3 |
| 30(b)(6) |
Under Federal Rule of Civil Procedure 30(b)(6), a corporation, partnership, association, or governmental agency is subject to the deposition process, and to provide one or more witnesses to “testify as to matters known or reasonably available to the organization” without compromising attorney-client privilege communications or work product. It is not unusual for the 30(b)(6) topics to be directed toward the discovery process, including procedures for preservation, collection, chain of custody, processing, |
Back to Top |
A |
| Ablate |
Describes the process by which laser-readable “pits” are burned into the recorded layer of optical discs, DVD-ROMs and CD-ROMs. |
| Ablative |
Unalterable data. See Ablate. |
| Abuse of Privilege |
Formal nomenclature for user actions not in accordance with organizational policy or law. Actions falling outside, or explicitly proscribed by, acceptable use policy. |
| Accountability |
The principle that individuals using a facility or a computer system must be identifiable. With accountability, violations or attempted violations of system security can be traced to individuals who can then be held responsible. |
| Accuracy |
Department of Defense parlance for the notion that information has been maintained and transferred in such a way as to be inviolate (the information has been protected from being modified or otherwise corrupted either maliciously or accidentally). Accuracy protects against forgery or tampering. |
| Acetate-base film |
A safety film (ANSI Standard) substrate used to produce microfilm. |
| ACL (Access Control List) |
A security type used by Lotus Notes developers to grant varying levels of access and user privileges within Lotus Notes databases. |
| Active Data |
Active data is information residing on the direct access storage media of computer systems, which is readily visible to the operating system and/or application software with which it was created and immediately accessible to users without undeletion, modification or reconstruction (i.e., word processing and spreadsheet files, programs and files used by the computer’s operating system). |
| Active Data * |
Active Data is information residing on the direct access storage media (disc drives or servers) of computer systems, which is readily visible to the operating system and/or application software with which it was created and immediately accessible to users without restoration or reconstruction. |
| Active Records * |
Active Records are those Records related to current, ongoing or in-process activities and are referred to on a regular basis to respond to day-to-day operational requirements. An active record resides in native application format and is accessible for purposes of business processing with no restrictions on alteration beyond normal business rules. See Inactive Records. |
| ADC |
Analog to Digital converter. Converts analog data to a digital format. |
| Address |
Addresses using a number of different protocols are commonly used on the Internet. These addresses include email addresses (Simple Mail Transfer Protocol or SMTP), IP (Internet Protocol) addresses and URLs (Uniform Resource Locators), commonly known as Web addresses. |
| ADF |
Automatic Document Feeder. This is the means by which a scanner feeds the paper document. |
| AIIM |
The Association for Information and Image Management – focused on electronic imaging. |
| Algorithm |
A detailed formula or set of steps for solving a particular problem. To be an algorithm, a set of rules must be unambiguous and have a clear stopping point. |
| Aliasing |
When computer graphics output has jagged edges or a stair-stepped, rather than a smooth, appearance when magnified. The graphics output can be smoothed using anti-aliasing algorithms. |
| Alphanumeric |
Characters composed of letters, numbers (and sometimes punctuation marks). Excludes control characters. |
| Ambient Data |
Ambient data is data stored in non-traditional computer storage areas and formats, such as Windows swap files, unallocated space, and file slack. |
| Analog |
Data in an analog format is represented by continuously variable, measurable, physical quantities such as voltage, amplitude or frequency. Analog is the opposite of digital. |
| Annotations |
The changes, additions, or editorial comments made or applicable to a document - usually an electronic image file - using electronic sticky notes, highlighter, or other electronic tools. Annotations should be overlaid and not change the original document. |
| ANSI |
American National Standards Institute - a private, non-profit organization that administers and coordinates the U.S. voluntary standardization and conformity assessment system. |
| Aperture Card |
An IBM punch card with a window which holds a 35mm frame of microfilm. Indexing information is punched in the card. |
| Application |
An application is a collection of one or more related software programs that enables a user to enter, store, view, modify or extract information from files or databases. The term is commonly used in place of “program,” or “software.” Applications may include word processors, Internet browsing tools and spreadsheets. |
| Architecture |
The term architecture refers to the hardware, software or combination of hardware and software comprising a computer system or network. The term “open architecture” is used to describe computer and network components that are more readily interconnected and interoperable. Conversely, the term “closed architecture” describes components that are less readily interconnected and interoperable. |
| Archival Data * |
Archival Data is information an organization maintains for long-term storage and record keeping purposes, but which is not immediately accessible to the user of a computer system. Archival data may be written to removable media such as a CD, magneto-optical media, tape or other electronic storage device, or may be maintained on system hard drives. Some systems allow users to retrieve archival data directly while other systems require the intervention of an IT professional. |
| Archive |
A copy of data (any information stored on a computer) on a computer drive, or on a portion of a drive, maintained for historical reference. Also: After processing discovery materials, an archive is created for each case. Viruses found in processing are typically removed (a clean archive), program-related files are removed (per instruction, a purged archive), erased files are analyzed and recovered if possible, slack space is checked, files are grouped according to files classes, and meta-data is added to |
| Archive/Electronic Archive |
Archives are long term repositories for the storage of records. Electronic archives preserve the content, prevent or track alterations and control access to electronic records. |
| ARMA International |
a not-for-profit association and recognized authority on managing records and information – paper and electronic - www.arma.org. |
| Artificial Intelligence (AI) |
The subfield of computer science concerned with the concepts and methods of symbolic inference by computer and symbolic knowledge representation for use in making inferences - an attempt to model aspects of human thought on computers. It is also sometimes defined as trying to solve by computer any problem once believed to be solvable only by humans. AI is the capability of a device to perform functions that are normally associated with human intelligence, such as reasoning and optimization through experien |
| ASCII |
An acronym for American Standard Code that allocates a number to each key on the keyboard and that can be traded and read by most computer systems. |
| ASCII (Acronym for American Standard Code) |
ASCII is a code that assigns a number to each key on the keyboard. ASCII text does not include special formatting features and therefore can be exchanged and read by most computer systems. |
| Aspect Ratio |
The relationship of the height and width of any image. The aspect ratio of an image must be maintained to prevent distortion. |
| Attachment |
An attachment is a record or file associated with another record for the purpose of storage or transfer. There may be multiple attachments associated with a single “parent” or “master” record. The attachments and associated record may be managed and processed as a single unit. In common use, this term refers to a file (or files) associated with an e-mail for transfer and storage as a single message unit. Because in certain circumstances the context of the attachment—for example, the parent e-mail and its a |
| Attribute |
An attribute is a characteristic of data that sets it apart from other data, such as location, length, or type. The term attribute is sometimes used synonymously with “data element” or “property.” |
