Reference

Digital forensics glossary

Short, precise definitions of the vocabulary used across examinations and reports: evidence handling, file systems, operating-system artifacts, mobile, networks and time. Each entry links to the terms it depends on.

153terms
22letters

A

Acquisition: The process of creating a copy of digital data for examination while keeping the original unchanged, documented and verifiable.
See also: Forensic image, Write blocker, Verification hash
AFF4: Advanced Forensic Format version 4, an open container format for disk and memory images that stores data and metadata in a structured, extensible form.
See also: Forensic image
Alternate data stream (ADS): An additional named data stream attached to an NTFS file. Windows uses it for example for the Zone.Identifier mark on downloaded files; it can also hide data.
See also: NTFS, Zone.Identifier
Amcache: A registry-format file (Amcache.hve) that records information about executables and installed programs, including paths and SHA-1 hashes. Presence of an entry does not by itself prove execution.
See also: Shimcache (AppCompatCache), Prefetch, SHA-1
Anti-forensics: Techniques intended to hinder examination, such as wiping, log clearing, timestamp alteration and encryption. Their traces can themselves be relevant findings.
See also: Timestomping, Wiping, Event log clearing
APFS: Apple File System, used on current macOS and iOS devices. It supports snapshots, cloning and native encryption.
See also: HFS+, FileVault
Arama ve el koyma (search and seizure): Procedural measures, carried out under a lawful decision or order, to search for evidence and take items of evidential value into custody. Searches of computers, programs and records fall within this scope.
See also: İmaj alma / yedekleme (imaging), Tutanak (official record), Chain of custody
Artifact: A trace left by the operating system or an application, such as a log entry, registry value or database record, that can show past activity.
See also: Timeline

B

Base station: Radio equipment of a mobile network that serves devices in its coverage area through one or more cells. Coverage depends on terrain, load and antenna configuration.
See also: Cell ID
Bilirkişi (court-appointed expert): A person whose opinion is sought by a court or investigating authority on matters requiring special or technical knowledge. In civil procedure, HMK 266 provides that an expert is not appointed for matters resolvable with the general and legal knowledge of a judge; the profession is regulated by Law No. 6754 on Expert Witnesses.
See also: Bilirkişi raporu (expert report), Uzman mütalaası (party-appointed expert opinion), Bilirkişilik Kanunu (Law No. 6754)
Bilirkişi raporu (expert report): The written report in which a court-appointed expert answers the technical questions put to them. In criminal procedure it is governed by CMK 67; the expert does not make legal assessments.
See also: Bilirkişi (court-appointed expert), Uzman mütalaası (party-appointed expert opinion)
Bilirkişilik Kanunu (Law No. 6754): The Turkish law on expert witnesses that sets out the principles of expert work, registration in regional expert lists and related supervision.
See also: Bilirkişi (court-appointed expert)
BitLocker: Microsoft's volume encryption for Windows, often bound to the TPM. A 48-digit recovery key can unlock the volume.
See also: Recovery key, TPM, Full-disk encryption
Browser history: Records kept by web browsers, usually in SQLite databases, of visited URLs, downloads, searches and form data, with timestamps in browser-specific formats.
See also: SQLite, WebKit / Chrome time

C

Call detail record (CDR): An operator record of a call, SMS or data session, typically with parties, start time, duration and network cell information, but not content.
See also: HTS record, Cell ID
Carrier-grade NAT (CGNAT): NAT operated by an internet or mobile provider, where many subscribers share a public IP. Attribution requires the IP, source port and exact time.
See also: NAT, Port, IP address
Cell ID: Identifier of the network cell (a sector of a base station) serving a device at a given time. It indicates a coverage area, not an exact position.
See also: Base station, HTS record
Chain of custody: The chronological record of who seized, held, transferred, examined and stored an item of evidence, when, and for what purpose. Gaps weaken the ability to show the item is unchanged.
See also: Evidence integrity, Tutanak (official record), Tamper-evident seal
Clock skew: The difference between a device's clock and a reference time. It must be measured or estimated before timestamps from different devices are compared.
See also: NTP, Timeline
Cluster (allocation unit): The smallest unit of space a file system allocates to a file, made up of one or more sectors.
See also: Sector, Slack space
Crash dump: A file containing all or part of memory written when Windows or an application fails, useful for determining the cause of a crash.
See also: Memory image

