— M —
Master File Table (MFT) – A unique system file that essentially acts as a database, containing information on all the files and subdirectories located within the NTFS logical volume (partition). There is at least one record for every file and subdirectory on the NTFS logical volume and each one is 1024 bytes in length and contains information, known as attributes, that tell the system how to deal with the file or directory associated with the record. If the full 1024 bytes are not used, the record can contain information from previous files, which is known as MFT slack. Knowledge of this MFT slack is vital to investigators because a computer forensics utility that captures file slack does not capture MFT slack.
In addition, the MFT sometimes stores the actual file data along with all the system data relating to the file, which is known as resident data. Resident data can have significant meaning concerning computer security issues regarding the potential leakage of sensitive data.
Media – The physical material used to store electronic data. Media includes hard drives, backup tapes, computer disks, CD, DVD, PDA memory, etc.
Media Conversion – Moving data from one type of media to another such as tape to CD.
Merge – The process of merging various email files into one file for de-duplication purposes.
Megabyte (Meg) – One megabyte of data is equal to one million bytes.
Meta-data – Electronic information about a file that travels with the electronic file (file properties, Microsoft software, and OS meta-data).
Migrated Data – Data that has been transferred from one database or format to another that is generally done when migrating from one form of hardware or software technology to another.
MIS (Management Information Systems) – In general, a computer-based system that provides IT personnel with the necessary tools for categorizing, assessing, and efficiently running an organization's computer systems.
Mirror Image – A mirror image entails the creation of a true bit-by-bit copy of a computer hard drive and such an image must be created before computer forensics or electronic discovery are performed to ensure that no data on the original hard drive will be altered. Also known as the creation of a forensic duplication, clone, or forensic image.
MIS – Management information systems.
Modem – A device that allows a computer system to transmit data over telephone or cable lines.
|
 |
