F-I

fdisk

A utility that can be run from a bootable floppy disk that displays current disk partition information and allows you to repartition a hard disk.

Federal Rule of Civil Procedure 26

Federal Rule 26 states the General Provisions Governing Discovery and Duty of Disclosure. Section (a) states Required Disclosures and Methods to Discover Additional Matter.

File Allocation Table (FAT)

A simple filesystem used by DOS, but supported by later operating systems. The FAT resides at the beginning of a disk partition and acts as a table of contents for the stored data.

file viewer

A utility that provides thumbnail images of files. Such tools are useful for visually scanning a group of files.

filesystem

The operating system's method of organizing, managing, and accessing files through logical structuring on the hard drive.

FireWire

An IEEE-1394 technology that is a high- performance, external bus standard that supports data transfer and multimedia.

floppy drive

A drive accessible from the outside of the computer into which you can insert and/or remove a floppy disk. One floppy disk holds up to 1.4MB of data.

forensic compression

The compacting of an image file by compressing redundant sectors to reduce the amount of space it takes up.

forensic suite

A set of tools and/or software programs used to analyze a computer for collection of evidence.

forensically sound

Procedures whereby absolutely no alteration is caused to stored data so that all evidence is preserved and protected from all contamination.

hard evidence

Real evidence that is conclusively associated with a suspect or activity.

hardware-protected areas (HPAs)

Areas of a hard disk created to specifically allow manufacturers to hide diagnostic and recovery tools.

hash

A mathematical function that creates a fixed- length string from a message of any length. The result of a hash function is the hash value, sometimes called a message digest. Hash functions are one-way functions. That is, you can create a hash value from a message, but you cannot create a message from a hash value.

High-Performance File System (HPFS)

A file- system designed for the OS/2 operating system. HPFS automatically sorts the directory based on the file- name , and it includes the super block and spare block.

honeypot

A specially equipped system deployed to lure hackers and track their use of the system's resources.

hybrid attack

A modification of the dictionary attack that tries different permutations of each dictionary entry.

HyperText Markup Language (HTML)

A web-based programming language used to create documents that are portable from one platform to another.

IDE port

The Integrated Drive Electronics (IDE) port is a system-level interface that allows the operating system to recognize a hard drive as part of the system.

incident

Any violation, or intended violation, of security policy.

incident response

The action taken to respond to a situation that can be recovered from relatively quickly.

incident response plan

The actions an organization takes when it detects an attack, whether ongoing or after the fact.

incident response team (IRT)

A team of individuals trained and prepared to recognize and immediately respond appropriately to any security incident.

input/output (I/O)

Data transfer that occurs between the thinking part of the computer or CPU and an external device or peripheral. For example, when you type on your keyboard, the keyboard sends input to the computer which in turn , outputs what you type on the screen.

International Association of Computer Investigative Specialists (IACIS)

An international volunteer corporation comprised of law enforcement professionals including federal, state, local, and international law enforcement who are committed to education in the field of forensic computer science.

Internet service provider (ISP)

Provides a gateway to the Internet and other online services, primarily as a paid service.

intrusion detection

Software and hardware agents that monitor network traffic for patterns that may indicate an attempt at intrusion.

IP address

An identifier for a computer or device on a TCP/IP network.