. A missing result can reflect collection or parsing limitations rather than the absence of the activity.

See also: process injection.

Taught in: Incident Response and Threat Hunting, module 03: Read the memory image: what is running.

NTFS is a Windows file system whose structures include file records, attributes and journals useful in forensic examination. Those structures can help reconstruct names, storage allocation and changes. They are not a complete audit trail: retention, record reuse and timestamp semantics limit which historical events an examiner can reliably recover.

See also: master file table.

Taught in: Incident Response and Threat Hunting, module 08: NTFS under the hood.

Order of volatility is a way to prioritize collection according to how quickly evidence may change or disappear. Running processes and memory often need attention before persistent storage. It is not a rigid checklist: safety, authority, encryption, ongoing harm and the collection tools' effects may justify a different documented sequence.

See also: memory acquisition.

Taught in: Incident Response and Threat Hunting, module 02: Capture memory before it is gone.

Persistence is a mechanism that lets code or access survive interruption, such as a reboot or account session ending. Services, scheduled tasks and startup settings can provide it, but many are legitimate. Identify the mechanism, creation context and responsible account, then connect it to observed behavior rather than labeling every startup entry malicious.

See also: registry hive.

Taught in: Incident Response and Threat Hunting, module 09: Execution, persistence and the account behind it.

Prefetch is Windows performance data that may retain information associated with application launches, including referenced files and execution-related metadata. Availability and interpretation vary by system configuration and version. It can support an execution hypothesis, but should be correlated with other artifacts and does not by itself identify the person responsible.

See also: execution evidence.

Taught in: Windows Forensic Examiner, module 03: What did they run, and when.

Process injection places code into another process's address space or redirects its execution. Attackers use it to conceal activity or operate in a useful security context, although some legitimate software uses related techniques. Suspicious memory regions require corroboration through permissions, content, execution context and other evidence; a scanner label is not a conclusion.

See also: memory forensics.

Taught in: Incident Response and Threat Hunting, module 04: Read the memory image: what is hiding.

A registry hive is a stored collection of Windows configuration keys and values, with metadata and supporting logs. Hives can describe users, devices, software and persistence settings. Key last-write times do not provide a separate timestamp for every value change, so explain exactly which object and operation a reported time represents.

See also: persistence.

Taught in: Windows Forensic Examiner, module 02: Who is this user, on this machine.

Remote access artifacts are records left when a system is accessed or controlled from elsewhere, such as logon events, client history or remote-execution traces. They help connect accounts and hosts. Different protocols leave different evidence, and legitimate administration may resemble intrusion, so reconstruct the context before claiming unauthorized access.

See also: lateral movement.

Taught in: Incident Response and Threat Hunting, module 05: Scope the enterprise fast.

Scoping determines which systems, accounts and information may be involved in an incident. Start with known evidence, develop testable leads and expand collection deliberately. Maintain both confirmed findings and unresolved coverage gaps; the number of systems that matched a particular indicator is not necessarily the full extent of compromise.

See also: indicator of compromise.

Taught in: Incident Response and Threat Hunting, module 05: Scope the enterprise fast.

A shadow copy is a point-in-time view of a storage volume made available through Windows snapshot mechanisms. It can preserve earlier versions of data useful to an examination. It is not necessarily a full independent backup, and its availability depends on retention and storage behavior; record which snapshot supplied each recovered item.

See also: volume shadow copy.

Taught in: Windows Forensic Examiner, module 01: Acquire without changing anything.

A shellbag is Windows shell data used to retain folder-view information. It may reference directories on local, removable or network locations, including paths no longer present. Its interpretation depends on shell behavior and version. A folder reference can support an interaction hypothesis but does not prove that every file inside was opened.

See also: user activity artifacts.

Taught in: Windows Forensic Examiner, module 04: What did they open, and where did it go.

