Understanding technical terms is the first hurdle to overcome in mastering electronic evidence. Here are some definitions of the less familiar terms.

Distributed Data:  Distributed Data is that information belonging to an organization which resides on portable media and non-local devices such as home computers, floppy disks, CD-ROMs, personal digital assistants (“PDAs”), wireless communication devices (e.g., Blackberry), zip drives, Internet repositories such as e-mail hosted by Internet service providers or portals, web pages, and the like.  Distributed data also includes data held by third parties such as application service providers and business partners.

Forensic Copy: A Forensic Copy is an exact bit-by-bit copy of the entire physical hard drive of a computer system, including slack and unallocated space.

Legacy Data: Legacy Data is information the development of which an organization may have invested significant resources to and that has retained its importance, but has been created or stored by the use of software and/or hardware that has been rendered outmoded or obsolete.

Metadata: Metadata is information about a particular data set which describes how, when and by whom it was collected, created, accessed, and modified and how it is formatted. Some metadata, such as file dates and sizes, can easily be seen by users; other metadata can be hidden or embedded and is unavailable to computer users who are not technically adept.  Metadata is generally no reproduced in full form when a document is printed. (Typically referred to by the not highly informative “shorthand” phrase “data about data,” describing the content, quality, condition, history, and other characteristics of the data.)

Residual Data: Residual Data (sometimes referred to as “Ambient Data”) refers to data that is not active on a computer system.  Residual data includes (1) data found on media free space; (2) data found in file slack space; and (3) data within files that have functionally been deleted in that it is not visible using the application with which the file was created, without use of the undelete or special data recovery techniques.

Migrated Data: Migrated Data is information that has been moved from one database or format to another, usually as a result of a change from one hardware or software technology to another.