INSIGHTS · GLOSSARY
Glossary of forensic terms
Short, plain definitions of the words you will meet in forensic reports and screening results.
Last reviewed
- ACE-V
- A four-stage method for comparing fingerprints: Analysis, Comparison, Evaluation and Verification. An examiner studies the unknown print, compares it with a known one, reaches a conclusion, and a second examiner then checks that conclusion. The ACE-V method explained ›
- Adverse media
- Published news or reports linking a person or company to wrongdoing, such as fraud, corruption or serious misconduct. Reviewing it is a common part of screening, although a press report is a lead to check rather than a finding in itself. Global sanctions check ›
- Asset tracing
- Following money or property from where it started to where it is now, through accounts, companies and transfers. It is often used when funds have been diverted and someone hopes to recover them. Asset tracing and recovery ›
- Beneficial owner (UBO)
- The individual who ultimately owns or controls a company, even when the shares are held in someone else’s name or through other companies. UBO stands for ultimate beneficial owner. Corporate due diligence ›
- Chain of custody
- A running record of who has held an item of evidence, when, and what was done with it, from collection onwards. Gaps in that record can invite questions about whether the item was changed along the way. Digital evidence chain of custody ›
- Chip-off
- A technique in which the memory chip is removed from a device’s circuit board and read directly. It is usually reserved for damaged devices where other extraction methods are not possible. Forensic data recovery ›
- Deleted data recovery
- Retrieving files or records that a user or program has removed. Deletion often only marks space as free, so the content can survive until new data overwrites it; once overwritten, it is usually gone. Can deleted WhatsApp messages be recovered? ›
- Due diligence
- Research carried out before a decision, such as an investment, a partnership or a hire, to confirm that a company or person is what they appear to be. Its depth is usually matched to the size of the risk. Which check do I need? ›
- Exemplar
- A sample of known origin used for comparison with a questioned item, for example a set of genuine signatures or a page printed on a particular machine. Good exemplars are close in date and type to the item being examined. How document examination works ›
- Expert witness
- A person with specialist knowledge who gives the court an opinion on matters outside ordinary experience. The expert’s duty is to help the court understand the evidence, not to argue for the party that engaged them. How an investigation runs ›
- Forensic image
- An exact, bit-for-bit copy of a storage device, including empty and deleted areas as well as visible files. Examiners work on the image so that the original stays untouched. Digital forensics investigation ›
- Handwriting comparison
- Examining a questioned piece of writing against known writing to assess whether the same person produced both. Examiners look at letter forms, proportions, spacing, pen pressure and fluency, and weigh similarities against differences. Questioned document examination ›
- Hash value
- A short string of characters calculated from a file or disk by a mathematical function. Changing even one bit of the data produces a different value, so matching hashes show that a copy is identical to its source. Digital evidence chain of custody ›
- Incident response
- The organised work of containing a security breach, finding out what happened and restoring normal operation. Preserving logs and affected systems early makes the later investigation far easier. After a breach: what to preserve ›
- Indentation
- Faint impressions left on a sheet of paper by writing done on a sheet that was resting on top of it. Recovering indentations can reveal notes or the order in which pages were written. How document examination works ›
- Known writing
- Handwriting or signatures whose author is not in dispute, collected for comparison. It may be written in the normal course of life, such as old letters or forms, or produced on request for the examination. Questioned document examination ›
- Latent print
- A fingerprint left on a surface that is not readily visible to the eye. It is usually made visible with powders, chemicals or lighting before it can be photographed and compared. Fingerprint analysis ›
- Logical extraction
- Copying the data a phone or computer makes available through its normal software interfaces, such as contacts, messages and media. It is quicker than a physical extraction but usually reaches less deleted material. Mobile device forensics ›
- Metadata
- Information stored about a file rather than in its visible content, such as when it was created, edited or sent, and by which device or program. It can support or contradict an account of events, but it can also be altered and needs careful interpretation. Digital evidence and the chain of custody ›
- Minutiae
- The small features within fingerprint ridges, such as ridge endings, bifurcations and dots. Their type, position and relationship to one another are what an examiner compares between two prints. The ACE-V method explained ›
- Non-linear junction detector (NLJD)
- A handheld instrument used in counter-surveillance sweeps to locate hidden electronic components. It detects the harmonic responses produced by semiconductor junctions, so it can find a device whether or not it is switched on. Technical surveillance countermeasures ›
- OSINT
- Open-source intelligence: information gathered lawfully from publicly available sources, such as websites, social media, news and published records. Its value depends on checking each item against independent sources. OSINT investigations ›
- Physical extraction
- A low-level copy of a device’s memory, taken beneath the normal operating system. Where a device supports it, it can reach deleted and system data that a logical extraction cannot. Mobile device forensics ›
- Police clearance certificate (PCC)
- An official document issued by the police stating whether the named person has a recorded criminal history. Employers and immigration authorities often ask for one, and it is obtained with the person’s consent. Criminal record check ›
- Politically exposed person (PEP)
- Someone who holds or has held a prominent public role. Their close family and associates are usually screened as connected persons. Being a PEP is not wrongdoing, but it usually calls for closer checks because of the higher risk of corruption. Global sanctions check ›
- Pre-employment screening
- Checks on a job candidate before an offer is confirmed, such as identity, qualifications, past employment and criminal record. They are carried out with the candidate’s knowledge and consent. Pre-employment screening guide ›
- Questioned document
- Any document whose authorship, origin, date or integrity is in dispute, for example a will, contract, cheque or certificate. Examining it can involve the handwriting, signatures, inks, paper and any alterations. How document examination works ›
- Sanctions screening
- Checking names of people and companies against lists of parties that governments or international bodies have placed under restrictions. A possible match has to be reviewed carefully, since different people can share a name. Global sanctions check ›
- Surveillance indicators
- Signs that conversations or devices may be monitored, such as confidential information leaking without explanation or unfamiliar apps on a phone. None of them is conclusive alone, but together they can justify a professional check. Signs you may be under surveillance ›
- TSCM
- Technical surveillance countermeasures: a structured search of offices, boardrooms or homes for hidden listening or recording equipment. It combines physical inspection with electronic detection. Technical surveillance countermeasures ›
- UV/IR examination
- Viewing a document under ultraviolet and infrared light. Inks and papers that look identical in daylight can react differently, which can reveal additions, erasures or substituted pages. Questioned document examination ›
- Volatile memory
- Memory, such as a computer’s RAM, that loses its contents when the power goes off. It can hold running programs, network connections and encryption keys, so it may need capturing before a machine is shut down. Computer and memory forensics ›
- Whistleblower report
- A concern raised by an insider about suspected wrongdoing within an organisation. It is often the starting point for an internal investigation and calls for discretion to protect both the person reporting and the evidence. Responding to suspected internal fraud ›
- Write-blocker
- A device or setting placed between a storage drive and an examiner’s computer that allows data to be read but prevents anything being written back. It protects the original from accidental change during copying. Digital evidence chain of custody ›