Computer Evidence Glossary

         A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

Magenta: Used in four color printing. Reflects blue & red and absorbs green.

Magnetic/Optical Storage Media: Includes, but is not limited to, hard drives, backup tapes, CD­ROMs, DVD­ROMs, Jaz and Zip drives.

Magneto­Optical Drive: A drive that combines laser and magnetic technology to create high­capacity erasable storage.

Mailbox: An area on a storage device where email is placed. In email systems, each user has a private mailbox. When the server receives email, the mail system automatically puts it in the appropriate mailbox.

Make­Available Production: A process whereby what is usually a large universe of potentially responsive documents are made available to the requestor; from which universe, the requestor then reviews and selects or tags the documents they wish to obtain, and the producing party produces to the requestor only the selected documents. This is sometimes done under an agreement protecting against privilege and confidentiality waiver during the initial make available production; and the producing party, after the requestor has selected the documents they wish to obtain, reviews only the selected documents for privilege and confidentiality before the selected documents are physically produced to the requestor.

Malware: Any type of malicious software program, typically installed illicitly, including viruses, Trojans, worms, key loggers, spyware, adware and others.

MAPI (Mail Application Program Interface): A Windows software standard that has become a popular email interface used by MS Exchange, GroupWise, and other email packages.

MAPI Mail Near­Line: Documents stored on optical discs or compact discs that are housed in the jukebox or CD changer and can be retrieved without human intervention.

Marginalia: Handwritten notes in the margin of the page in documents.

Master Boot Sector/Record: The sector on a hard drive which contains the computer code (boot strap loader) necessary for the computer to start up and the partition table describing the organization of the hard drive.

Mastering: Making many copies of a disc from a single master disc.

MBOX: The format in which email is stored on traditional UNIX email systems.

MCA (Micro Channel Architecture): IBM bus standard rendered obsolete by the PCI bus.

MDE (Magnetic Disc Emulation): Software that makes a jukebox look and operate like a hard­drive such that it will respond to all the I/O commands ordinarily sent to a hard drive.

MD5: Message­digest algorithm meant for digital signature applications where a large message has to be “compressed” in a secure manner before being signed with the private key. See Hash.

Media: An object or device, such as a disc, tape, or other device, on which data is stored.

Megabyte (M or MB): 1,048,576 bytes ­1,0242 (a million bytes). See Byte.

Memory: Data storage in the form of chips, or the actual chips used to hold data; “storage” is used to describe memory that exists on tapes, discs, CDs, DVDs, key drives and hard drives. See RAM and ROM.

Menu: A list of options, each of which performs a desired action such as choosing a command or applying a particular format to a part of a document.

Message Header: Message headers generally contain the identities of the author and recipients, the subject of the message, and the date the message was sent.

Message Unit: An email and any attachments that are associated with the email.

Metadata: Data typically stored electronically that describes characteristics of ESI, found in different places in different forms. Can be supplied by applications, users or the file system. Metadata can describe how, when and by whom ESI was collected, created, accessed, modified and how it is formatted. Can be altered intentionally or inadvertently. Certain metadata can be extracted when native files are processed for litigation. Some metadata, such as file dates and sizes, can easily be seen by users; other metadata can be hidden or embedded and unavailable to computer users who are not technically adept. Metadata is generally not reproduced in full form when a document is printed to paper or electronic image. See also Application Metadata, Document Metadata, Email Metadata, Embedded Metadata, File System Metadata, User­Added Metadata and Vendor­Added Metadata. For a more thorough discussion, see The Sedona Guidelines: Best Practice Guidelines & Commentary for Managing Information & Records in the Electronic Age (Second Edition).

Metadata Comparison: A comparison of specified metadata as the basis for de­duplication without regard to content. See De­Duplication.

MFT (Master File Table): Index to files on a computer. If corrupt, a drive may be unusable, yet ESI may be retrievable using forensic methods.

MICR (Magnetic Ink Character Recognition): The process used by banks to encode checks.

Microfiche: Sheet microfilm (4” by 6”) containing reduced images of 270 pages or more in a grid pattern.

Microsoft Outlook: A personal information manager from Microsoft, part of the Microsoft Office suite. Although often used mainly as an email application, it also provides calendar, task and contact management, note taking, a journal and web browsing. Can be used as a stand­alone application, or operate in conjunction with Microsoft Exchange Server to provide enhanced functions for multiple users in an organization, such as shared mailboxes and calendars, public folders, and meeting time allocation.

Microsoft Outlook Express: A scaled down version of Microsoft Outlook.

Migrated Data: ESI that has been moved from one database or format to another.

Migration: Moving ESI to another computer application or platform; may require conversion to a different format.

Mirror Image: A bit by bit copy of the device that ensures it is not altered during the imaging process. See Forensic Copy.

Mirroring: The duplication of ESI for purposes of backup or to distribute Internet or network traffic among several servers with identical ESI. See also Disc Mirroring and Bit Stream Backup.

MIS: Management Information Systems.

MODEM: Modulator/Demodulator. A device that translates digital data from a computer into analog signals (modulates) and transmits the information over telephones lines. Another modem at the receiving computer will receive the information, translate it back from analog to digital (demodulate) and store it.

Monochrome: Displays capable of only two colors, usually black and white, or black and green.

Mosaic: A web browser popular before the introduction of Netscape and Internet Explorer.

Mount, Mounting: The process of making off­line ESI available for on­line processing. For example, placing a magnetic tape in a drive and setting up the software to recognize or read that tape. The terms “load” and “loading” are often used in conjunction with, or synonymously with, “mount” and “mounting” (as in “mount and load a tape”). “Load” may also refer to the process of transferring ESI from mounted media to another media or to an on­line system.

MPEG­1, ­2, ­3, and ­4: Different standards for full motion video to digital compression/decompression techniques advanced by the Moving Pictures Experts Group. MPEG­1 compresses 30 frames/second of full­motion video down to about 1.5 Mbits/sec from several hundred megabytes. MPEG­2 compresses the same files down to about 3.0 Mbits/sec and provides better image quality. MPEG­3 refers to the playing of CD clips.

MS­DOS: Microsoft (MS)­Disc Operating System. Used in PCs as the control system prior to the introduction of 32­bit operating systems.

MSG: Generic format in which emails can be saved.

MTBF (Mean Time Between Failure): Average time between failures. Used to compute the reliability of devices/equipment.

MTTR (Mean Time To Repair): Average time to repair. The higher the number, the more costly and difficult to fix.

Multimedia: The combined use of different media; integrated video, audio, text and data graphics in digital form.

Multisynch: Analog video monitors that can receive a wide range of display resolutions, usually including TV (NTSC). Color analog monitors accept separate red, green & blue (RGB) signals.

Glossary - Courtesy of The Sedona Conference^®