Computer Evidence Glossary

         A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

EDMS (Electronic Document Management System): A system to electronically manage documents during all life cycles. See Electronic Document Management. EGA (Extended Graphics Adapter): See VGA.
EIA: Electronic Industries Association.
EIM: Electronic Image Management.
EISA (Extended Industry Standard Architecture): One of the standard buses used for PCs.
Electronic Discovery (“E­Discovery”): The process of collecting, preparing, reviewing, and producing electronically stored information (“ESI”) in the context of the legal process. See Discovery.

Electronic Document Management: For paper documents, involves imaging, indexing/coding and archiving of scanned documents/images, and thereafter electronically managing them during all life cycle phases. Electronic documents are likewise electronically managed from creation to archiving and all stages in between. Often referred to as ILM (information lifecycle management).

Electronic File Processing: Generally includes extraction of certain metadata and text from files, identification of duplicates/de­duplication and rendering of data into delimited format.
Electronic Image: An electronic or digital picture of a document (e.g. TIFF, PDF, etc.). Electronic Record: Information recorded in a form that requires a computer or other machine to process it and that otherwise satisfies the definition of a record. Electrostatic Printing: A process in which paper is exposed to electron charge, causing toner to stick to the charged pixels.
 Em: In any print, font or size is equal to the width of the letter “m” in that font and size. See also En.
Email (Electronic Mail): An electronic means for communicating information under specified conditions, generally in the form of text messages, through systems that will send, store, process, and receive information and in which messages are held in storage until the addressee accesses them.

Email address: An electronic mail address. Internet email addresses follow the formula: user­ID@domain­name; other email protocols may use different address formats. In some email systems, a user’s email address is “aliased” or represented by his or her natural name rather than a fully qualified email address. For example, john.doe@abc.com might appear simply as John Doe.

Email Message: A document created or received via an electronic mail system, including brief notes, formal or substantive narrative documents. Any attachments that may be transmitted with the email message, such as word processing and other electronic documents, are not part of the email message, but are part of the “Message Unit.”

Email Metadata: Data stored in the email about the email. Often this data is not even viewable in the email client application used to create the email, e.g., blind copy addressees, received date. The amount of email metadata available for a particular email varies greatly depending on the email system. Contrast with File System Metadata and Document Metadata.

Email String: A series of emails linked together by email responses or forwards. The series of email messages created through multiple responses and answers to an originating message. Also referred to as an email “thread.” Comments, revisions, and attachments are all part of an email string. See Thread.

Email Store: Files containing message units. See Container Files, Message Unit, EDB, OST, PST, and NSF.

Embedded Metadata: Generally hidden, but an integral part of ESI, such as “track changes” or “comments” in a word processing file or “notes” in a presentation file. While some metadata is routinely extracted during processing and conversion for e­discovery, embedded data may not be. Therefore, it may only available in the original, native file. See also Application Metadata and Metadata.

Embedded Object: An object embedded within another object, often appearing as an icon or hyperlink. See also Compound Document.

EML: Generic email format.

En: In any print, font or size is equal to the width of the letter “n” in that font and size. See also Em.

Encoding: To change or translate into code; to convert information into digital format. For software, encoding is used for video and audio references, like encoding analogue format into digital or raw digital data into compressed format.

Encryption: A procedure that renders the contents of a message or file scrambled or unintelligible to anyone not authorized to read it. Encryption is used to protect information as it moves from one computer to another and is an increasingly common way of sending credit card numbers and other personal information over the Internet.

Encryption Key: A data value that is used to encrypt and decrypt data. The number of bits in the encryption key is a rough measure of the encryption strength; generally, the more bits in the encryption key, the more difficult it is to break.

End Document Number or End Doc#: The last single page image of a document.

Endorser: A small printer in a scanner that adds a document­control number or other endorsement to each scanned sheet.

Enhanced Titles: A meaningful/descriptive title for a document. The opposite of Verbatim Titles.

Enterprise Architecture: Framework for how software, computing, storage and networking systems should integrate and operate to meet the changing needs across an entire business.

EOF (End of File): A distinctive code that uniquely marks the end of a data file.

 EPP (Enhanced Parallel Port): See Port. EPS (Encapsulated PostScript): Uncompressed files for images, text and objects. Can only be printed on printers with PostScript drivers.

Erasable Optical Drive: A type of optical drive that uses erasable optical discs. ESDI (Enhanced Small Device Interface): A defined, common electronic interface for transferring data between computers and peripherals, particularly disc drives.

ESI: Electronically stored information, regardless of the media or whether it is in the original format in which it was created, as opposed to stored in hard copy (i.e. on paper). Ethernet: A common way of networking PCs to create a Local Area Network (LAN). Evidentiary Image or Copy: See Forensic Copy. Exabyte: 1,152,921,504,606,846,976 bytes ­10246 (a quintillion bytes). See Byte. Exchange Server: A server running Microsoft Exchange messaging and collaboration software. It is widely

used by enterprises using Microsoft infrastructure solutions. Among other things, Microsoft Exchange manages email, shared calendars and tasks.

Expanded Data: See Decompression. Export: Data extracted or taken out of one environment or application usually in a prescribed format, and usually for import into another environment or application.

Extended Partitions: If a computer hard drive has been divided into more than four partitions, extended partitions are created. Under such circumstances each extended partition contains a partition table in the first sector that describes how it is further subdivided.

Extensible Markup Language (XML): A specification developed by the W3C (World Wide Web Consortium—the Web development standards board). XML is a pared­down version of SGML, designed especially for Web documents. It allows designers to create their own customized tag, enabling the definition, transmission, validation, and interpretation of data between applications and between organizations.

Extranet: An Internet based access method to a corporate intranet site by limited or total access through a security firewall. This type of access is often utilized in cases of joint defense, joint venture and vendor client relationships.

Glossary - Courtesy of The Sedona Conference^®