Shimcache, also called the application compatibility cache, stores Windows compatibility-related file information. Examiners use its entries as leads about files and possible activity, with interpretation dependent on the Windows version. Presence in the cache is not a universal execution indicator; explain entry semantics and corroborate the hypothesis with independent evidence.

See also: Amcache.

Taught in: Windows Forensic Examiner, module 03: What did they run, and when.

A super timeline combines time-related events from multiple artifact families, such as file-system metadata, event logs, registry data and browser records. It supports cross-source reconstruction but also contains duplication, unrelated activity and differing timestamp meanings. Preserve source labels and filter by an investigative question rather than treating the combined order as ground truth.

See also: file system timeline.

Taught in: Incident Response and Threat Hunting, module 07: The super timeline, and how to read it.

Threat hunting is a deliberate search for potentially malicious activity that existing alerts have not adequately explained. A useful hunt begins with a hypothesis and specifies the evidence that would support or weaken it. Document collection coverage and normal behavior so an unusual result can be investigated rather than automatically called an attack.

See also: scoping.

Taught in: Incident Response and Threat Hunting, module 11: Hunt the next host.

Timeline analysis reconstructs activity by comparing events and timestamps from relevant evidence sources. The aim is to answer a question about sequence and context, not merely sort rows. Account for clock differences and timestamp meanings, corroborate important events, and distinguish what the evidence shows from the story that seems plausible.

See also: super timeline.

Taught in: Incident Response and Threat Hunting, module 06: Build the first timeline.

Read the timeline-analysis explainer.

Timestomping is deliberate alteration of file timestamps to mislead analysis or blend files into an expected time range. Unexpected times can also arise from copying, restoration or software behavior. Compare multiple timestamp fields and independent artifacts, and explain why intentional manipulation is a better explanation before asserting that it occurred.

See also: anti-forensics.

Taught in: Incident Response and Threat Hunting, module 08: NTFS under the hood.

Triage collection gathers a selected set of evidence to answer urgent questions without immediately acquiring everything. It can accelerate assessment across many systems, but selection creates blind spots. Document the collection profile, failures and excluded sources, then obtain fuller evidence where the initial findings or unanswered questions justify it.

See also: scoping.

Taught in: Windows Forensic Examiner, module 11: Triage at speed.

User activity artifacts are traces associated with interaction in a user environment, including recent items, shortcuts, browser stores and application records. They can connect files and actions to a profile. A profile is not a person: shared accounts, remote access, automation and synchronization all need consideration before assigning human responsibility.

See also: attribution.

Taught in: Windows Forensic Examiner, module 04: What did they open, and where did it go.

The USN journal records change notifications for files and directories on an NTFS volume. It can help reconstruct names and change-related activity after other evidence disappears. Records are retained only for a limited history and do not contain full file contents or every user action, so interpret reason flags in context.

See also: master file table.

Taught in: Incident Response and Threat Hunting, module 08: NTFS under the hood.

Volatile data is information likely to change quickly or disappear when a system stops running, such as memory contents and current connections. Its preservation may require live collection. Explain the conditions and timing of capture because a volatile snapshot does not represent every earlier state or necessarily a single consistent moment.

See also: order of volatility.

Taught in: Incident Response and Threat Hunting, module 02: Capture memory before it is gone.

A volume shadow copy is a Windows volume snapshot coordinated through the Volume Shadow Copy Service. It may expose earlier file or metadata states that can be compared with current evidence. Collection and examination must account for snapshot dependencies, retention and deletion; the snapshot's time is not the creation time of every file it contains.

See also: shadow copy.

Taught in: Windows Forensic Examiner, module 01: Acquire without changing anything.

A write blocker is hardware or software intended to prevent writes to evidence media while permitting reads. It helps reduce accidental changes during acquisition or examination. Confirm compatibility and operation for the relevant interface, and record its use; it does not prevent every possible source change or replace integrity verification.

See also: acquisition.

Taught in: Windows Forensic Examiner, module 01: Acquire without changing anything.