| Audit Trail * |
In computer security systems, a chronological record of when users logged in, how long they were engaged in various activities, what they were doing, and whether any actual or attempted security violations occurred. An audit trail is an automated or manual set of chronological records of system activities that may enable the reconstruction and examination of a sequence of events and/or changes in an event. |
| Author or Originator * |
The author of a document is the person, office or designated position responsible for its creation or issuance. In the case of a document in the form of a letter, the author or originator is usually indicated on the letterhead or by signature. In some cases, the software application producing the document may capture the author’s identity and associate it with the document. For records management purposes, the author or originator may be designated as a person, official title, office symbol, or code. |
| AVI (Audio-Video Interleave) |
A Microsoft standard for Windows animation files that interleaves audio and video to provide medium quality multimedia. |
Back to Top |
B |
| Backbone |
The top level of a hierarchical network. It is the main channel along which data is transferred. |
| Backfiles |
Existing paper or microfilm files. |
| Backup |
To create a copy of data as a precaution against the loss or damage of the original data. Most users backup some of their files, and many computer networks utilize automatic backup software to make regular copies of some or all of the data on the network. Some backup systems use digital audio tape (DAT) as a storage medium. |
| Backup Data |
Backup data is information that is not presently in use by an organization and is routinely stored separately upon portable media, to free up space and permit data recovery in the event of disaster. |
| Backup Tape |
Backup or disaster recovery tapes are portable media used to store data that is not presently in use by an organization to free up space but still allow for disaster recovery. |
| Backup Tape Recycling |
Backup tape recycling is the process whereby an organization’s backup tapes are overwritten with new backup data, usually on a fixed schedule (i.e., the use of nightly backup tapes for each day of the week with the daily backup tape for a particular day being overwritten on the same day the following week; weekly and monthly backups being stored offsite for a specified period of time before being placed back in the rotation). |
| Backup Tapes |
Magnetic tapes used to store copies of data, for use when restoration or recovery of data is required. Data on backup tapes are generally recorded and stored sequentially, rather than randomly, meaning in order to locate and access a specific file or data set, all data on the tape preceding the target must first be read, a time-consuming and inefficient process. Backup tapes typically use data compression, which increases restoration time and expense, given the lack of uniform standards governing data comp |
| Bandwidth |
The amount of information or data that can be sent over a network connection in a given period of time. Bandwidth is usually stated in kilobits per second (kbps) or megabits per second (mps). |
| Bar Code |
A small pattern of vertical lines that can be read by a laser or an optical scanner. In records management and electronic discovery, bar codes are often affixed to specific records for indexing, tracking and retrieval purposes. |
| Batch Processing |
The processing of a large amount of data, or multiple records, in a single step. |
| Bates Number |
Sequential numbering used to track documents and images in production data sets, where each page is identified by a unique production number. Often used in conjunction with a suffix or prefix to identify the producing party, the litigation, or other relevant information. See also Production Number. |
| Bates Production Number |
A bates production number is a tracking number assigned to each page of each document in the production set. |
| Baud Rate |
The number of times per second a communications channel changes the carrier signal it sends on a phone line. A 2400-baud modem changes the signal 2400 times a second. |
| BBS (Bulletin Board System) |
A computer system or service that users access to participate in electronic discussion groups, post messages and/or download files. |
| BCS |
Boston Computer Society, one of the first associations of PC/Apple users and one of the largest and most active. |
| Beginning Document Number or BegDoc# |
The Bates Number identifying the first page of a document or record. |
| Bibliographical/Objective Coding |
Extracting objective information from electronic documents such as date created, author/recipient/copies, and associating the information with a specific electronic document. |
| Binary |
Mathematical base 2, or numbers composed of a series of zeros and ones. Since zero's and one's can be easily represented by two voltage levels on an electronic device, the binary number system is widely used in digital computing. |
| BIOS (Basic Input Output System) |
The set of user-independent computer instructions stored in a computer’s ROM, immediately available to the computer when the computer is turned on. BIOS information provides the code necessary to control the keyboard, display screen, disc drives and communication ports in addition to handling certain miscellaneous functions. |
| Bit |
A bit ( B inary dig IT ) is the smallest unit of computer data. A bit consists of either 0 or 1. There are eight bits in a byte. |
| Bit Map |
A Bit Map provides information on the placement and color of individual bits and allows the creation of characters or images by creating a picture composed of individual bits (pixels). |
| Bit Stream Backup |
Bit stream backups, also referred to as mirror image backups, are comprised of the backup of all areas of a computer hard disk drive or another type of storage media, e.g., Zip disks, floppy disks, Jazz disks, etc. Such backups exactly replicate all sectors on a given storage device, therefore, all files and ambient data storage areas are copied. |
| Bi-Tonal |
A bi-tonal image uses only black and white. |
| Blog |
Blogs, also referred to as Web logs, are frequent, chronological Web publications consisting of links and postings. The most recent posting appears at the top of the page. |
| BMP |
A Windows file format for storing bit map images. |
| Bookmark |
A link to a Web site or page previously visited. |
| Boolean Search |
The term 'Boolean' refers to a system of logic developed by an early computer pioneer, George Boole. In Boolean searching, an 'and' operator between two words results in a search for documents containing both of the words. An 'or' operator between two words creates a search for documents containing either of the target words. A 'not' operator between two words creates a search result containing the first word but excluding the second. |
| Boot |
To start up or reset a computer. |
| Boot Sector |
The very first sector on a hard drive which contains the computer code (boot strap loader) necessary for the computer to start up and the partition table describing the organization of the hard drive. |
| BPI (Bits Per Inch) |
BPI measures data densities in disc and magnetic tape systems. |
| Bps |
bits per second. |
| Broadband |
Communications of high capacity and usually of multimedia content. |
| Browser |
An application, such as Internet Explorer or Netscape Navigator, used to view and navigate the World Wide Web and other Internet resources. |
| Bug |
A problem with computer software or hardware that causes it to malfunction or crash. |
| Burn |
Slang for making (burning) a CD-ROM copy of data, whether it is music, software, or other data. |
| Bus |
A parallel circuit that connects the major components of a computer, allowing the transfer of electric impulses from one connected component to any other. |
| Business Process Outsourcing |
Business process outsourcing occurs when an organization turns over the management of a business function, such as accounts payable, purchasing, payroll or information technology to a third party. |
| Byte |
A unit of measure consisting of eight bits that is the basic measurement of most computer data as multiples of the byte value. One million bytes are equivalent to a 'megabyte' while one billion bytes is a 'gigabyte'.
1 gigabyte = 1,000 megabytes
1 terabyte = 1,000 gigabytes |
Back to Top |
C |
| Cache |
Pronounced cash, the cache is a special high-speed storage mechanism that can be either a reserved section of main memory or an independent high-speed storage device, with two types of caching commonly used in personal computers: memory caching and disk caching.