D

Daylight saving time (DST): Seasonal shift of local clocks. Historical DST rules must be applied when converting past local times; Türkiye has not observed seasonal changes since 2016.
See also: Time zone offset
Dead-box (static) acquisition: Acquisition of storage media from a powered-off system, usually through a write blocker. It preserves the media but loses volatile data.
See also: Write blocker, Live acquisition
Deleted file: A file whose directory entry or metadata has been marked as free. Its content may remain recoverable until the space is reused, trimmed or wiped.
See also: Unallocated space, File carving, TRIM
Delil (evidence): Any means used to prove the existence or nature of a fact in proceedings. Digital evidence is data stored or transmitted electronically that may be used for that purpose.
See also: Chain of custody, Evidence integrity
DHCP lease: A time-limited assignment of an IP address to a device by a DHCP server. Lease logs link an IP address to a MAC address for a period.
See also: IP address, MAC address
DNS: Domain Name System, which resolves names to IP addresses. Resolver caches and logs can show which domains a device looked up.
See also: IP address

E

E.164: The ITU-T international telephone numbering format: country code followed by the national number, for example +90 for Türkiye.
See also: MSISDN
E01 / EWF: Expert Witness Format, a forensic image container that stores the acquired data in compressed segments together with case metadata and checksums.
See also: Forensic image, Raw (dd) image
Email header: The metadata lines of an email message, including Received lines added by each server. Only headers added by trusted servers are reliable; earlier lines can be forged.
See also: Metadata, IP address
Encryption at rest: Encryption of stored data so it is unreadable without the key. Images of encrypted media must be decrypted with the key or recovery key before analysis.
See also: Full-disk encryption, BitLocker, FileVault
ESE database: Extensible Storage Engine, a Microsoft database format used by SRUM, Windows Search and other components.
See also: SRUM
Event ID: A number identifying the type of an event within a given provider. The same number can mean different things for different providers, so always read it with its source.
See also: EVTX
Event log clearing: Removal of all records from an event log. Windows records it (Security event 1102, System event 104), but other deletion methods may leave no such record.
See also: EVTX
Evidence integrity: The property that data has not been altered since acquisition. It is usually demonstrated by comparing hash values computed at acquisition and at later checks.
See also: Hash value, Verification hash, Chain of custody
EVTX: The Windows XML event log file format (.evtx), used for Security, System, Application and many application-specific logs.
See also: Event ID, Event log clearing
exFAT: A file system designed for flash media and large files, widely used on SD cards and USB drives.
See also: FAT32
EXIF: A metadata standard embedded in image files that can record camera model, capture settings, date and time and sometimes GPS coordinates. It can be edited or stripped.
See also: Metadata
ext4: The common Linux file system. It uses inodes and a journal and stores timestamps with nanosecond resolution, including a creation time (crtime).
See also: Inode, File system journal

F

Faraday bag (RF isolation): Shielding that blocks radio signals so a seized mobile device cannot receive remote wipe commands or new data. Battery drain and connectivity loss must be managed.
See also: Live acquisition
FAT32: A simple legacy file system common on removable media. It stores limited timestamps (last access date only) and local time rather than UTC.
See also: exFAT, UTC
File carving: Recovering files from raw data by searching for known headers, footers and structures, without relying on file system metadata. Names and timestamps are usually lost.
See also: Unallocated space, File signature (magic number)
File signature (magic number): A byte sequence at a fixed position, usually the start, that identifies a file format regardless of its extension.
See also: File carving
File system: The structures an operating system uses to organise files on a volume, including names, locations, sizes, timestamps and free-space tracking.
See also: NTFS, ext4, APFS
File system extraction: Acquisition of the device's file system, including application databases and system files that a logical extraction does not reach.
See also: Logical extraction, Physical extraction
File system journal: A log of pending or recent metadata changes that a file system keeps for crash recovery. It can retain traces of changes no longer visible in the main structures.
See also: USN Journal ($UsnJrnl), ext4
FILETIME: A Windows 64-bit timestamp counting 100-nanosecond intervals since 1601-01-01 UTC.
See also: UTC, Unix epoch time
FileVault: Apple's full-disk encryption for macOS volumes.
See also: APFS, Full-disk encryption, Recovery key
Forensic image: A bit-for-bit copy of a storage device or volume, including unallocated and slack space, stored in a raw or forensic container format with its hash values.
See also: Raw (dd) image, E01 / EWF, AFF4, İmaj alma / yedekleme (imaging)
Full-disk encryption: Encryption of an entire volume or disk. Powering off a running system may lock the data, which affects the decision between live and dead-box acquisition.
See also: Encryption at rest, Live acquisition, Recovery key

