|
| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z |
Admissible: Evidence that is acceptable or allowable in court.
Application: A collection of one or more related software programs that enable a user to enter, store, view, modify, or extract information from files or databases.
Archival Data: Information that is not directly accessible to the user of a computer system but that the organization maintains for long-term storage and record keeping purposes.
Archive/Electronic Archive: Long-term repositories for the storage of records. Electronic archives preserve the content, prevent or track alterations, and control access to electronic records.
Attachment: A record or file associated with another record for the purpose of storage or transfer. There may be multiple attachments associated with a single "parent" or "master" record. The attachments and associated record may be managed and processed as a single unit.
Author/Originator: The person, office, or designated position responsible for its creation or issuance. In the case of a document in the form of a letter, the author or originator is usually indicated on the letterhead or by signature.
Back to top
Backup: A copy of data as a precaution against the loss or damage of the original data. Most users backup some of their files, and many computer networks utilize automatic backup software to make regular copies of some or all of the data on the network.
Backup Tape: Backup or disaster recovery tapes are portable media used to store data that is not presently in use by an organization to free up space but still allow for disaster recovery.
Bandwidth: The amount of information or data that can be sent over a network connection in a given period of time. Bandwidth is usually stated in bits per second (bps), kilobits per second (kbps), or megabits per second (mps).
Bates Production Number: A tracking number assigned to each page of each document in the production set.
Byte: Eight bits. A byte is a collection of bits used by computers to represent a character (i.e., "a," "1," or "&"). A gigabyte = 1,000 megabytes and 1 terabyte = 1,000 gigabytes.
Back to top
Cache: A type of computer memory that temporarily stores frequently used information for quick access.
Chain-of-Custody: A process used to maintain and document the chronological history of electronic evidence. A chain-of-custody ensures that the data presented is "as originally acquired" and has not been altered prior to admission into evidence.
Coding: Document coding is the process of capturing case-relevant information (i.e., author, date authored, date sent, recipient, date opened) from a paper document.
Compression: A technology that reduces the size of a file. It’s valuable to network users because they help save both time and bandwidth.
Computer Forensics: The use of specialized techniques for recovery, authentication, and analysis of electronic data when a case involves issues relating to reconstruction of computer usage and authentication of data by technical analysis or explanation of technical features of data and computer usage.
Back to top
DAT (Digital Audio Tape): Used as a storage medium in some backup systems.
Data: Information residing on the direct access storage media of computer systems, which is readily visible to the operating system and/or application software with which it was created and immediately accessible to users without restoration, modification, or reconstruction.
Data Extraction: The process of removing files and meta-data from backup tapes.
De-duplication: De-duping is the process of comparing electronic records based on their characteristics and removing duplicate records from the data set.
Deleted Data: Data that, in the past, existed on the computer as live data and which has been deleted by the computer system or end-user activity. Deleted data remains on storage media in whole or in part until it is overwritten by ongoing usage or "wiped" with a software program specifically designed to remove deleted data.
Deleted File: A file with disk space that has been designated as available for reuse. The deleted file remains intact until it has been overwritten with a new file.
Discovery: A pre-trial process in which each party tries to find all the information held by the other party and by certain third parties that is relevant, probative, and can be admitted into evidence at trial.
Document: A document includes writings, drawings, graphs, charts, photographs, phone records, and other data compilations.
Back to top
Electronic Discovery: The discovery of electronic documents and data including e-mail, word processing files, computer databases, and virtually anything that is stored on a computer. Technically, documents and data are "electronic" if they can only be read through the use of computers.
Electronic Evidence: Electronic information (like paper) generally is admissible into evidence in a legal proceeding.
Electronic Mail Message: A document created or received via an electronic mail system, including any attachments, such as word processing and other electronic documents, which may be transmitted with the message. Also, see “E-mail” below.
E-mail: The whole of an electronic document containing the message envelope and message content (attachments, etc.). Also, see “Electronic Mail Message” above.
E-mail Message Store: The location in which an e-mail system stores its data. For example, an Outlook PST (personal storage folder) is a type of top most file that is created when a user's Microsoft Outlook mail account is set up.
