40 glossary terms

Glossary

Plain-language definitions of Windows forensics terms and concepts.

Alternate Data Stream (ADS): An additional named $DATA stream attached to an NTFS file, invisible in Explorer, used for Mark of the Web and sometimes to hide data.
Anti-forensics: Techniques used to destroy, hide or falsify evidence, such as log clearing, timestomping, wiping and deleting shadow copies or the USN journal.
ControlSet and CurrentControlSet: The numbered configuration sets in the SYSTEM hive; CurrentControlSet is a runtime link that does not exist in an offline hive file.
ESE database (Extensible Storage Engine): Microsoft's embedded transactional database format behind SRUM, WebCache, the Windows Search index and the BITS queue, often found dirty.
Event Tracing for Windows (ETW): The kernel-level tracing framework in which providers emit events to sessions; it feeds the event logs, .etl files and security tools.
Windows event ID: The number identifying an event type within a given provider; it only has meaning when paired with its provider and log channel.
Evidence of execution: Artifacts that show a program actually ran on a Windows system, as opposed to merely existing on disk, and how strongly each one supports that claim.
File carving: Recovering files from raw disk data using content signatures such as headers and footers, without relying on file system metadata.
File slack: The unused space between the end of a file's data and the end of its last allocated cluster, which can hold remnants of earlier files.
FILETIME: The 64-bit Windows timestamp format counting 100-nanosecond intervals since 1 January 1601 UTC, used by NTFS, the registry and many artifacts.
Jump List AppID: The 16-hex-character identifier that names each Jump List file and maps it back to the application that created it.
Registry key LastWrite time: The single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.
Lateral movement: An attacker moving from one compromised host to others in the network, using RDP, SMB, PsExec, WMI, WinRM or remote tasks and services.
Logon type: The numeric field in logon events 4624 and 4625 that says how an account logged on: console, network, service, RDP, cached and more.
LOLBin (living-off-the-land binary): A legitimate, signed Windows binary that attackers abuse to download, execute or hide payloads without dropping their own tools.
Mark of the Web (MOTW): The Zone.Identifier alternate data stream Windows adds to downloaded files, recording the security zone and often the source URL.
MFT file reference number: The 64-bit NTFS identifier of a file: a 48-bit MFT entry number plus a 16-bit sequence number that changes each time the entry is reused.
NTFS: NTFS (New Technology File System) is the default Windows file system; its metadata files such as $MFT, $LogFile and $UsnJrnl are core forensic sources.
NTUSER.DAT: The per-user registry hive stored in each Windows profile and loaded as HKEY_CURRENT_USER, rich in user activity and persistence traces.
Persistence: Mechanisms that let malware or an attacker survive reboots and logoffs, such as Run keys, services, scheduled tasks or WMI subscriptions.
Registry transaction logs (.LOG1/.LOG2): The .LOG1 and .LOG2 files next to each registry hive that record pending writes; on Windows 8.1 and later they can hold data missing from the hive.
Resident data: File content small enough to be stored directly inside its NTFS MFT record instead of in separate clusters on the volume.
Security Identifier (SID): The unique value Windows uses to identify users, groups and computers, such as S-1-5-21-…-1001, found throughout registry, logs and file paths.
Shell item (ShellItem / PIDL): A binary structure identifying one element of the Windows Shell namespace, chained into ID lists inside ShellBags, LNK files and Jump Lists.
SQLite write-ahead log (-wal): The -wal sidecar file where SQLite writes recent changes before merging them into the main database; often holds the newest evidence.
$STANDARD_INFORMATION vs $FILE_NAME: The two NTFS attributes that each hold a set of MACB timestamps; comparing them is a core technique for detecting timestomping.
Super timeline: A single chronological view merging timestamps from the file system, registry, event logs and other artifacts, typically built with Plaso.
Triage collection: Targeted acquisition of high-value artifacts (hives, event logs, $MFT, Prefetch) instead of a full disk image, using KAPE or Velociraptor.
Unallocated space: Clusters a file system currently marks as free; they often still contain data from deleted files until new data overwrites them.
UsrClass.dat: The second per-user registry hive, mapped to HKCU\Software\Classes and holding ShellBags, MUICache and per-user COM registrations.
UTC vs local time in Windows artifacts: Why some Windows artifacts record UTC and others local time, and how the TimeZoneInformation registry key helps normalize a forensic timeline.
Volume serial number: The identifier written to a volume when it is formatted; recorded in LNK files and Prefetch, it ties file activity to a specific volume.
Chain of Custody: The documented, unbroken record of who handled a piece of evidence, when, and why, ensuring its integrity and admissibility.
MACB Timestamps: The four NTFS file times — Modified, Accessed, Changed (MFT entry), and Born (created) — used to build forensic timelines.
Master File Table (MFT): The NTFS metadata index, stored as `$MFT`, holding one record per file and directory on a volume.
Order of Volatility: The principle of collecting the most volatile evidence first, before it is lost, as described in RFC 3227.
Registry Hive: An on-disk file that backs part of the Windows Registry, such as `SYSTEM`, `SOFTWARE`, or `NTUSER.DAT`.
Timestomping: An anti-forensic technique that alters a file's timestamps to hide when it was created, modified, or accessed.
Volume Shadow Copy (VSS): A Windows service that creates point-in-time snapshots of a volume, letting investigators recover earlier file and registry states.
Write Blocker: A hardware or software control that prevents any writes to evidence media during acquisition, preserving its integrity.