Digital Evidence Glossary
Boston-based, serving clients nationwide

Common terms (plain language)

Chain of custody

A record shofavorable outcomeg who had the evidence, when, and what was done to protect integrity.

Forensic image (bit-for-bit)

A capture of storage content designed to preserve data structure and context. Used when appropriate and authorized.

Hash value

A cryptographic fingerprint used to verify that a file or image has not changed.

Preservation vs. analysis

Preservation focuses on defensible capture and documentation. Analysis interprets content and may require separate retention.

Litigation hold

A directive to preserve relevant information when litigation is anticipated or ongoing.