Encryption: A procedure that renders the contents of a message or file unintelligible to anyone not authorized to read it.
ESI: Electronically Stored Information
Back to top
Family Range: The range of documents from the first Bates production number assigned to the first page of the top most parent document through the last Bates production number assigned to the last page of the last child document.
Family Relationship: Two or more documents that have a connection or relatedness because of some factor.
File Extension: A tag of three or four letters, preceded by a period, which identifies a data file's format or the application used to create the file. File extensions can streamline the process of locating data.
File Server: When several or many computers are networked together in a LAN situation, one computer may be utilized as a storage location for files for the group. File servers may be employed to store e-mail, financial data, word processing information, or to back-up the network.
File Sharing: One of the key benefits of a network is the ability to share files stored on the server among several users.
Filtering: Electronic filtering of e-mails and files for privilege or by keyword, file type, or name. Filtering removes files that don't fit the search criteria and reduces the volume of data that requires further investigation.
Forensically Sound Procedures: Procedures used for acquiring electronic information in a manner that ensures it is "as originally discovered" and is reliable enough to be admitted into evidence.
Format: The internal structure of a file, which defines the way it is stored and used. Specific applications may define unique formats for their data (e.g., MS Word document). Many files may only be viewed or printed using their originating application or an application designed to work with compatible formats.
Fragmented Data: Live data that has been broken up and stored in various locations on a single hard drive or disk.
FTP (File Transfer Protocol): An Internet protocol that enables you to transfer files between computers on the Internet.
Back to top
Gigabyte (GB): A measure of computer data storage capacity. 1 gigabyte = 1 billion (1,000,000,000) bytes of data.
Back to top
Hard Drive: The primary storage unit on PCs, consisting of one or more magnetic media platters on which digital data can be written and erased magnetically.
Hash: An algorithm that creates a value to verify duplicate electronic documents. A hash value serves as a digital thumbprint.
Back to top
Inactive Record: Records related to closed, completed, or concluded activities. Inactive records are no longer routinely referenced, but must be retained in order to fulfill reporting requirements or for purposes of audit or analysis.
Internal Inquiries: A close examination of a matter in a search for information or truth that is internal to a company.
IP Address: A string of four numbers separated by periods used to represent a computer on the Internet.
Back to top
JPEG: An image compression standard for photographs.
Back to top
Keyword Search: A search for documents containing one or more words that are specified by a user.
Kilobyte (Kb): A measure of computer data storage capacity. 1 kilobyte = 1 thousand (1,000) bytes of data.
Back to top
LAN (Local Area Network): A network of computers in a single location.
Legacy Data: Information in the development of which an organization may have invested resources and which has importance, but has been stored and rendered obsolete.
Legal Hold: Communication issued as a result of current or anticipated litigation, audit, government investigation, or other such matter that suspends the normal disposition or processing of records.
Back to top
Media: The physical material used to store electronic data, including hard drives, backup tapes, computer disks, CD/DVD, PDA, memory, etc.
Merge: The process of combining various e-mail files into one file for de-duplication purposes.
Metadata: Information about a particular data set which describes how, when, and by whom it was received, created, accessed, and/or modified and how it is formatted. Some metadata, such as file dates and sizes, can easily be seen by users; other metadata can be hidden or embedded and unavailable to computer users who are not technically adept.
Migrated Data: Information that has been moved from one database or format to another, usually as a result of a change from one hardware or software technology to another.
Mirror Image: Used in computer forensic investigations and some electronic discovery investigations, a mirror image is a bit-by-bit copy of a computer hard drive that ensures the operating system is not altered during the forensic examination.
Back to top
Native File: A file saved in the format of the original application used to create the file. Dealing with native files can minimize expensive per-page costs for the traditional TIFF and/or PDF processing and will maximize the relevant information available from the file.
Native Format: Electronic documents have an associated file structure defined by the original creating application. This file structure is referred to as the "native format" of the document.
