The digital world is known for acronyms and jargon, which can be overwhelming for non-technology based vocabularies. To help you navigate the technology speak, Avansic created the following list of key terms.
BYOD - Otherwise known as "Bring Your Own Device." A use policy that some companies and firms are adopting that allows users to select their electronic devices (ie, iPhones and iPads).
Clawback - Clawback is a method of data exchange suggested by the Federal Rules of Civil Procedure in which one party releases data to another party without relinquishing the right to later declare items or documents within as privileged. In practice, clawback is best performed using a third party intermediary.
Clustering - Grouping documents based on unsupervised machine learning. Some also call this advanced analytics, technology assisted review, and predictive coding.
Culling - Culling is the process of removing clearly non-responsive items from a data set; for example, removing junk mail or de-NISTing the contents of a hard drive. Culling is a high level process that seeks to reduce a data set by removing the most obviously unimportant items.
Data Carving - Data carving is the process of examining a computerís slack and free space to try and discover any relevant file artifacts.
De-Duplication (or "deduping") - De-duplication is the process of removing duplicate files. A different process of de-duplication is typically used for files and email.
De-NISTing - De-NISTing is the process of removing commonly found files on computers that involve the machineís internal operations. This is a common step performed to reduce a data set during ESI processing. There are many lists of known files available; the most commonly used is the National Software Reference Library from NIST. This is also called "Known File Filtering" or "KFF".
Digital Forensics - Digital forensics involves the investigation of a data set that includes hidden or deleted information on computers, cell phones and other electronic devices. This is a focused approach to finding data that yields a targeted and relevant data set.
Early Case Assessment - Early case assessment is a process to help determine the devices and information relevant to a particular case. This is a way to reduce the cost of e-discovery from the early stages. Avansic provides each customer with a Project Manager to consult for this type of assessment.
E-Discovery - E-discovery is a broad approach that works to filter and convert data into a reduced set of usable documents for attorney review. It generally includes all active files on a computer hard drive.
En Camera - Set of documents containing all privileged documents, as well as the privilege log, and when documents are being produced during the course of litigation.
ESI (Electronically Stored Information) - Electronically Stored Information is any information stored on a digital device or on digital media. This term is commonly used in the e-discovery industry.
ESI Processing - ESI processing is a general term that typically applies to any the filtering, searching, and de-duplication stage of e-discovery. Both digital forensics and e-discovery
Filtering - Filtering is the stage of ESI Processing where the data set is reduced by keywords, date restrictions, custodians, or phrases.
Forensic Examiner - A forensics examiner is a professional trained in recovering digital information for legal or investigative purposes.
Forensics Copy (Image) - A forensics copy or image is a special copy of a hard drive taken by a forensics specialist that duplicates every single piece of information, written as 0s and 1s, on the hard drive. This special copy ensures that all of the information on the drive can be investigated, including deleted files.
Hard Drive - A hard drive is the part of a computer that contains all programs, documents and the operating system. This is the device that is copied during a forensics collection. Hard drives can also be contained within other electronic devices, including iPods.
Hash - A hash value is a small digital fingerprint of data commonly used to test if data has been altered. Common hashes include MD5 and SHA.
Indexing - Indexing is a term used to describe the preparation of data to be searched. Similar to the index in the back of a textbook, this process allows quick and ready searching of the entire electronic device. For other searching techniques, the addition of a keyword or term requires a search of the entire drive again.
Information Security/Information Assurance - The practice of protecting, detecting and preventing information systems from unauthorized and potentially harmful events.
Internet History - Internet history is a computerís record of which Web sites have been visited. The specific information will depend on which browser was used and the settings for that browser.
Loadfile - A loadfile is a file used to import data into a software program. The most common loadfiles are destined for Summation and Concordance. A Concordance load file (also called a .dat or .opt file) is nothing more than a sophisticated spreadsheet with rows and columns. A Summation loadfile is a text file with a list of items. Loadfiles contain information that directs the program how to handle data.
Managed Services - Managed Services is a way for you to be able to process and review or just review your data, using Avansic's hardware and software that resides at our office. Clients have the ability to log on to their system at any time, but handling servers, licenses, and updates is performed by Avansic. Managed Services gives clients immediate access to very powerful processing and review tools without the hassle of negotiating contracts for software, purchasing hardware, and hiring the personnel to setup and maintain those tools.
Metadata - Metadata is "data about data", which refers to information captured about a document that isnít necessarily viewable; this may include access dates, formatting changes, save locations, and users of a document.
Native File - A native file is a file produced in the same form in which it was created and stored. For instance, a Word document that is produced as .doc file or an Excel file that is produced as .xls file is a native file.
Online Review - The process of reviewing documents using electronic tools and electronic document repositories. Tools typically allow the user to collaborate on a project, tagging, sorting and organizing documents.
Privilege Log - When documents are held back from being produced due to privileged content, such as attorney-client or doctor-patient communications, a privilege log is kept of the specific documents and the reason for their exclusion. This log is produced to the opposing counsel and to the judge for the case.
Predictive Coding - Uses training sets and supervised machine learning to assign a document into a particular category. There are a variety of tools and workflows available to facilitiate this process.
Production - Production is the release of documents requested by the other partyís attorneys during litigation. Production can also include the release of documents from a digital forensics or electronic discovery firm to clients, generally in the form of a CD or DVD.
PST, OST (Mail Store) - If Microsoft Outlook is used as the e-mail program, e-mails are stored in a single file with the extensions ".pst" or ".ost."
Redaction - Redaction is removing sensitive information from a document or document set before release to either the opposing party or to the public. It is common to redact privileged information from a production set before turning it over to the opposing party. Another example of redaction is removing classified information from government documents before making them publicly available.
Server (File or Email) - A server is a computer used to allow general access to commonly used files and software through a network. Servers have much more storage and processing capacity than desktop computers.
Slack/Free Space - Slack and free space is the unused space on a hard drive that contains leftover and deleted information. A digital forensics image of a hard drive captures this information, which allows forensics professionals to piece together deleted files.
TIFF, JPG, PDF files - These are common file types for electronic document production. .TIFF and .JPG file types are image files, and .PDF is a document file that is generally used to transfer content that the user does not wish to be changed. PDF files appear the same regardless of the computerís operating system.