Computer Evidence Glossary

         A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

Native Format: Electronic documents have an associated file structure defined by the original creating application. This file structure is referred to as the “native format” of the document. Because viewing or searching documents in the native format may require the original application (for example, viewing a Microsoft Word document may require the Microsoft Word application), documents may be converted to a neutral format as part of the record acquisition or archive process. “Static” formats (often called “imaged formats”), such as TIFF or PDF, are designed to retain an image of the document as it would look viewed in the original creating application but do not allow metadata to be viewed or the document information to be manipulated. In the conversion to static format, the metadata can be processed, preserved and electronically associated with the static format file. However, with technology advancements, tools and applications are becoming increasingly available to allow viewing and searching of documents in their native format, while still preserving all metadata.

Native Format Review: Review of ESI in its current “native” format using either an application capable of supporting native format review or the original application in which the ESI was created.

Natural Language Search: A manner of searching that permits the use of plain language without special connectors or precise terminology, such as “Where can I find information on William Shakespeare?” as opposed to formulating a search statement (such as “information” and “William Shakespeare”). See Boolean Search.

Near De­duplication: Identification and grouping or tagging of electronic files with “near duplicate” similarities, yet some differences in terms of content or metadata, or both ­for example, document versions, emails sent to multiple custodians, different parts of email chains, or similar proposals sent to several clients.

Near­Line Data: A term used to refer to ESI or a robotic storage device (robotic library) that houses removable media, uses robotic arms to access the media, and uses multiple read/write devices to store and retrieve records. Examples include optical discs.

Near­Line Data Storage: Storage in a system that is not a direct part of the network in daily use, but that can be accessed through the network. There is usually a small time lag between the request for ESI stored in near­line media and its being made available to an application or end­user. Making near­line data available will not require human intervention (as opposed to “off­line” data which can only be made available through human actions).

Network: A group of two or more computers and other devices connected together (“networked”) for the exchange and sharing of ESI and resources. A local­area network (LAN) refers to connected computers and devices geographically close together (i.e. in the same building). A wide­area network (WAN) refers generally to a network of PCs or other devices, remote to each other, connected by telecommunications lines. Typically, a WAN may connect two or more LANs together.

Network Gear: Refers to the actual hardware used in the operation of networks – for example routers, switches and hubs.

Neural Network: Neural networks are made up of interconnected processing elements called units, which respond in parallel to a set of input signals given to each.

NIST ­National Institute of Standards and Technology: a federal technology agency that works with industry to develop and apply technology measurements and standards.

NIST List: A hash database of computer file types developed by NIST to identify those generated by a system and those generated by a user.

Node: Any device connected to a network. PCs, servers, and printers are all nodes on the network.

Non­Apparent Data: Data not normally seen on a printed version of ESI ­whether “printed” to paper or image, such as tiff or pdf, e.g. spreadsheet formulas. See Embedded Metadata and Metadata.

Non­Interlace: When each line of a video image is scanned separately. Older CRT computer monitors use non­interlaced video.

NOS (Network Operating System): See Operating System.

Normalization: The process the process of reformatting data so that it is stored in a standardized form, such as setting the date and time stamp of a specific volume of ESI to a specific zone, often GMT, to permit advanced processing of the ESI, such as de­duplication. See also Coordinated Universal Time.

Notes Server: See Lotus Domino.

NSF: Lotus Notes container file (i.e. database.nsf); can be either an email database or the traditional type of fielded database. See Lotus Domino.

NTFS (New Technology File System): A high­performance and self­healing file system proprietary to Microsoft, used in Windows NT, Windows 2000, Windows XP, and Windows Vista Operating Systems, that supports file­level security, compression and auditing. It also supports large volumes and powerful storage solution such as RAID. An important feature of NTFS is the ability to encrypt files and folders to protect sensitive data.

Glossary - Courtesy of The Sedona Conference^®