Active DataFiles that can be seen on a computer by the average user.  Does not include deleted files or system files that may be hidden.
ASCIIAmerican Standard Code for Information Interchange.  Standard text with no formatting which means it can be read by most computer programs.
Backup tapesBackup tapes are a form of media used to store data.  Some of the most common types of backup tapes are DAT, DLT and LTO.  All tapes are NOT created equal.  A DAT tape usually holds a few hundred MEGABYTES whereas an LTO tape can hold a few hundred GIGABYTES (1024 MBs = 1 GB).
Bit-Stream CopyAlso called an evidentiary image. This is an exact sector by sector copy of a hard drive which allows for retrieval of deleted files.


Unit of measurement for digital data.  One byte = one character.
Computer ForensicsRecovering deleted files and determining the activity of a computer user.
De-DupeShorthand for de-duplication.  The concept of removing all duplicate documents seems straight-forward, but actually raises many questions.  Is the same email in two different inboxes truly a duplicate?  And what process is used to de-duplicate?  The standard method is by using hash values (see below) but this is generally not very effective on email.
Electronic DiscoveryAcquiring digital media for production in litigation.  Has also been used to describe the process of converting paper files to digital media (e.g., TIFF and OCR files).
Evidentiary ImageSame as a bit-stream copy. An exact sector by sector copy of a hard drive that allows for retrieval of deleted files.
File extensionTypically the last three characters of a file name after the period that indicates the program or application used to create the document.  For example, Word documents end with a .doc file extension, Excel spreadsheets have a .xls file extension and Word Perfect uses .wpd file extension.
FragmentsPortions of data that are left on a hard drive.  Does not include full documents or email content, but words or sentences that are left on the hard drive from activity on the computer.
GeolocationLocating a device or object based on the a number of factors, including IP address, EFIX data in photographs and GPS coordinates.
Gigabyte1024 MB = 1 gigabyte (GB) – A DVD holds ~4.7 gigabytes (GB).
Hash valueThe “DNA” or fingerprint for a digital file.  A string of characters that is unique to that particular file or group of files.  MD-5 and SHA are the two most common algorithms used to create hash values.   Hash values can be used to de-dupe files or to confirm authenticity.
ImageThis word can have numerous meanings in electronic discovery vernacular.  An image is a picture and is often used to describe TIFF files created from paper documents.  But it is also used to describe a copy of a hard drive or other digital media (such as a Ghost image).
Kilobyte1024 bytes = 1 kilobyte (KB).  Most files are measured in kilobytes (KB).  This document is 45 KB
Logical ImageWhile it is not an entirely accurate technical description, this phrase is often used to signify an image that only contains the active data and not the unallocated or free space of the drive.  Without the unallocated space of the hard drive, recovery of deleted data is impossible.
Lotus NotesMade by IBM.  One of the two most common corporate email programs.  The other is Microsoft’s Outlook.
Megabyte1024 KB = 1 megabyte (MB).   A 2.5” floppy disk would hold 1.4 MB and a typical CD holds ~750 MB.
MetadataData about data.  Information such as the author, date created and date modified.  There is file or system metadata and document or application metadata.  File metadata is assigned by the computer’s operating system whereas document metadata is assigned by the application or program used to create the file.  If a file is moved from one location to another the file metadata will change, but most of the document metadata will remain intact.
.msg fileAn individual email file, commonly associated with Outlook or Outlook Express.
Native File FormatA file that is in its original format (e.g., Word document, Excel spreadsheet, .pst file, etc.).
NASNetwork Attached Storage.  A device that is similar to a server and stores files for access by multiple users.
.nsf fileA database store for Lotus Notes.  Typically contains email, contacts, calendar items and journal entries.  Similar to Outlook’s .pst file
OCROptical Character Recognition.  A software program converts the text of a printed document to digital format so the document can be searched.  Accuracy rates can vary widely depending on numerous factors such as the quality of the original and the program used for scanning which obviously impacts the validity of any search results.
OutlookOne of the two most common corporate email programs (the other is Lotus Notes).  Made by Microsoft and needs to be purchased, but typically comes as part of one of the Microsoft Office packages.
OST fileOffline Storage Table. Similar to a .pst file but will synchronize with the Exchange server.  The default setting for Exchange 2007 and above is to have an OST file on the individual user’s hard drive.
Physical ImageThe same as a bit-stream copy where the entire contents of the device are acquired.
PST filePersonal Stores Table.  The compressed file used by Outlook to store an individual user’s email, contacts, calendar items, journal entries and notes.  Similar to Lotus Notes’ .nsf file.
SANStorage Area Network.  This is different from a NAS in that the files are stored at the block level instead of the file system level.  This type of storage is typically used for backups or other large data groups.
Slack SpaceA portion of the hard drive between where one file ends and another file begins. This can be an important place to look if searching for old deleted data.
Terabyte1024 GB = 1 terabyte (TB).  This is an enormous amount of data.
TIFF or TIFTagged Image File Format.  A graphic file that is commonly used by litigation support vendors to create pictures of either digital or paper documents.
Unallocated SpaceThe portion of the hard drive that is not allocated to active files.   When a file is deleted, only the link to the file is removed.  The actual file remains in the unallocated space of the hard drive until it has been overwritten.
Web-based emailAs the name implies, email that is accessed and stored on the Internet.  This includes programs such as Hotmail, Gmail, Yahoo and others.  Typically these programs store the email on their own servers, but the email can be moved down to the user’s computer.



12828 Northup Way, Suite 120
Bellevue, WA 98005-1935


MEET eDiscovery Inc.


Tel: (425)-373-3349