H

Hash collision: Two different inputs producing the same hash value. Feasible collisions weaken a hash function for proving that data was not deliberately altered.
See also: MD5, SHA-1
Hash value: A fixed-length value computed from data by a hash function; any change to the data produces a different value with overwhelming probability.
See also: SHA-256, MD5, SHA-1, Hash collision
HFS+: The Apple file system used before APFS. Its timestamps count seconds from 1904-01-01.
See also: APFS
Hibernation file (hiberfil.sys): A compressed copy of memory written to disk when Windows hibernates or uses fast startup. It can be converted and analysed like a memory image.
See also: Page file (pagefile.sys), Memory image
HPA / DCO: Host Protected Area and Device Configuration Overlay: ATA features that can hide part of a disk's capacity from the operating system. An acquisition should check for them.
See also: Acquisition
HTS record: Term used in Türkiye for communication traffic records obtained from electronic communication operators (commonly expanded as Historical Traffic Search). They contain traffic data such as numbers, times, durations and base station information, not content.
See also: Call detail record (CDR), Cell ID, Base station

I

ICCID: Integrated Circuit Card Identifier: the serial number of a SIM card, usually printed on the card itself.
See also: SIM card, IMSI
İmaj alma / yedekleme (imaging): Turkish practice terms for making a bit-level copy of the data on a seized or examined system. The copy's hash values are normally recorded in the official report (tutanak).
See also: Forensic image, Hash value, Tutanak (official record)
IMEI: International Mobile Equipment Identity: a number identifying a mobile handset (the device, not the subscriber).
See also: IMSI, ICCID, MSISDN
IMSI: International Mobile Subscriber Identity: the subscriber identity stored on the SIM and used by the mobile network.
See also: SIM card, MSISDN, IMEI
Inode: A Unix-style file system structure that holds a file's metadata (owner, permissions, timestamps, block pointers) but not its name.
See also: ext4
IP address: A numerical address (IPv4 or IPv6) identifying a network interface at a given time. Because of NAT and dynamic assignment it identifies a connection point, not a person.
See also: NAT, Carrier-grade NAT (CGNAT), Port
IP geolocation: Estimating a location from an IP address using third-party databases. Accuracy varies widely and the result is an estimate, not a position.
See also: IP address
ISO 8601: International standard notation for dates and times, for example 2026-10-14T09:30:00Z. Writing the offset or Z removes ambiguity.
See also: UTC
ISO/IEC 27037: International guideline for the identification, collection, acquisition and preservation of digital evidence.
See also: ISO/IEC 27041, ISO/IEC 27042, ISO/IEC 27043
ISO/IEC 27041: International guidance on assuring the suitability and adequacy of incident investigation methods, including validation of tools and processes.
See also: ISO/IEC 27037, ISO/IEC 27042
ISO/IEC 27042: International guideline for the analysis and interpretation of digital evidence, including competence and reporting.
See also: ISO/IEC 27037, ISO/IEC 27041
ISO/IEC 27043: International standard describing principles and processes for incident investigation, from readiness through to closure.
See also: ISO/IEC 27037

J

Jump List: Per-application lists of recently or frequently used items, stored as files that contain embedded LNK data.
See also: LNK (shortcut) file

K

Keyword search: Searching data for terms or patterns. Results depend on encoding, compression and encryption, so a negative result does not prove absence.
See also: File carving
Known-file filtering: Using reference hash sets to exclude known operating system and application files, or to flag files of interest, so that review can focus on the remainder.
See also: Hash value

L

Last write time: The timestamp of a registry key's most recent change. It applies to the key as a whole, not to an individual value.
See also: Registry hive
Live acquisition: Acquisition from a running system, used when volatile data (memory, network state, decrypted volumes) would be lost on shutdown. Each action alters the system slightly, so steps must be recorded.
See also: Order of volatility, RAM acquisition
LNK (shortcut) file: A Windows shortcut file. It stores the target path, target timestamps, volume serial number and sometimes the network share or machine identifier.
See also: Jump List
Location data: Positions recorded by a device or service from GPS, Wi-Fi, cell or IP sources. Each source has its own accuracy, which should be reported with the result.
See also: Cell ID, IP geolocation, EXIF
Logical extraction: Acquisition of data that the device's operating system or backup interface makes available, such as contacts, messages and media. It does not include deleted data in unallocated areas.
See also: File system extraction, Physical extraction, Mobile device backup
Logical image: A copy of selected files and folders with their metadata, rather than of the whole device. Deleted data and unallocated space are not included.
See also: Forensic image, Logical extraction