A memory cache, sometimes called a cache store or RAM cache, is a portion of memory made of high-speed static RAM (SRAM) instead of the slower and cheaper dynamic RAM (DRAM) used for main memory. Memory caching is effective because most programs |
| Caching |
The temporary storage of frequently-used data to speed access. See also Cache. |
| Case De-Duplication |
Retains only single copies of documents per case. For example, if an identical document resides with Mr. A, Mr. B and Mr. C, only the first occurrence of the file will be saved (Mr. A's). Contrast with custodian de-duplication and production de-duplication. |
| Catalog |
See Index. |
| CCD (Charge Coupled Device) |
A computer chip the output of which correlates with the light or color passed by it. Individual CCDs or arrays of these are used in scanners as a high-resolution, digital camera to read documents. |
| CCITT |
Consultative Committee for International Telephone & Telegraphy. Sets standards for phones, faxes, modems etc. The standard exists primarily for fax documents. |
| CCITT Group 4 |
A lossless compression technique/format that reduces the size of a file, generally about 5:1 over RLE and 40:1 over bitmap. CCITT Group 4 compression may only be used for bi-tonal images. |
| CDPD (Cellular Digital Packet Data) |
A data communication standard utilizing the unused capacity of cellular voice providers to transfer data. |
| CD-R (Compact Disc Recordable) |
A CD-ROM on which a user may permanently record data once using a CD Burner. |
| CD-ROM |
See Compact Disc. (Compact Disk - Read Only Memory) Data storage medium that uses compact discs to store about 1,500 floppy discs worth of data. |
| Centronics Interface |
A parallel interface standard for connecting printers and other devices to computers. |
| Certificate |
Digital signature combining data verification and encryption key. See PKI Digital Signature. |
| CGA (Color Graphics Adapter) |
See Video Graphics Adapter (VGA). |
| Chaff/winnowing. |
Advanced encryption technique involving data dispersal and mixing |
| Chain of Custody |
A process used to maintain and document the chronological history of electronic evidence. A chain of custody ensures that the data presented is 'as originally acquired' and has not been altered prior to admission into evidence. An electronic chain of custody link should be maintained between all electronic data and its original physical media throughout the production process. Also: Documentation and testimony regarding the possession, movement, handling and location of evidence from the time it is obta |
| Chain of Evidence |
The 'sequencing' of the chain of evidence follows this order:
1. Collection & Identification
2. Analysis
3. Storage
4. Preservation
5. Transportation
6. Presentation in Court
7. Return to Owner
The chain of evidence shows:
1. Who obtained the evidence
2. Where and when the evidence was obtained
3. Who secured the evidence
4. Who had control or possession of the evidence |
| Character Treatment |
The use of all caps or another standard form of treating letters in a coding project. |
| Chat |
See Instant messaging (IM). A form of real-time communication between two or more people based on typed text. The text is conveyed via computers connected over a network such as the Internet. |
| Check Digit |
One digit, usually the last, of an identifying field is a mathematical function of all of the other digits in the field. This value can be calculated from the other digits in the field and compared with the check digit to verify the validity of the whole field. |
| CIE (Commission International de l’Eclairage) |
The international commission on color matching and illumination systems. |
| Cine-Mode |
Data recorded on a film strip such that it can be read by a human when held vertically. |
| Cinepak |
A compression algorithm; see MPEG. |
| CITIS (Contractor Integrated Technical Information Service) |
The Department Of Defense now requires contractors to have an integrated electronic document image and management system. |
| Client |
Any computer system that requests a service of another computer system. A workstation requesting the contents of a file from a file server is a client of the file server. See Thin Client. |
| Client/Server |
An architecture whereby a computer system consists of one or more server computers and numerous client computers (workstations). The system is functionally distributed across several nodes on a network and is typified by a high degree of parallel processing across distributed nodes. With client-server architecture, CPU intensive processes (such as searching and indexing) are completed on the server, while image viewing and OCR occur on the client. This dramatically reduces network data traffic and insulate |
| Clipboard |
A holding area that temporarily stores information copied or cut from a document. |
| Cluster |
Clusters are fixed length blocks of bytes that store data for Microsoft operating systems. Clusters are, essentially, a consortium of sectors used to allocate the data storage area in all Microsoft operating systems, range in size from one sector to 128 sectors, and vary based on the size of the logical storage volume and the operating system involved. |
| Cluster (File) |
The smallest unit of storage space that can be allocated to store a file on operating systems that use a file allocation table (FAT) architecture. Windows and DOS organize hard discs based on Clusters (also known as allocation units), which consist of one or more contiguous sectors. Discs using smaller Cluster sizes waste less space and store information more efficiently. |
| Cluster (System) |
A collection of individual computers that appear as a single logical unit. Also referred to as matrix or grid systems. |
| Cluster bitmaps |
Used in NTFS to keep track of the status (free or used) of clusters on the hard drive. |
| CMYK |
Cyan, Magenta, Yellow and Black. A subtractive method used in four color printing and Desktop Publishing. |
| Coding |
Litigation Support: Automated or human process through which documents are examined and evaluated using predetermined codes, and the results of those comparisons are logged. Coding usually identifies names, dates, and relevant terms or phrases. Coding may be structured (limited to the selection of one of a finite number of choices), or unstructured (a narrative comment about a document). Coding may be objective, i.e., the name of the sender or the date, or subjective, i.e., evaluation as to the relevancy |
| COLD (Computer Output to Laser Disc) |
A computer programming process that outputs electronic records and printed reports to laser disc instead of a printer. |
| COM (Computer Output to Microfilm) |
A process that outputs electronic records and computer generated reports to microfilm. |
| Comb |
A series of boxes with their top missing. Tick marks guide text entry. Used in forms processing rather than boxes. |
| Comic Mode |
Human-readable data, recorded on a strip of film which can be read when the film is moved horizontally to the reader. |
| Comma Separated Value (CSV) |
A record layout that separates data fields/values with a comma and typically encloses data in quotation marks. |
| Compact Disc (CD) * |
A type of optical disc storage media, compact discs come in a variety of formats. These formats include CD-ROMs (“CD Read-Only Memory”) that are read-only; CD-Rs (“CD Recordable”) that are write to once and are then read-only; and CD-RWs (“CD Re-Writable”) that can be written to multiple times. |
| Compliance Search |
The identification of relevant terms and/or parties in response to a discovery request. |
| Component Video |
Separates video into luminosity and color signals that provide the highest possible signal quality. |
| Composite Video |
Combines red, green, blue and synchronization signals into one video signal so that only one connector is required; used by most TVs and VCRs. |
| Compression * |
Compression algorithms such as Zip and RLE reduce the size of files saving both storage space and reducing bandwidth required for access and transmission. Data compression is widely used in backup utilities, spreadsheet applications and database management systems. Compression generally eliminates redundant information and/or predicts where changes will occur. “Lossless” compression techniques such as Zip and RLE preserve the integrity of the input. Coding standards such as JPEG and MPEG employ “lossy” met |
| Compression Ratio |
The ratio of the size of an uncompressed file to a compressed file, e.g., with a 10:1 compression ratio, a 1 MB file can be compressed to 100 KB. |
