Digital evidence terminology, for attorneys

Forensic image

A bit-for-bit copy of a storage device, including deleted data and unused space — not a copy of the visible files.

Why it matters: Copying files captures what the file system currently lists. Imaging captures everything, including deleted records and unallocated space. An examination performed on a file copy cannot recover what an examination on an image can.

Ask: Was a forensic image made, or were files copied off the device?

Write blocker

Hardware or software that permits reading a device while physically preventing anything from being written to it.

Why it matters: Simply connecting a drive to a running computer can modify timestamps and write recovery data. A write blocker is what allows an examiner to testify that the original was not altered during acquisition.

Hash value (MD5, SHA-1, SHA-256)

A fixed-length fingerprint calculated from a file's contents. Any change to the data produces a completely different value.

Why it matters: Matching hashes between source and image establish the copy is faithful. But a hash mismatch between two versions of a video does not prove tampering — it proves they are different digital objects, which is expected whenever anything is re-encoded, previewed, or redacted.

Ask: Were hashes calculated at acquisition, and does the copy I received match the evidence-system master?

Chain of custody

The documented record of who had the evidence, when, and what they did with it — from seizure through examination to court.

Why it matters: For digital evidence the chain often has a weak half. Platform records may be immaculate from the moment of upload while everything before it rests on one person's testimony. Ask about both halves separately.

Native file

The file as originally produced by the recording device or system, in its original format, with its original metadata.

Why it matters: Nearly every problem in the case studies on this site traces back to something other than a native file being treated as one — a preview, an export, a conversion, or a presentation embed.

Ask: Is this the native file, a forensic copy, an export, a preview, a redacted version, or a demonstrative?

Master File Table (MFT)

The index NTFS keeps of every file on the volume — name, path, size, timestamps, and where the data lives.

Why it matters: Deleting a file usually leaves its MFT record intact for some time. That means an examiner can often establish that a specific file existed, what it was called, where it lived, and when it was created and modified, even when the contents are gone.

Unallocated space

Storage the file system considers free — which commonly still contains the contents of deleted files until it is reused.

Why it matters: This is where deleted data actually lives. It is also what a logical copy skips entirely, which is why the acquisition method determines what can be found.

File carving

Recovering files from unallocated space by recognizing their internal structure rather than relying on file-system records.

Why it matters: Carving can recover fragments when the file-system record is gone — partial documents, video segments, images. Partial recovery is still probative: a fragment can establish that a file existed and what it contained.

Windows Registry

The system configuration database, which also records device connections, user activity, and program execution.

Why it matters: The Registry records USB devices by serial number and when they connected. That is how a specific physical device gets tied to a specific computer at a specific time.

LNK files and Jump Lists

Shortcut and recent-file records Windows creates automatically when a document is opened, including from external drives.

Why it matters: These survive the file. A LNK record can establish that a document was opened from a particular USB drive on a particular date long after both the document and any copy of it are gone.

Prefetch and USN Journal

Records of program execution and of file-system changes, maintained automatically by Windows.

Why it matters: They answer questions the files cannot: what programs ran and when, and what was created, renamed, or deleted on the volume — including mass-deletion events.

Volume Shadow Copies

Point-in-time snapshots Windows creates for system restore and backup.

Why it matters: A file deleted today may still exist inside a snapshot from last month. Shadow copies are one of the more commonly overlooked recovery sources.

TRIM (on SSDs)

A command that lets a solid-state drive erase deleted data in the background, for performance reasons.

Why it matters: On a TRIM-enabled SSD, deleted data is frequently destroyed within minutes and is genuinely unrecoverable. On a traditional hard drive the same data may persist for months. "We couldn't recover it" means very different things on the two.

Ask: What kind of storage was it, and was TRIM active?

Format versus wipe

Formatting rebuilds the file-system index and typically leaves the underlying data intact. Wiping overwrites the data itself.