M

Mac absolute time (Cocoa time): Apple timestamp counting seconds (sometimes nanoseconds) since 2001-01-01 00:00:00 UTC, common in iOS and macOS databases.
See also: Unix epoch time, SQLite
MAC address: A hardware address of a network interface used on the local network. It can be changed or randomised and is not normally visible beyond the local segment.
See also: IP address
MACB timestamps: Shorthand for the Modified, Accessed, Changed (metadata) and Born (created) timestamps of a file. Their update rules differ between file systems and operating systems.
See also: $STANDARD_INFORMATION and $FILE_NAME, Timeline
Master File Table (MFT): The NTFS metadata file ($MFT) holding one record per file or directory, with attributes such as names, timestamps and data locations. Records of deleted files may remain until reused.
See also: NTFS, $STANDARD_INFORMATION and $FILE_NAME, Resident file
MD5: A 128-bit hash function. Practical collisions exist, so it should not be relied on alone where deliberate manipulation is a concern; it still detects accidental change.
See also: SHA-256, Hash collision, Hash value
Memory image: The file produced by RAM acquisition, analysed to recover processes, network connections, loaded modules and keys present at the time of capture.
See also: RAM acquisition
Metadata: Data that describes other data, such as file timestamps, sizes, authorship fields or EXIF information in photos.
See also: EXIF, MACB timestamps
Mobile device backup: A backup created by the device's own tools, such as an iTunes/Finder backup or an Android backup. Its content depends on the platform and on whether it is encrypted.
See also: Logical extraction, Property list (plist)
MRU list: A "most recently used" list kept by Windows or an application in the registry, recording recently opened files, commands or locations.
See also: NTUSER.DAT
MSISDN: The telephone number assigned to a mobile subscription, written in E.164 international format.
See also: E.164, IMSI

N

NAT: Network Address Translation, which lets many devices share one public IP address. Identifying an internal device requires the translation logs.
See also: IP address, Carrier-grade NAT (CGNAT)
NetFlow / flow records: Summaries of network connections (addresses, ports, protocol, byte counts, times) without packet content.
See also: PCAP
NIST SP 800-86: NIST guide to integrating forensic techniques into incident response, describing collection, examination, analysis and reporting.
See also: ISO/IEC 27037
NTFS: The default Windows file system. File metadata is held in the Master File Table, and features include alternate data streams and journaling.
See also: Master File Table (MFT), Alternate data stream (ADS), USN Journal ($UsnJrnl)
NTP: Network Time Protocol, used to synchronise device clocks with time servers. Synchronisation logs can help establish clock accuracy.
See also: Clock skew
NTUSER.DAT: The per-user registry hive in the user's profile folder. It holds user settings and many activity traces, such as recently used files and UserAssist.
See also: Registry hive, UserAssist, MRU list, UsrClass.dat

O

Order of volatility: The principle of collecting the most short-lived data first (CPU state, memory, network state) before more persistent data such as disks.
See also: RFC 3227, Live acquisition

P

Page file (pagefile.sys): A Windows disk file to which memory pages are moved when RAM is under pressure. It can hold fragments of process memory from earlier sessions.
See also: Hibernation file (hiberfil.sys), RAM acquisition
Partition table (MBR / GPT): The structure at the start of a disk describing its partitions. MBR is the legacy scheme; GPT is the current scheme used with UEFI.
See also: Volume
PCAP: A file format for captured network packets. It contains traffic only from the capture point and time window, and encrypted payloads remain unreadable without keys.
See also: NetFlow / flow records
Physical extraction: Acquisition of a bit-level copy of the device's storage. On modern encrypted devices it may be unavailable or yield data that cannot be decrypted.
See also: Logical extraction, File system extraction, Encryption at rest
Port: A 16-bit number identifying an endpoint of a TCP or UDP connection on a host. Source ports are essential for attribution behind CGNAT.
See also: Carrier-grade NAT (CGNAT), IP address
Prefetch: Files in C:\Windows\Prefetch that Windows creates to speed up program loading. They record executable names, run counts, recent run times and referenced files.
See also: Amcache, Shimcache (AppCompatCache)
Property list (plist): Apple's structured data format, stored as XML or binary, used for settings and application data on iOS and macOS.
See also: Mac absolute time (Cocoa time), Mobile device backup
Protocol Buffers (protobuf): A compact binary serialisation format used by many apps. Without the schema, field meanings must be inferred and documented as such.
See also: SQLite