| Computer |
Includes but is not limited to network servers, desktops, laptops, notebook computers, mainframes and PDAs (personal digital assistants). |
| Computer Evidence |
Computer evidence is rather unique when compared to other forms of more traditional documentary evidence. Unlike paper documentation, computer evidence is extremely fragile and it occurs in the form of an identical copy of a specific document that is stored in a computer file. In addition, the legal "best evidence" rules differ for the processing of computer evidence. However, there is the potential for unauthorized copies to be made of important computer files without leaving behind a trace that the copy |
| Computer Forensics * |
Computer Forensics (in the context of this document, “forensic analysis”) is the use of specialized techniques for recovery, authentication and analysis of electronic data when an investigation or litigation involves issues relating to reconstruction of computer usage, examination of residual data, authentication of data by technical analysis or explanation of technical features of data and computer usage. Computer forensics requires specialized expertise that goes beyond normal data collection and preserv |
| Computer Investigations |
Computer crimes are specifically defined by federal and/or state statutes and any computer documentary evidence utilized during a computer investigation may include computer data stored on floppy diskettes, zip disks, CDs and computer hard disk drives. The evidence necessary to prove computer-related crimes can potentially be located on one or more computer hard disk drives in various geographic locations. This evidence can reside on computer storage media as bytes of data in the form of computer files and |
| Concept Search |
Searching electronic documents to determine relevance by analyzing the words and putting search requests in conceptual groupings so the true meaning of the request is considered. Concept searching considers both the word and the context in which it appears to differentiate between concepts such as diamond (baseball) and diamond (jewelry). |
| Content Comparison |
A method of de-duplication that compares file content or output (to image or paper) and ignores metadata. See De-Duplication. |
| Contextual Search |
The process of returning electronic evidence to its true context when created, by whom, for what purpose, etc. |
| Continuous Tone |
An image (e.g. a photograph) which has all the values of gray from white to black. |
| Convergence |
Integration of computing, communications and broadcasting systems. |
| Cookie |
A message given to a Web browser by a Web server. The browser stores the message in a text file. The message is then sent back to the server each time the browser requests a page from the server. The main purpose of cookies is to identify users and possibly prepare customized Web pages for them. |
| Cookies |
Holds information on the times and dates a user has visited websites. Other information can also be saved to your hard drive in these text files, including information about online purchases, validation information about the user for 'Members Only' websites, etc. |
| Corrupted File |
A file damaged in some way, such as by a virus, or by software or hardware failure, so that it cannot be read by a computer. |
| COTS (Commercial Off-the-Shelf) |
Hardware or software products that are commercially manufactured, ready-made and available for use by the general public without the need for customization. |
| CPI |
Characters Per Inch. |
| CPU (Central Processing Unit) |
The primary silicon chip that runs a computer’s operating system and application software. It performs a computer’s essential mathematical functions and controls essential operations. |
| CRC (Cyclical Redundancy Checking) |
Used in data communications to create a checksum character at the end of a data block to ensure integrity of data transmission and receipt. |
| CRM (Customer Relationship Management) |
programs that help manage clients and contacts. Used in larger companies. Often a significant repository of sales, customer, and sometimes marketing data. |
| Cross-Custodian De-Duplication |
Culls a document to the extent multiple copies of that document reside within different custodians’ data sets. See De-Duplication. |
| CRT (Cathode Ray Tube) |
The picture tube of a computer monitor or television. |
| Cryptography |
Technique to scramble data to preserve confidentiality or authenticity. |
| Cull (verb) |
To remove a document from the collection to be produced or reviewed. See Data Filtering, Harvesting. |
| Custodian |
Data Custodian.: Person having administrative control of a document; for example, the data custodian of an email is the owner of the mailbox which contains the email. Custodians may be electronic or hard copy. |
| Custodian De-Duplication |
Culls a document if multiple copies of that document reside within the same custodian's data set. For example, if Mr. A and Mr. B each have a copy of a specific document, and Mr. C has two copies, the system will maintain one copy each for Mr. A, Mr. B, and Mr. C. Contrast with case de-duplication (Retains only single copies of documents per case. For example, if an identical document resides with Mr. A, Mr. B and Mr. C, only the first occurrence of the file will be saved (Mr. A's).) and production de-dup |
| Customer-Added Metadata |
Data (any information stored on a computer) or work product created by a user while reviewing a document. For example, annotation text of a document or subjective coding information. Contrast with vendor-added metadata. (Data created and maintained by the electronic discovery vendor as a result of processing the document. While some vendor-added metadata has direct value to customers, much of it is used for process reporting, chain of custody, and data accountability.) Also see User-Added Metadata. |
| CYAN |
Cyan-colored ink reflects blue and green and absorbs red. |
| Cyber or Cyberspace |
Slang for information shared on the internet. See 'Internet' |
| Cylinder |
The set of tracks on both sides of each platter in the hard drive that is located at the same head position. |
Back to Top |
D |
| DAC (Digital to Analog Converter) |
Converts digital data to analog data. |
| DAD (Digital Audio Disc) |
Another term for compact disc. |
| DAT |
An acronym for Digital Audio Tape, which some backup systems utilize as a storage medium. |
| DAT (Digital Audio Tape) |
A magnetic tape generally used to record audio but can hold up to 40 gigabytes (or 60 CDs) of data if used for data storage. Has the disadvantage of being a serial access device. Often used for backup. |
| Data |
A representation of facts, concepts, or instructions in a formalized manner suitable for communication, interpretation, or processing by humans or by automatic means. Any representations such as characters or analog quantities to which meaning is, or might be, assigned. |
| Data Analysis |
Provides access to tools allowing users to perform sophisticated data analysis of both native data content and meta-data. Features include:
1. Basic keyword and Boolean search functionality
2. Natural language and search query support
3. Fuzzy logic and thesaurus-based search
4. Advanced data mining capabilities, such as artificial intelligence, neural-network, and thematic data mapping search |
| Data Collection |
See Harvesting. |
| Data Element * |
A combination of characters or bytes referring to one separate piece of information, such as name, address, or age. |
| Data Extraction |
The process of retrieving data from documents (hard copy or electronic). The process may be manual or electronic. Also: The process of removing files and meta-data from backup tapes. |
| Data Field |
See Field. |
| Data Filtering |
The process of identifying for extraction specific data based on specified parameters. |
| Data Formats |
The organization of information for display, storage or printing. Data is maintained in certain common formats so that it can be used by various programs, which may only work with data in a particular format, e.g. PDF, html'''. |
| Data Harvesting |
See Harvesting. |
| Data Integrity |
Refers to the validity of data. Data integrity can be comprised in a number of ways, including:
Human errors when data is entered
Errors that occur when data is transmitted from one computer to another
Software bugs or viruses
Hardware malfunctions, such as disk crashes
Natural disasters, such as fires and floods
There are many ways to minimize these threats to data, including:
Backing up data on a regular basis