Why it matters: A formatted drive or reformatted memory card is routinely recoverable. People — and reports — use the two words interchangeably, and they describe completely different outcomes.

Physical damage versus logical failure

A drive that has failed mechanically or electrically, versus one that is intact but has corrupted structures.

Why it matters: Physical damage requires a recovery lab — cleanroom work, board-level repair, chip-off extraction. Most forensic examiners image devices; they do not repair them, which is why "no data recoverable" is sometimes a statement about capability rather than about the device.

Chip-off extraction

Removing the memory chip from a damaged device and reading it directly.

Why it matters: It is often the last option for a phone or flash device that will not power on, and it is why a destroyed device is not automatically a dead end.

Logical, file-system, and physical extraction

Three depths of phone acquisition. Logical returns what the phone's own interfaces expose. File-system reaches the databases and application files. Physical captures the storage itself.

Why it matters: A logical extraction that found no deleted messages proves nothing about whether deleted messages exist — it was never going to look in the right place. The extraction level is the context for every negative finding.

Ask: What extraction level was performed, and what would a deeper acquisition have reached?

SQLite, WAL, and free pages

Messaging and app data lives in SQLite databases. Deleted rows commonly persist in the database's free pages and its write-ahead log.

Why it matters: This is where deleted messages are actually recovered from. It also explains why recovery sometimes fails — a vacuum operation or heavy use can clear those structures permanently.

Notification artifacts

Records the operating system keeps when a message arrives, often including a truncated preview of the text.

Why it matters: An independent corroboration source that survives deletion of the message itself. Frequently the difference between a screenshot standing alone and a screenshot supported by the device.

Cloud backup

A copy of device data held by the platform, often predating deletions or a device replacement.

Why it matters: When a phone has been wiped, lost, or replaced, the backup routinely survives. Always ask about it before accepting that a device's contents are gone.

Container versus codec

The container is the file structure — MP4, AVI, MOV. The codec is how the stream inside it is encoded — H.264, H.265, MJPEG.

Why it matters: Changing the container can leave the video stream untouched. Transcoding replaces the stream itself, altering compression, timing, and quality. Convenience tools transcode by default.

Transcoding

Re-encoding video or audio into a different format, usually so it will play on standard software.

Why it matters: "I converted it so I could open it" is an extremely common and almost never documented step. It changes the exhibit, and any measurement taken from the converted file inherits the change.

Ask: Was this file converted between the recording system and me, and with what software?

Variable frame rate (VFR)

Recording where the interval between frames varies — standard on motion-triggered surveillance systems.

Why it matters: Forcing VFR footage to a constant frame rate duplicates frames and compresses intervals. Any speed, distance, or timing calculation done on that file is unreliable, because the timing it depends on was manufactured.

Audio normalization

Automatic processing that raises the signal level so quiet audio sounds louder.

Why it matters: It also lifts background noise and can make an ambiguous word sound intelligible. When the disputed fact is what someone said, the jury may be hearing a processed version that is acoustically different from the evidence.

Frame interpolation

Synthetic frames calculated between real ones, used to generate smooth slow motion.

Why it matters: Interpolated frames were never recorded. Slow-motion social-media video can make a movement look clearer and more deliberate than the source footage actually supports.

Generations

Each copy, export, conversion, or embed a file passes through on its way to court.

Why it matters: An exhibit can look like the original while being four or five generations removed from it. Establishing which generation is being offered is the first question in any video dispute.

Native, derivative, preview, and demonstrative

The original file; any processed copy; a simplified version generated by a platform for viewing; and an exhibit prepared to illustrate testimony.

Why it matters: These four are routinely described with the same word — "the video." They have different evidentiary status, and the difference is worth putting on the record.

CSLI (cell-site location information)

Records of which tower and sector carried a call or data session.

Why it matters: CSLI is not GPS. It establishes which sector served the phone, and sector coverage varies with terrain, load, and network configuration. "Consistent with the area" and "located at the scene" are different statements that sound identical to a jury.