R

RAM acquisition: Capturing the contents of physical memory from a running system. Memory changes during capture, so the image is not a consistent snapshot and cannot be re-verified against the source.
See also: Live acquisition, Order of volatility, Memory image
Raw (dd) image: An image that contains only the sector data, byte for byte, with no embedded metadata. Hash values and notes must be kept in separate files.
See also: Forensic image, E01 / EWF
Recovery key: An alternative secret that unlocks an encrypted volume when the normal credential is not available. It may be escrowed in a directory service or user account.
See also: BitLocker, FileVault
Recycle Bin: The Windows folder ($Recycle.Bin) where files deleted through Explorer are moved. On current versions each item has an $I file (original path, size, deletion time) and an $R file (content).
See also: Deleted file
Registry hive: A file that stores a section of the Windows registry, such as SYSTEM, SOFTWARE, SAM or a user's NTUSER.DAT. Each key has a last-write timestamp.
See also: NTUSER.DAT, SYSTEM hive, SOFTWARE hive, SAM hive, Last write time
Reproducibility: The ability of another qualified examiner, using the same data and documented method, to obtain the same result.
See also: Evidence integrity
Resident file: A small NTFS file whose content is stored inside its MFT record rather than in separate clusters.
See also: Master File Table (MFT)
RFC 3227: IETF guidelines for evidence collection and archiving, known for its order of volatility for collecting data from live systems.
See also: Order of volatility

S

SAM hive: Registry hive holding local user accounts and groups, including account creation and last logon information.
See also: Registry hive
Sector: The smallest addressable unit on a storage device, typically 512 bytes or 4,096 bytes.
See also: Cluster (allocation unit)
SHA-1: A 160-bit hash function. Practical collisions have been demonstrated; it is still found in many tools and artifacts such as Amcache.
See also: SHA-256, Hash collision
SHA-256: A 256-bit hash function from the SHA-2 family, currently the common choice for evidence verification.
See also: Hash value, Verification hash
ShellBags: Registry data that stores Explorer view settings for folders. It can show that a user browsed a folder, including on removable or network drives, even after the folder is gone.
See also: UsrClass.dat
Shimcache (AppCompatCache): Application compatibility data in the SYSTEM hive listing executables the system has encountered, with file modification times. On recent Windows versions it does not reliably indicate execution.
See also: SYSTEM hive, Amcache
SIM card: Subscriber Identity Module: the card (or embedded eSIM profile) that holds the subscriber identity and network credentials.
See also: ICCID, IMSI
Slack space: The unused space between the end of a file's data and the end of its last allocated cluster. It may contain remnants of earlier data.
See also: Cluster (allocation unit), Unallocated space
SOFTWARE hive: Registry hive holding installed software, operating system version and installation details, and machine-wide autostart entries.
See also: Registry hive
SQLite: A file-based database format used by most mobile apps and browsers. Deleted records can sometimes be recovered from free pages and the WAL file.
See also: Write-ahead log (WAL), Browser history
SRUM: System Resource Usage Monitor: a database (SRUDB.dat) recording per-application resource use, such as network bytes sent and received, in roughly hourly intervals.
See also: ESE database
$STANDARD_INFORMATION and $FILE_NAME: Two NTFS attributes that each carry a set of four timestamps. They are updated under different rules, so comparing them helps detect timestamp manipulation.
See also: Master File Table (MFT), MACB timestamps, Timestomping
Super timeline: A timeline that merges timestamps from many artifact types (file system, registry, logs, browser data) into one sequence.
See also: Timeline
Swap space: The Linux and macOS counterpart of the page file: disk space used to hold memory pages moved out of RAM.
See also: Page file (pagefile.sys)
SWGDE: Scientific Working Group on Digital Evidence, a US-based group that publishes best-practice and terminology documents for digital forensics.
See also: NIST SP 800-86
SYSTEM hive: Registry hive holding system configuration such as services, time zone settings, mounted devices and USB device history.
See also: Registry hive, Shimcache (AppCompatCache)