Controlling access to data via security mechanisms
Designing user interfaces that prevent t |
| Data Mapping |
Going beyond basic search capabilities, data mapping is also called keyless searching. It finds or suggests associations between files within a large body of data, which may not be apparent using other techniques. |
| Data Mining |
Data mining generally refers to techniques for extracting summaries and reports from an organization’s databases and data sets. In the context of electronic discovery, this term often refers to the processes used to cull through a collection of electronic data to extract evidence for production or presentation in an investigation or in litigation. |
| Data Set |
A named or defined collection of data. See also Production Data Set and Privilege Data Set. |
| Data Streams |
Microsoft introduced a data storage concept called data streams in Windows NT version 3.51. These data streams allow multiple forms of data to be associated with a file, including any number of graphic files, databases, programs, spreadsheets, word processing documents, or other data types associated with a given file to alter some of the rules concerning computer security issues and computer forensics investigations. |
| Data Verification |
Assessment of data to ensure it has not been modified. The most common method of verification is hash coding by some method such as MD5. See also Digital Fingerprint and File Level |
| Database * |
In electronic records a database is a set of data elements consisting of at least one file, or of a group of integrated files, usually stored in one location and made available to several users. In computing databases are sometimes classified according to their organizational approach with the most prevalent approach being the relational database - a tabular database in which data is defined so that it can be reorganized and accessed in a number of different ways. Another popular organizational structure i |
| Database Management System (DBMS) * |
A software system used to access and retrieve data stored in a database. |
| Daubert (challenge) |
Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993), addresses the admission of scientific expert testimony to ensure that the testimony is reliable before considered for admission pursuant to Rule 702. The court assesses the testimony by analyzing the methodology and applicability of the expert’s approach. Faced with a proffer of expert scientific testimony, the trial judge must determine first, pursuant to Rule 104(a), whether the expert is proposing to testify to (1) scientific knowledge that (2 |
| Decryption |
Transformation of encrypted (or scrambled) data back to original form. |
| De-duplication |
De-Duplication (“De-Duping”) is the process of comparing electronic records based on their characteristics and removing duplicate records from the data set.
The process of providing one instance of an item when there was once two or more identical copies. This process usually involves landing all files into a database and then searching for duplicate files. Basic de-duplication is perrformed on a select and limited basis, such as for file names and types, and is usually based on the value of the entire el |
| De-Fragment (“de-frag”) |
Use of a computer utility to reorganize files so they are more contiguous on a hard drive or other storage medium, if the files or parts thereof have become fragmented and scattered in various locations within the storage medium in the course of normal computer operations. Used to optimize the operation of the computer, it will overwrite information in unallocated space. See Fragmented. |
| Deleted Data * |
Deleted Data is data that existed on the computer as live data and which have been deleted by the computer system or end-user activity. Deleted data may remain on storage media in whole or in part until they are overwritten or “wiped.” Even after the data itself have been wiped, directory entries, pointers or other information relating to the deleted data may remain on the computer. “Soft deletions” are data marked as deleted (and not generally available to the end-user after such marking), but not yet phy |
| Deletion |
Deletion is the process whereby data is removed from active files and other data storage structures on computers and rendered inaccessible except through the use of special data recovery tools designed to recover deleted data. Deletion occurs on several levels in modern computer systems
(a) File level deletion renders the file inaccessible to the operating system and normal application programs and marks the storage space occupied by the file’s directory entry and contents as free and available to re-use |
| Descenders |
the portion of a character which falls below the main part of the letter (e.g. g, p, q) |
| De-shading |
Removing shaded areas to render images more easily recognizable by OCR. De-shading software typically searches for areas with a regular pattern of tiny dots. |
| De-skewing |
The process of straightening skewed (tilted) images. De-skewing is one of the image enhancements that can improve OCR accuracy. Documents often become skewed when scanned or faxed. |
| Desktop |
Usually refers to an individual PC -- a user's 'desktop computer' (as opposed to a network computer or server). Also refers to the main view on a PC that shows the standard shortcuts to specific applications and/or files, or the 'computer's desktop'. |
| De-speckling |
Removing isolated speckles from an image file. Speckles often develop when a document is scanned or faxed. |
| DIA/DCA (Document Interchange Architecture) |
An IBM standard for transmission and storage of voice, text or video over networks. |
| Digital |
Information stored as a string of ones and zeros. Opposite of analog. |
| Digital Certificate |
Electronic records that contain keys used to decrypt information, especially information sent over a public network like the Internet. |
| Digital Fingerprint |
A fixed-length hash code that uniquely represents the binary content of a file. See also Data Verification and File Level Binary Comparison and Hash Coding. |
| Digitize |
The process of converting an analog value into a digital (numeric) representation. |
| Directory |
A simulated file folder or container used to organize files and directories in a hierarchical or tree-like structure. UNIX and DOS use the term “directory”, while Mac and Windows use the term “folder.” |
| Disaster Recovery Tape |
A form of transferable media device used to store data that is not currently being used by the organization in order to create additional space while still allowing for information to be restored should a disaster occur. |
| Disc (disk) |
It may be a floppy disk, or it may be a hard disk. Either way, it is a magnetic storage medium on which data is digitally stored. A disc may also refer to a CD-ROM. |
| Disc mirroring |
A method of protecting data from a catastrophic hard disc failure or for long term data storage. As each file is stored on the hard disc, a “mirror” copy is made on a second hard disc or on a different part of the same disc. See also Mirror. |
| Disc Partition |
A hard drive containing a set of consecutive cylinders. |
| Disc/Disk |
Round, flat storage media with layers of material which enable the recording of data. |
| Discovery |
Discovery is the process of identifying, locating, securing and producing information and materials for the purpose of obtaining evidence for utilization in the legal process. The term is also used to describe the process of reviewing all materials which may be potentially relevant to the issues at hand and/or which may need to be disclosed to other parties, and of evaluating evidence to prove or disprove facts, theories or allegations. There are several ways to conduct discovery, the most common of which |
| Discwipe |
Utility that overwrites existing data. Various utilities exist with varying degrees of efficiency - some wipe only named files or unallocated space of residual data, thus unsophisticated users who try to wipe evidence may leave behind files of which they are unaware. |
| Disk (Disc) |
Refers to both floppy disks and hard disks, which are both a form of magnetic storage medium used to digitally store data. |
| Disk Mirroring |
When files are stored on a computer system's hard disk, a 'mirror' copy is made on an additional hard disk or a separate part of the same disk to safeguard information in the case of a disaster. |
| Disposition * |