Nesting: Nesting occurs when one document is inserted within another document (e.g., an attachment is nested within an e-mail; graphics files are nested within a Microsoft Word document).
Back to top
OCR (Optical Character Recognition): A technology which takes data from a paper document and turns it into editable text data. The document is first scanned and then OCR software searches the document for letters, numbers, and other characters.
Online Storage: The storage of electronic data as fully accessible information in daily use on the network or elsewhere.
Back to top
Paper Discovery: Refers to the discovery of writings on paper that can be read without the aid of some devices.
Parent-child Relationships: A term used in e-Discovery to describe a chain of documents that stems from a single e-mail or storage folder. These types of relationships are primarily encountered when a party is faced with a discovery request for e-mail.
PDF (Portable Document Format): An Adobe technology for formatting documents so that they can be viewed and printed using the Adobe Acrobat reader.
Petabyte (PB): A measure of computer data storage capacity. 1 petabyte = 1 thousand million million (1,000,000,000,000,000) bytes of data.
Pointer: An index entry in the directory of a disk (or other storage medium) that identifies the space on the disc in which an electronic document or piece of electronic data resides, thereby preventing that space from being overwritten by other data.
Production: Delivery of data or information in response to an interrogatory, subpoena or discovery order, or a similar legal process.
PST (Personal Folder File): The place where Outlook stores its data (when Outlook is used without Microsoft® Exchange Server). A PST file is created when a mail account is set up.
Back to top
Record: Information, regardless of medium or format, that has value to an organization. Collectively, the term is used to describe both documents and electronically stored information.
Record Custodian: An individual responsible for the physical storage and protection of records throughout their retention period. In the context of electronic records, custodianship may not be a direct part of the records management function in all organizations.
Records Management: The planning, controlling, directing, organizing, training, promoting, and other managerial activity involving the lifecycle of information, including creation.
Records Retention Period: The length of time a given records series must be kept, expressed as either a time period and event or action.
Repository: A centralized database stored on a computer that houses specific information.
Repository for Electronic Records: A direct access device on which the electronic records and associated metadata are stored. Sometimes called a "records store," "online repository," or "records archive."
Residual Data: Refers to data that is not active on a computer system. Residual data includes data found on media free space; data found in file slack space; and data within files that has functionally been deleted.
Back to top
Sampling: The process of statistically testing a data set for the likelihood of relevant information. It can be a useful technique in addressing a number of issues relating to litigation, including decisions as to which repositories of data should be preserved and reviewed in a particular litigation, and determinations of the validity and effectiveness of searches or other data extraction procedures.
Scanning: The process of converting a hard copy paper document into a digital image for use in a computer system. After a document has been scanned, it can be reviewed using field and full-text searching, instant document retrieval, and a complete range of electronic document review options.
Searching: The ability to look within the data and search by a name, date, or keyword to find desired information.
Server: Any computer on a network that contains data or applications shared by users of the network on their client PCs.
Spoliation: The destruction of records which may be relevant to ongoing or anticipated litigation, government investigation, or audit. Courts differ in their interpretation of the level of intent required before sanctions may be warranted.
Back to top
Terabyte (TB): A measure of computer data storage capacity. 1 terabyte = 1 thousand billion (1,000,000,000,000) bytes of data.
TIFF (Tagged Image File Format): One of the most widely supported file formats for storing bit-mapped images. Files in TIFF format often end with a .tif extension.
Transmission Control Protocol/Internet Protocol (TCP/IP): A collection of protocols that define the basic workings of the features of the Internet.
Back to top
Unallocated Space: Space on a hard drive that potentially contains intact files, remnants of files, subdirectories, or temporary files which were created and then deleted by either a computer application, the operating system, or the operator.
Back to top
Website: A collection of Uniform Resource Indicators (URIs), including Uniform Resource Locators (URLs) in the control of one administrative entity.
Back to top
ZIP: An open standard for compression and decompression used widely for PC download archives. ZIP is used on Windows-based programs such as WinZip and Drag and Zip. The file extension given to ZIP files is .zip.
|
Glossary
