Cyber Forensics: From Data to Digital Evidence

Glossary

32-bit register In computer architecture, a processor register (or general purpose register) is a small amount of storage available on the CPU whose contents can be accessed more quickly than storage available elsewhere.

Typically, this specialized storage is not considered part of the normal memory range for the machine.

Registers are normally measured by the number of bits they can hold, for example, an “8-bit register” or a “32-bit register.”

absolute address An explicit identification of a memory location, peripheral device, or location within a device.

For example, memory byte 413,679, disk drive 1, and sector 451 are absolute addresses.

The computer uses absolute addresses to reference memory and peripherals.

active partition The partition containing the operating system (OS), which is actively being used. The operating system will actually “boot up” the system/computer.

address Every byte in a file is assigned a number, called its address, starting at 0 for the first byte of the file, 1 for the second byte, and so on.

allocated Assigned. Typically refers to disk space (see Allocated space).

Any cluster currently assigned to a file is considered allocated.

allocated space Space on a storage device (i.e., disk), where the operating system has already written files to.

array A grouping of similar types of data, referenced as sequential locations. The absolute locations of items in an array may not truly be sequential in a managed memory environment. Some different ...