The final business action carried out on a record. This action generally is to destroy or archive the record. Electronic record disposition can include “soft deletions” (see Deletion), “hard deletions,” “hard deletions with overwrites,” “archive to long-term store,” “forward to organization,” and “copy to another media or format and delete (hard or soft).” |
| Distributed Data |
Data that resides on portable media and non-local devices such as laptop computers, home computers, CD-ROMs, floppy disks, zip drives, wireless communication devices, personal digital assistants, web pages, Internet repositories such as e-mail hosted by Internet service providers or portals, and the like that belongs to the organization and not the user. |
| Distributed Data * |
Distributed Data is that information belonging to an organization which resides on portable media and non-local devices such as remote offices, home computers, laptop computers, personal digital assistants (“PDAs”), wireless communication devices (e.g., Blackberry) and internet repositories (including email hosted by internet service providers or portals and web sites). Distributed data also includes data held by third parties such as application service providers and business partners. Note Information Te |
| Dithering |
In printing, dithering is usually called halftoning, and shades of gray are called halftones. The more dither patterns that a device or program supports, the more shades of gray it can represent. Dithering is the process of converting grays to different densities of black dots, usually for the purposes of printing or storing color or grayscale images as black and white images. |
| DLT (Digital Linear Tape) |
A type of backup tape which can hold up to 80 GB depending on the data file format. |
| Document |
Fed. R. Civ. P. 34(a) defines a document as “including writings, drawings, graphs, charts, photographs, phonorecords, and other data compilations.” In the electronic discovery world, a document also refers to a collection of pages representing an electronic file. E-mails, attachments, databases, word documents, spreadsheets, and graphic files are all examples of electronic documents. |
| Document Date |
The original creation date of a document. For an email the document date is indicated by the date-stamp of the email. |
| Document Imaging Programs |
Software used to store, manage, retrieve and distribute documents quickly and easily on the computer. |
| Document Metadata |
Data about the document stored in the document, as opposed to document content. Often this data is not immediately viewable in the software application used to create/edit the document but often can be accessed via a “Properties” view. Examples include document author and company, and create and revision dates. Contrast with File System Metadata and Email Metadata. See also Metadata. |
| Document Retention |
The preservation of documents and data, including hard copy and electronic documents, databases and e-mails, that are created, sent and received in an organization’s ordinary course of business. |
| Document Retention Policy |
A systematic plan for reviewing, maintaining and destroying documents and data, including hard copy and electronic documents, databases and e-mails, that are created, sent and received in an organization’s ordinary course of business. |
| Document Type or Doc Type |
A typical field used in bibliographical coding. Typical doc type examples include letter, memo, report, article and others. |
| Domain |
A sub-network of servers and computers within a LAN. Domain information is useful when restoring backup tapes, particularly of email. |
| Domino Database |
Another name for Lotus Notes Databases versions 5.0 or higher. See NSF. |
| Dot Pitch |
Distance of one pixel in a CRT to the next pixel on the vertical plane. The smaller the number, the higher quality display. |
| DPI (Dots Per Inch) |
The measurement of the resolution of display in printing systems. A typical CRT screen provides 96 dpi, which provides 9,216 dots per square inch (96x96). When a paper document is scanned, the resolution, or level of detail, at which the scanning was performed is expressed in DPI. Typically, documents are scanned at 200 or 300 DPI. |
| Draft Record * |
A draft record is a preliminary version of a record before it has been completed, finalized, accepted, validated or filed. Such records include working files and notes. Records and information management policies may provide for the destruction of draft records upon finalization, acceptance, validation or filing of the final or official version of the record. However, draft records generally must be retained if (1) they are deemed to be subject to a legal hold; or (2) a specific law or regulation mandates |
| Drag-and-Drop |
The movement of on-screen objects by dragging them with the mouse, and dropping them in another place. |
| DRAM |
Dynamic Random Access Memory, a memory technology which is periodically “refreshed” or updated – as opposed to “static” RAM chips which do not require refreshing. The term is often used to refer to the memory chips themselves. |
| Drive Geometry |
A computer hard drive is made up of a number of rapidly rotating platters that have a set of read/write heads on both sides of each platter. Each platter is divided into a series of concentric rings called tracks. Each track is further divided into sections called sectors, and each sector is subdivided into bytes. Drive geometry refers to the number and positions of each of these structures. |
| Driver |
A driver is a computer program that controls various devices such as the keyboard, mouse, monitor, etc. |
| DSP (Digital Signal Processor/Processing) |
A special purpose computer (or technique) which digitally processes signals and electrical/analog waveforms. |
| DTP (Desktop Publishing) |
PC applications used to prepare direct print output or output suitable for printing presses. |
| Duplex |
Two-sided page(s). |
| Duplex Scanners vs. Double-Sided Scanning |
Duplex scanners automatically scan both sides of a doublesided page, producing two images at once. Double-sided scanning uses a single-sided scanner to scan double-sided pages, scanning one collated stack of paper, then flipping it over and scanning the other side. |
| DVD (Digital Video Disc or Digital Versatile Disc) |
A plastic disc, like a CD, on which data can be written and read. DVDs are faster, can hold more information, and can support more data formats than CDs. |
Back to Top |
E |
| ECM |
Enterprise content management. |
| EDI (Electronic Data Interchange) |
Eliminating forms altogether by encoding the data as close as possible to the point of the transaction; automated business information exchange. |
| EDMS (Electronic Document Management System) |
A system to electronically manage documents during all life cycles. See Electronic Document Management. |
| EGA (Extended Graphics Adapter) |
See VGA. |
| EIA |
Electronic Industries Association EIM |
| EISA (Extended Industry Standard Architecture) |
One of the standard buses used for PCs. |
| Electronic Discovery |
The process of collecting (also called “harvesting”), preparing, reviewing, and producing electronic documents in the context of the legal process These documents include e-mail, Web pages, word processing files, computer databases, and virtually anything that is stored on a computer. Technically, documents and data are “electronic” if they exist in a medium that can only be read through the use of computers. Such media include cache memory, magnetic disks (such as computer hard drives or floppy disks), |
| Electronic Document Management |
For paper documents, involves imaging, indexing/coding and archiving of scanned documents/images, and thereafter electronically managing them during all life cycle phases. Electronic documents are likewise electronically managed from creation to archiving and all stages in between. |
| Electronic Evidence |
According to Black's law dictionary, evidence is 'any species of proof, or probative matter, legally presented at the trial of an issue, by the act of parties and through the medium of witnesses, records, documents, exhibits, concrete objects, etc. for the purpose of inducing belief in the minds of the court or jury as their contention.' Electronic information generally is admissible into evidence in a legal proceeding. |
| Electronic File Processing |
Generally includes extraction of metadata from files, identification of duplicates/de-duplication and rendering of data into delimited format. |
| Electronic Image |
An electronic or digital picture of a document (e.g. TIFF, PDF, etc.). |
| Electronic Image |
An electronic or digital picture of a document; the most common image used in E-Discovery is TIFF (Tagged Information File Format) |