EXIF and QuickTime metadata

Data embedded in photos and videos by the recording device — time, camera model, settings, sometimes GPS.

Why it matters: Messaging apps and upload platforms routinely strip it. When they do, the surviving timestamp often reflects the download or upload, not the recording.

Ask: Did this file reach the investigator through a messaging app or an upload platform?

Drone telemetry / flight logs

Position, altitude, heading, camera angle, and flight path recorded by the controlling application.

Why it matters: Drone video without telemetry cannot establish where the camera was, which means it cannot support a claim about distances or boundaries. The logs live on the pilot's phone or tablet and survive the memory card being wiped.

UTC versus local time

Systems store timestamps in Coordinated Universal Time; interfaces display local time using the device's current timezone setting.

Why it matters: This is the single most common timeline error in digital evidence. Timezone changes during travel, daylight saving, and app-specific epoch formats routinely move an event by hours — sometimes across the line that defines the offense.

Ask: Was every timestamp in this timeline normalized, and from what source?

MACB timestamps

Modified, Accessed, Created, and Born times a file system records — which do not always mean what their names suggest.

Why it matters: Copying, syncing, backup software, and antivirus scans all update these. A creation time later than a modification time is common and not evidence of anything by itself.

Audit log

The platform's record of uploads, access, categorization, previews, replacements, exports, and deletions.

Why it matters: It answers questions the media files cannot: whether other footage existed, who accessed it, whether anything was replaced, and why something was deleted. It is discoverable and it is rarely produced unless requested by name.

Ask: Can I have the platform audit logs for every exhibit in this case?

Categorization and retention

The label applied to a file at upload, which determines how long the platform keeps it before automatic deletion.

Why it matters: Footage categorized as non-evidentiary, or left uncategorized, commonly carries a short retention period and is deleted on schedule with no human decision. This is a frequent and entirely mundane cause of missing video.

Platform preview

A simplified, re-encoded copy the platform generates so files play in any browser.

Why it matters: It is usually what the defense downloads. It lacks the original hash, camera identifiers, GPS track, event markers, and annotations that the uploaded master carries.

Redaction log

The record of who redacted a file, when, which regions were blurred, which intervals were muted, and on what stated basis.

Why it matters: It is how an over-broad redaction is identified without seeing the redacted content. If a mute interval overlaps the moment in dispute, that is visible from the log alone.

Replacement history

The platform's record of a file being superseded by a later version after the original upload.

Why it matters: The defense typically receives only the current version. That an earlier one existed, and why it was replaced, is in the history rather than the download.

Pre-event buffer

Footage a body-worn camera retains from the seconds before it was formally activated, often without audio.

Why it matters: When a camera is activated after an encounter begins, the buffer may be the only recording of how it began — which is frequently the disputed part.

Account versus device versus human

Three different findings: an account performed an action, a device recorded an action, and a specific person performed it.

Why it matters: Artifacts routinely establish the first two and cannot establish the third. Shared credentials, administrator access, remote sessions, and shared devices all produce traces identical to the account owner's.

Ask: Does this evidence identify a person, or an account and a device?

"Consistent with"

A phrase indicating the evidence does not exclude a proposition — not that it establishes it.

Why it matters: It is the most load-bearing phrase in forensic testimony and the most likely to be heard by a jury as confirmation. Ask what else the evidence would also be consistent with.

Absence of evidence

A finding that something was not located — which has many possible causes.

Why it matters: A message not found on a phone may have been deleted, or may never have existed, or may have been destroyed by vacuuming, encryption, a reset, an OS update, or an extraction method that could not reach it. All of those look identical in a report that only says "not found."

Spoliation

Loss or destruction of evidence after a duty to preserve it has attached.

Why it matters: It is frequently provable from artifacts about a missing file — access logs, export records, file-system remnants — even when the file itself is unrecoverable. The absence of the evidence does not end the inquiry.