Glossary of Digital Evidence & Cybercrime

A documented and unbroken chronological record tracking the custody, transfer, analysis, and disposition of digital evidence, ensuring admissibility, provenance, and mathematical integrity from initial acquisition to trial.

An emergency provisional measure obliging service providers or data custodians to rapidly preserve volatile stored computer data (traffic data, subscriber records, and server logs) at imminent risk of deletion, pending a formal judicial production order or mutual legal assistance request.

Large-scale network address translation mechanism used by ISPs to share a single public IPv4 address among hundreds or thousands of subscribers. In CGNAT architectures, identifying an individual endpoint strictly requires the combination of Public IP + Source Port + Sub-second UTC Timestamp.

A deterministic one-way cryptographic mathematical algorithm (such as SHA-256) that maps arbitrary data into a fixed-length string, serving as the immutable digital fingerprint of evidence where any single-bit alteration cascades into an entirely different hash value (avalanche effect).

A court order issued by a competent judicial authority requiring a service provider, corporation, or individual possessing or controlling specified computer data (subscriber info, traffic logs, or stored contents) to produce that data to law enforcement.

The systematic collection, validation, and forensic analysis of publicly accessible information (web resources, social network profiles, DNS/Whois databases, EXIF metadata, public ledgers) to produce actionable investigative intelligence.

Digital data residing in short-term or transient electronic storage (system RAM, CPU caches, routing tables, active socket connections, mounted encrypted volumes) that is permanently lost when the system is powered off or rebooted.

Forensic heuristic clustering and topological analysis of transactions on distributed public ledgers to de-anonymize wallet addresses, identify intermediary mixing pools, cross-chain hops, and trace illicit fund flows to centralized VASPs subject to KYC.

An exact, verifiable bit-stream physical duplicate of a digital storage medium (HDD, SSD, NVMe, flash partition) replicating every allocated sector, slack space, file table artifact, and unallocated sector containing deleted data.

Structured log records regarding network access and web application usage. Connection logs link user identities to IP assignments (1-year statutory ISP retention in Brazil). Application logs record specific feature transactions, source IPs, and UTC timestamps (6-month retention under Marco Civil).

Court-authorized real-time interception and wiretapping of in-transit electronic communications as packets traverse telecommunications backbones or intermediate servers, as opposed to static post-factum stored data disclosure.

Operational international network established by the Budapest Convention designating a dedicated 24/7 contact point in each State Party to provide immediate mutual assistance for ongoing transnational cyber investigations and emergency data preservation.

Exchangeable Image File Format (EXIF) attributes embedded in digital media header structures recording camera hardware specs, GPS coordinates, exposure settings, serial numbers, and UTC timestamps.

Methodological division in mobile forensics. Logical acquisition interacts with OS APIs to extract accessible structured records. Physical acquisition bypasses userland to dump raw NAND flash bit-for-bit, enabling carving of deleted SQLite records and slack space.

Cyber fraud tactic forging email envelope/header fields to impersonate legitimate senders. Forensics validates cryptographic server records across SPF (authorized IP range), DKIM (public key signature in headers), and DMARC enforcement policies.

Hyper-realistic synthetic media generation using generative artificial intelligence architectures (GANs, Latent Diffusion Models, neural voice cloning) to fabricate or manipulate audio, video, and imagery of individuals without consent.

A court warrant compelling cloud storage, social networks, and email providers to disclose statically stored private communications (stored messages, email archives, cloud photo drives, geolocation logs) protected by constitutional privacy privileges.

Formal bilateral and multilateral mutual legal assistance treaty (MLAT) frameworks and letters rogatory governing the lawful extraterritorial gathering of electronic evidence hosted in foreign sovereign jurisdictions.