| Electronic Image Management (EIM) |
A term coined to indicate the creation, management and structure of electronic images (TIF, PDF, GIF, JPG, etc.) within an organization. |
| Electronic Mail (Email) |
Electronic communication generally in the form of text messages. |
| Electronic Mail Message |
Commonly referred to as “e-mail”, an electronic mail message is a document created or received via an electronic mail system, including brief notes, formal or substantive narrative documents, and any attachments, such as word processing and other electronic documents, which may be transmitted with the message. |
| Electronic Mail Message * |
A document created or received via an electronic mail system, including brief notes, formal or substantive narrative documents, and any attachments, such as word processing and other electronic documents, which may be transmitted with the message. |
| Electronic Mail/Email * |
An electronic means for communicating information under specified conditions, generally in the form of text messages, through systems that will send, store, process, and receive information and in which messages are held in storage until the addressee accesses them. |
| Electronic Record |
Information recorded in a form that requires a computer or other machine to process it and that otherwise satisfies the definition of a record. |
| Electronic Record * |
Information recorded in a form that requires a computer or other machine to process it and that otherwise satisfies the definition of a record. |
| Electrostatic Printing |
Paper is exposed to electron charge. Toner sticks to the charged pixels. |
| Em |
In any print, font or size is equal to the width of the letter “M” in that font and size. |
| E-mail |
Electronic mail or computer-based mail |
| Email address |
An electronic mail address. Internet email addresses follow the formula user- ID@domain-name; other email protocols may use different address formats. In some email systems, a user’s email address is “aliased” or represented by his or her natural name rather than a fully qualified email address. For example, john.doe@abc.com might appear simply as John Doe. |
| E-mail Message Store. |
A top most e-mail message store is the location in which an e-mail system stores its data. For instance, an Outlook PST (personal storage folder) is a type of top most file that is created when a user’s Microsoft Outlook mail account is set up. Additional Outlook PST files for that user can be created for backing up and archiving Outlook folders, messages, forms and files. Similar to a filing cabinet, which is not considered part of the paper documents contained in it, a top most store generally is not con |
| Email Metadata |
Data stored in the email about the email. Often this data is not even viewable in the email client application used to create the email. The amount of email metadata available for a particular email varies greatly depending on the email system. Contrast with File System Metadata and Document Metadata. |
| Email String |
A series of emails linked together by email responses or forwards. The series of email messages created through multiple responses and answers to an originating message. Also referred to as an email “thread.” Comments, revisions, attachments are all part of an email string. |
| Encryption |
A procedure that renders the contents of a message or file unintelligible to anyone not authorized to read it. |
| Encryption |
A procedure that renders the contents of a message or file scrambled or unintelligible to anyone not authorized to read it. Encryption is used to protect information as it moves from one computer to another and is an increasingly common way of sending credit card numbers and other personal information over the Internet. |
| Encryption Key |
A data value that is used to encrypt and decrypt data. The number of bits in the encryption key is a rough measure of the encryption strength; generally, the more bits in the encryption key, the more difficult it is to break. |
| End Document Number or End Doc# |
The last single page image of a document. |
| Endorser |
A small printer in a scanner that adds a document-control number or other endorsement to each scanned sheet. |
| Enhanced Titles |
A meaningful/descriptive title for a document. The opposite of Verbatim Titles. |
| Enterprise Architecture |
Framework for how software, computing, storage and networking systems should integrate and operate to meet the changing needs across an entire business |
| Enterprise User Information (EUI) |
Email, including attachments, and user files. |
| EOF (End of File) |
A distinctive code which uniquely marks the end of a data file. |
| EPP (Enhanced Parallel Port) |
Also known as Fast Mode Parallel Port. A new, industry standard parallel port, having higher transfer times competitive with SCSI. |
| EPS (Encapsulated PostScript) |
Uncompressed files for images, text and objects. Only print on PostScript printers. |
| Erasable Optical Drive |
A type of optical drive that uses erasable optical discs. |
| ESDI (Enhanced Small Device Interface) |
A defined, common electronic interface for transferring data between computers and peripherals, particularly disc drives. |
| ESI |
Electronically stored information. |
| Ethernet |
A common way of networking PCs to create a LAN. |
| Ethernet |
A common way of networking PCs to create a Local Area Network (LAN). |
| Evidentiary Image or Copy |
See Forensic Copy. |
| Exabyte |
A unit of 1000 petabytes. See Byte. |
| Export |
Data extracted or taken out of one environment or application usually in a prescribed format, and usually for import into another environment or application. |
| Extended Partitions |
If a computer hard drive has been divided into more than four partitions, extended partitions are created. Under such circumstances each extended partition contains a partition table in the first sector that describes how it is further subdivided. |
| Extensible Markup Language (XML) |
Short for Extensible Markup Language, a specification developed by the W3C (World Wide Web Consortium—the Web development standards board). XML is a pared-down version of SGML, designed especially for Web documents. It allows designers to create their own customized tag, enabling the definition, transmission, validation, and interpretation of data between applications and between organizations. |
| Extranet |
An Internet based access method to a corporate intranet site by limited or total access through a security firewall. This type of access is typically utilized in cases of joint venture and vendor client relationships. |
| Extrinsic Data |
Information about the file, such as file signature, author, size, name, path, and creation and modification dates. This data is the accumulation of what is in the file, on the media label, discovered by the operator, and contributed by the user. Collectively, it represents the real value of examining an electronic file as opposed to the printed version. |
Back to Top |
F |
| False Positive/Negative |
A result that is not correct. This may be a result of performing a process incorrectly or using a process that is not accurate. |
| Family Range |
A family range describes the range of documents from the first Bates production number assigned to the first page of the top most parent document through the last Bates production number assigned to the last page of the last child document. |
| Family Relationship |
A family relationship is formed among two or more documents that have a connection or relatedness because of some factor. |
| FAT (File Allocation Table) |
An internal data table on hard drives that keeps track of where the files are stored. If a FAT is corrupt, a drive may be unusable, yet the data may be retrievable with forensics. See Cluster File. |
| FAX |
Short for facsimile. A process of transmitting documents by scanning them to digital, converting to analog, transmitting over phone lines and reversing the process at the other end and printing. |
| Fed. R. Civ P |
“Federal Rules of Civil Procedure |
| Fiber Optics |
Transmitting information by sending light pulses over cables made from thin strands of glass. |
| Field (or Data Field) |
A name for an individual piece of standardized data, such as the author of a document, a recipient, the date of a document or any other piece of data common to most documents in an image collection, to be extracted from the collection. |
| Field Separator |
A code that separates the fields in a record. For example, the CSV format uses a comma as the field separator. |
| File |