T

Tamper-evident seal: A seal or bag that shows visible signs if it is opened. Its serial number is recorded so that later inspection can confirm the package was not opened.
See also: Chain of custody, Tutanak (official record)
Thumbnail cache: Windows database files (thumbcache_*.db) holding thumbnails of images and documents viewed in Explorer, which may persist after the originals are deleted.
See also: Deleted file
Time zone offset: The difference between local time and UTC, such as +03:00 for Türkiye. Whether a stored timestamp is local or UTC must be established for each source.
See also: UTC, Daylight saving time (DST)
Timeline: A chronological arrangement of events from one or more sources, normalised to a common time reference, used to reconstruct a sequence of activity.
See also: Super timeline, UTC, MACB timestamps
Timestomping: Deliberately altering file timestamps to mislead analysis. Inconsistencies between timestamp sources can reveal it.
See also: $STANDARD_INFORMATION and $FILE_NAME, MACB timestamps, USN Journal ($UsnJrnl)
Tool validation: Testing a forensic tool or method against known data to show that it produces correct and repeatable results for the intended use, and documenting its limits.
See also: ISO/IEC 27041, Reproducibility
TPM: Trusted Platform Module, a hardware component that stores keys and can release them only when the system boots in an expected state.
See also: BitLocker
Triage: A rapid, limited review to decide which devices or data to acquire or examine first. Its findings are provisional.
See also: Acquisition
TRIM: A command by which the operating system tells an SSD which blocks are no longer in use, allowing the drive to erase them. It reduces the chance of recovering deleted data from SSDs.
See also: Unallocated space, File carving
Tutanak (official record): An official document recording the place, time, participants and outcome of a procedural act, signed by those who carried it out and those present. In digital evidence work, seizure, imaging and hash values are recorded in it.
See also: Chain of custody, İmaj alma / yedekleme (imaging)

U

Unallocated space: Space not assigned to any current file. It may still hold content of deleted files until overwritten.
See also: File carving, Slack space, Deleted file
Unix epoch time: Time counted from 1970-01-01 00:00:00 UTC, commonly in seconds but in some applications in milliseconds or microseconds. The unit must be confirmed.
See also: UTC, FILETIME
UserAssist: Registry data in NTUSER.DAT that counts and timestamps GUI program launches by a user. Value names are ROT13-encoded.
See also: NTUSER.DAT
USN Journal ($UsnJrnl): An NTFS change journal recording file creations, renames, deletions and other changes with timestamps and reason codes. Older entries are overwritten as it fills.
See also: NTFS, File system journal
UsrClass.dat: A second per-user registry hive, stored under AppData\Local\Microsoft\Windows, that holds ShellBags among other data.
See also: ShellBags, NTUSER.DAT
UTC: Coordinated Universal Time, the reference time scale used to normalise timestamps from different sources before comparison.
See also: Time zone offset, Timeline
Uzman mütalaası (party-appointed expert opinion): A scientific or technical opinion obtained by a party from a specialist of its choice and submitted to the court. It is evaluated by the court together with the other evidence and does not have the status of a court-appointed expert report.
See also: Bilirkişi raporu (expert report), Bilirkişi (court-appointed expert)

V

Verification hash: A hash computed over the acquired copy and compared with the hash of the source (or of the acquisition stream) to confirm the copy is complete and unaltered.
See also: Hash value, Evidence integrity
Volume: A logical storage area with its own file system, usually corresponding to a partition.
See also: Partition table (MBR / GPT), File system
Volume Shadow Copy (VSS): Windows point-in-time snapshots of a volume. They can preserve earlier versions of files, registry hives and logs.
See also: Registry hive, EVTX
VPN: A tunnel that carries traffic through another network endpoint, so the observed IP address belongs to the VPN server rather than the user's connection.
See also: IP address

W

WebKit / Chrome time: Timestamp counting microseconds since 1601-01-01 UTC, used in Chromium-based browser databases.
See also: Browser history, FILETIME
Wiping: Overwriting data so that it cannot be recovered. Wiping tools and their execution may leave traces even when the target data is gone.
See also: Anti-forensics, Unallocated space
Working copy: A verified duplicate of the forensic image used for analysis, so that the master copy remains untouched.
See also: Forensic image, Verification hash
Write blocker: A hardware device or software control that allows reading from a storage device while preventing writes to it.
See also: Acquisition, Dead-box (static) acquisition
Write-ahead log (WAL): A companion file (-wal) where SQLite writes changes before merging them into the main database. It may contain records not yet, or no longer, in the main file.
See also: SQLite

Z

Zone.Identifier: An alternate data stream Windows adds to files obtained from the internet, recording the security zone and often the source URL.
See also: Alternate data stream (ADS)