— F —
File – Information stored together under a specified name.
File Allocation Table – Microsoft operating systems store data in fixed length blocks of bytes called clusters, with the size of these blocks depending on the type of storage device and the size of the storage device. A File Location Table (FAT) is used to track the clusters that have been allocated to a specific file for Microsoft DOS, Windows, Windows 95, and Windows 98. The operating system relies upon the FAT to locate the data associated with a specific file and references in the FAT act as pointers to identify clusters by numeric reference.
File Extension – Distinguishes a file's format or the application used to create the file and can be used to simplify the process of locating data.
File Server – Utilized when many computer systems are connected together as part of a LAN, a file server can retain email messages, financial data, word processing information, or be used to back-up the network.
File Sharing – The ability for computer systems networked together to share files that are stored on the file server.
File Signature – Within the file, the file signature is the information about the true program-related origin of the file and, therefore, its type. Tools for reading file signatures identify the true program source, even if the file extension has been changed.
File Slack Space – File slack potentially contains randomly selected bytes of data from computer memory because DOS/Windows normally writes in 512 byte blocks called sectors. Clusters are made up of blocks of sectors. However, if there is not enough data in the file to fill the last sector in a file, DOS/Windows makes up the difference by padding the remaining space with data from the memory buffers of the operating system. This randomly selected data from memory is called "RAM Slack" because it comes from the memory of the computer. RAM Slack can contain any information that may have been created, viewed, modified, downloaded, or copied during work sessions that have occurred since the computer was last booted. Thus, if the computer has not been shut down for several days, the data stored in file slack can come from work sessions that occurred in the past.
Filtering – Electronic filtering of emails and files for privilege or by keyword, file, type, or name. Filtering removes files that do not fit the search criteria and reduces the volume of data that requires further investigation.
Firewall – A system intended to thwart unauthorized access to or from a private network that is often used to also prevent unauthorized users from accessing private networks connected to the Internet.
Floppy – A thin magnetic film disk that is used as an older method for storing data.
Forensic Copy – A precise bit-by-bit copy of a computer system's hard drive, including slack and unallocated space.
Format – The manner in which a file is structured internally, which dictates the way it is stored and utilized. Specific types of formats include .DOC files that refer to Microsoft Word documents, .XLS files that refer to Microsoft Excel Spreadsheets, .TXT files for text files, among others.
Forensically Sound Procedures – Procedures used for acquiring electronic information in a manner that ensures it is "as originally discovered" and is reliable enough to be admitted into evidence.
Fragmented Data – Live data that has been disseminated and stored in multiple areas on a single hard drive or disk.
FTP (File Transfer Protocol) – An protocol used on the Internet for exchanging files.
|
 |