Data stored under a specific name |
| File Allocation Table |
Microsoft operating systems store data in fixed length blocks of bytes called clusters, with the size of these blocks depending on the type of storage device and the size of the storage device. A File Location Table (FAT) is used to track the clusters that have been allocated to a specific file for Microsoft DOS, Windows, Windows 95, and Windows 98. The operating system relies upon the FAT to locate the data associated with a specific file and references in the FAT act as pointers to identify clusters by n |
| File Compression |
See Compression. |
| File Extension |
A tag of three or four letters, preceded by a period, which identifies a data file's format or the application used to create the file. File extensions can streamline the process of locating data. For example, if one is looking for incriminating pictures stored on a computer, one might begin with the .gif and .jpg files. |
| File Format |
The organization or characteristics of a file that allow it to be used with certain software programs. |
| File Level Binary Comparison |
Method of de-duplication using the digital fingerprint (hash) of a file. File Level Binary comparison ignores metadata, and can determine that “SHOPPING LIST.DOC” and “TOP SECRET.DOC” are actually the same document. See Data Verification, Digital Fingerprint, and Hash coding. See De-Duplication. File Plan A document containing the identifying number, title, description, and disposition authority of files held or used in an office. |
| File server |
When several or many computers are networked together in a LAN situation, one computer may be utilized as a storage location for files for the group. File servers may be employed to store e-mail, financial data, word processing information or to back-up the network. |
| File Server |
Utilized when many computer systems are connected together as part of a Local Area Network (LAN), a file server can retain email messages, financial data, word processing information, or be used to back-up the network. When several or many computers are networked together in a LAN situation, one computer may be utilized as a storage location for files for the group. File servers may be employed to store email, financial data, word processing information or to back-up the network. See Server. |
| File Sharing |
The ability for computer systems networked together to share files that are stored on the file server. |
| File Signature |
Within the file, the file signature is the information about the true program-related origin of the file and, therefore, its type. Tools for reading file signatures identify the true program source, even if the file extension has been changed. |
| File Slack |
The unused space on a cluster that exists when the logical file space is less than the physical file space. |
| File Slack Space |
File slack potentially contains randomly selected bytes of data from computer memory because DOS/Windows normally writes in 512 byte blocks called sectors. Clusters are made up of blocks of sectors. However, if there is not enough data in the file to fill the last sector in a file, DOS/Windows makes up the difference by padding the remaining space with data from the memory buffers of the operating system. This randomly selected data from memory is called 'RAM Slack' because it comes from the memory of the |
| File System |
The engine that an operating system or program uses to organize and kept track of files. More specifically, the logical structures and software routines used to control access to the storage on a hard disc system and the overall structure in which the files are named, stored, and organized. The file system plays a critical role in computer forensics because the file system determines the logical structure of the hard drive, including its cluster size. The file system also determines what happens to data wh |
| File System Metadata |
Data that can be obtained or extracted about a file from the file system storing the file. Examples include file creation time, last modification time, and last access time. |
Back to Top |
f |
| file transfer |
Moving named files from one computer or network to another |
Back to Top |
F |
| Filename |
The name of a file, excluding root drive and directory path information. Different operating systems may impose different restrictions on filenames, for example, by prohibiting use of certain characters in a filename or imposing a limit on the length of a filename. The filename extension should indicate what type of file it is. However, users often change filename extensions to evade firewall restrictions or for other reasons. Therefore, file types must be identified at a binary level rather than relying o |
| Filtering |
Electronic filtering of emails and files for privilege or by keyword, file, type, or name. Filtering removes files that do not fit the search criteria and reduces the volume of data that requires further investigation. |
| FIPS |
Federal Information Processing Standards issued by the National Institute of Standards and Technology after approval by the Secretary of Commerce pursuant to Section 111(d) of the Federal Property and Administrative Services Act of 1949, as amended by the Computer Security Act of 1987, Public Law 100-235. |
| Firewall |
A set of related programs that protect the resources of a private network from users from other networks. |
| Flatbed Scanner |
A flat-surface scanner that allows users to input books and other documents. |
| Floppy |
A thin magnetic film disk that is used as an older method for storing data. |
| Floppy Disc |
An increasingly rare storage medium consisting of a thin magnetic film disk housed in a protective sleeve. |
| Folder |
See Directory. |
| Forensic Copy |
A precise bit-by-bit copy of a computer system's hard drive, including slack and unallocated space. |
| Forensically Sound Procedures |
Procedures used for acquiring electronic information in a manner that ensures it is 'as originally discovered' and is reliable enough to be admitted into evidence. |
| Forensics |
Computer forensics is the scientific examination and analysis of data held on, or retrieved from, computer storage media in such a way that the information can be used as evidence in a court of law. It may include the secure collection of computer data; the examination of suspect data to determine details such as origin and content; the presentation of computer based information to courts of law; and the application of a country’s laws to computer practice. Forensics may involve recreating “deleted” or mis |
| Form of Production |
The manner in which requested documents are produced. Used to refer both to file format (native vs. PDF or TIFF) and the media on which the documents are produced (paper vs. electronic). |
| Format |
The internal structure of a file, which defines the way it is stored and used. Specific applications may define unique formats for their data (i.e., “MS Word document file format”). Many files may only be viewed or printed using their originating application or an application designed to work with compatible formats. Computer storage systems commonly identify files by a naming convention that denotes the format (and therefore the probable originating application) (i.e., “DOC” for Microsoft Word document fi |
| Format (verb) |
Makes a drive ready for first use. Erroneously thought to “wipe” drive. Typically, only overwrites FAT, but not files on the drive. |
| Forms Processing |
A specialized imaging application designed for handling pre-printed forms. Forms processing systems often use high-end (or multiple) OCR engines and elaborate data validation routines to extract hand-written or poor quality print from forms that go into a database. |
| Fragmented |
In the course of normal computer operations when files are saved, deleted or moved, the files or parts thereof may be broken into pieces, or fragmented, and scattered in various locations on the computer’s hard drive or other storage medium, such as removable discs. Data saved in contiguous clusters may be larger than contiguous free space, and it is broken up and randomly placed throughout the available storage space. See De-Fragment. |
| Fragmented Data |
Live data that has been disseminated and stored in multiple areas on a single hard drive or disk. |
| FTP (File Transfer Protocol) |
An Internet protocol that enables the transfer of files between computers over a network or the Internet. |
| Full Duplex |
Data communications devices which allow full speed transmission in both directions at the same time. |
| Full Path |
