425-373-3349 info@ediscoveryinc.com


Active Data Files that can be seen on a computer by the average user.  Does not include deleted files or system files that may be hidden.
ASCII American Standard Code for Information Interchange.  Standard text with no formatting which means it can be read by most computer programs.
Backup tapes Backup tapes are a form of media used to store data.  Some of the most common types of backup tapes are DAT, DLT and LTO.  All tapes are NOT created equal.  A DAT tape usually holds a few hundred MEGABYTES whereas an LTO tape can hold a few hundred GIGABYTES (1024 MBs = 1 GB).
Bit-Stream Copy Also called an evidentiary image. This is an exact sector by sector copy of a hard drive which allows for retrieval of deleted files.


Unit of measurement for digital data.  One byte = one character.
Computer Forensics Recovering deleted files and determining the activity of a computer user.
De-Dupe Shorthand for de-duplication.  The concept of removing all duplicate documents seems straight-forward, but actually raises many questions.  Is the same email in two different inboxes truly a duplicate?  And what process is used to de-duplicate?  The standard method is by using hash values (see below) but this is generally not very effective on email.
Electronic Discovery Acquiring digital media for production in litigation.  Has also been used to describe the process of converting paper files to digital media (e.g., TIFF and OCR files).
Evidentiary Image Same as a bit-stream copy. An exact sector by sector copy of a hard drive that allows for retrieval of deleted files.
File extension Typically the last three characters of a file name after the period that indicates the program or application used to create the document.  For example, Word documents end with a .doc file extension, Excel spreadsheets have a .xls file extension and Word Perfect uses .wpd file extension.
Fragments Portions of data that are left on a hard drive.  Does not include full documents or email content, but words or sentences that are left on the hard drive from activity on the computer.
Geolocation Locating a device or object based on the a number of factors, including IP address, EFIX data in photographs and GPS coordinates.
Gigabyte 1024 MB = 1 gigabyte (GB) – A DVD holds ~4.7 gigabytes (GB).
Hash value The “DNA” or fingerprint for a digital file.  A string of characters that is unique to that particular file or group of files.  MD-5 and SHA are the two most common algorithms used to create hash values.   Hash values can be used to de-dupe files or to confirm authenticity.
Image This word can have numerous meanings in electronic discovery vernacular.  An image is a picture and is often used to describe TIFF files created from paper documents.  But it is also used to describe a copy of a hard drive or other digital media (such as a Ghost image).
Kilobyte 1024 bytes = 1 kilobyte (KB).  Most files are measured in kilobytes (KB).  This document is 45 KB
Logical Image While it is not an entirely accurate technical description, this phrase is often used to signify an image that only contains the active data and not the unallocated or free space of the drive.  Without the unallocated space of the hard drive, recovery of deleted data is impossible.
Lotus Notes Made by IBM.  One of the two most common corporate email programs.  The other is Microsoft’s Outlook.
Megabyte 1024 KB = 1 megabyte (MB).   A 2.5” floppy disk would hold 1.4 MB and a typical CD holds ~750 MB.
Metadata Data about data.  Information such as the author, date created and date modified.  There is file or system metadata and document or application metadata.  File metadata is assigned by the computer’s operating system whereas document metadata is assigned by the application or program used to create the file.  If a file is moved from one location to another the file metadata will change, but most of the document metadata will remain intact.
.msg file An individual email file, commonly associated with Outlook or Outlook Express.
Native File Format A file that is in its original format (e.g., Word document, Excel spreadsheet, .pst file, etc.).
NAS Network Attached Storage.  A device that is similar to a server and stores files for access by multiple users.
.nsf file A database store for Lotus Notes.  Typically contains email, contacts, calendar items and journal entries.  Similar to Outlook’s .pst file
OCR Optical Character Recognition.  A software program converts the text of a printed document to digital format so the document can be searched.  Accuracy rates can vary widely depending on numerous factors such as the quality of the original and the program used for scanning which obviously impacts the validity of any search results.
Outlook One of the two most common corporate email programs (the other is Lotus Notes).  Made by Microsoft and needs to be purchased, but typically comes as part of one of the Microsoft Office packages.
OST file Offline Storage Table. Similar to a .pst file but will synchronize with the Exchange server.  The default setting for Exchange 2007 and above is to have an OST file on the individual user’s hard drive.
Physical Image The same as a bit-stream copy where the entire contents of the device are acquired.
PST file Personal Stores Table.  The compressed file used by Outlook to store an individual user’s email, contacts, calendar items, journal entries and notes.  Similar to Lotus Notes’ .nsf file.
SAN Storage Area Network.  This is different from a NAS in that the files are stored at the block level instead of the file system level.  This type of storage is typically used for backups or other large data groups.
Slack Space A portion of the hard drive between where one file ends and another file begins. This can be an important place to look if searching for old deleted data.
Terabyte 1024 GB = 1 terabyte (TB).  This is an enormous amount of data.
TIFF or TIF Tagged Image File Format.  A graphic file that is commonly used by litigation support vendors to create pictures of either digital or paper documents.
Unallocated Space The portion of the hard drive that is not allocated to active files.   When a file is deleted, only the link to the file is removed.  The actual file remains in the unallocated space of the hard drive until it has been overwritten.
Web-based email As the name implies, email that is accessed and stored on the Internet.  This includes programs such as Hotmail, Gmail, Yahoo and others.  Typically these programs store the email on their own servers, but the email can be moved down to the user’s computer.